Agents

Security check static checks

40 out of 100

Reads what is published about the server: package advisories, licence, secrets in the documented setup and tool permissions. Nothing is installed or run, so this is not a security assessment. Checked 24 Oct 2026 by edna-skill-static-v1 main@d001185d792e. What it checks

• Critical Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used (affects next 16.1.0, pinned in package.json).
• Critical Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used (affects next 16.1.0, pinned in package.json).
• Critical Next.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays (affects next 16.1.0, pinned in package.json).
• Critical Next.js: Unauthenticated Remote Code Execution on windows-hosted servers (affects next 16.1.0, pinned in package.json).
• High Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes (affects next 16.1.0, pinned in package.json).
• High Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Up (affects next 16.1.0, pinned in package.json).
• High Next.js has a Middleware / Proxy bypass in Pages Router applications using i18n (affects next 16.1.0, pinned in package.json).
• High Next.js has a Middleware / Proxy bypass through dynamic route parameter injection (affects next 16.1.0, pinned in package.json).
• High Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale (affects next 16.1.0, pinned in package.json).
• High Next.js: Server-Side Request Forgery in Server Actions on custom servers (affects next 16.1.0, pinned in package.json).
• High Next.js Vulnerable to Denial of Service with Server Components (affects next 16.1.0, pinned in package.json).
• High Next.js vulnerable to server-side request forgery in applications using WebSocket upgrades (affects next 16.1.0, pinned in package.json).
• High Next.js has Server-Side Request Forgery in Image Optimization (affects next 16.1.0, pinned in package.json).
• High Next.js HTTP request deserialization can lead to DoS when using insecure React Server Components (affects next 16.1.0, pinned in package.json).
• High Next.js: Denial of Service in App Router using Server Actions (affects next 16.1.0, pinned in package.json).
• High Next.js vulnerable to Denial of Service via connection exhaustion in applications using Cache Components (affects next 16.1.0, pinned in package.json).
• High Next.js: Denial of Service in App Router using Server Actions (affects next 16.1.0, pinned in package.json).
• High Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname (affects next 16.1.0, pinned in package.json).
• High Next.js has a Denial of Service with Server Components (affects next 16.1.0, pinned in package.json).
• Medium Next.js: Unbounded next/image disk cache growth can exhaust storage (affects next 16.1.0, pinned in package.json).
• Medium Next.js: Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences (affects next 16.1.0, pinned in package.json).
• Medium Next.js: Unbounded Server Action payload in Edge runtime (affects next 16.1.0, pinned in package.json).
• Medium Next.js has cache poisoning of SSG and ISR pages in self-hosted applications (affects next 16.1.0, pinned in package.json).
• Medium Next.js has Unbounded Memory Consumption via PPR Resume Endpoint (affects next 16.1.0, pinned in package.json).
• Medium Next.js: Cache confusion of response bodies for requests with bodies (affects next 16.1.0, pinned in package.json).
• Medium Next.js: Unauthenticated disclosure of internal Server Function endpoints (affects next 16.1.0, pinned in package.json).
• Medium Next.js self-hosted applications vulnerable to DoS via Image Optimizer remotePatterns configuration (affects next 16.1.0, pinned in package.json).
• Medium Next.js has information disclosure in App Router metadata image routes via dynamicParams bypass (affects next 16.1.0, pinned in package.json).
• Medium Next.js vulnerable to cross-site scripting in App Router applications using CSP nonces (affects next 16.1.0, pinned in package.json).
• Medium Next.js: HTTP request smuggling in rewrites (affects next 16.1.0, pinned in package.json).
• Medium Next.js has cross-site scripting in beforeInteractive scripts with untrusted input (affects next 16.1.0, pinned in package.json).
• Medium Next.js: Unbounded postponed resume buffering can lead to DoS (affects next 16.1.0, pinned in package.json).
• Medium Next.js has a Denial of Service in the Image Optimization API (affects next 16.1.0, pinned in package.json).
• Medium Next.js has cache poisoning in SSG/ISR rendering that leads to cross-user content substitution and persistent denial of service (affects next 16.1.0, pinned in package.json).
• Medium Next.js: null origin can bypass Server Actions CSRF checks (affects next 16.1.0, pinned in package.json).
• Medium Next.js: Denial of Service in the Image Optimization API using SVGs (affects next 16.1.0, pinned in package.json).
• Medium Next.js vulnerable to cache poisoning in React Server Component responses (affects next 16.1.0, pinned in package.json).
• Low Next.js has information disclosure in development server's Model Context Protocol endpoint (affects next 16.1.0, pinned in package.json).
• Low Next.js's Middleware / Proxy redirects can be cache-poisoned (affects next 16.1.0, pinned in package.json).
• Low Next.js: null origin can bypass dev HMR websocket CSRF checks (affects next 16.1.0, pinned in package.json).
• Low Next.js vulnerable to cache poisoning via collisions in React Server Component cache-busting (affects next 16.1.0, pinned in package.json).
• Note 1 of 6 packages are not pinned to one version, so only the malicious packages list was checked for them, not version advisories.