CVE-2025-13984

Next.js - Critical - Access bypass - SA-CONTRIB-2025-122 PUBLISHED

Description (CNA)

Permissive Cross-domain Security Policy with Untrusted Domains vulnerability in Drupal Next.Js allows Cross-Site Scripting (XSS).This issue affects Next.Js: from 0.0.0 before 1.6.4, from 2.0.0 before 2.0.1.

Affected (CNA)

Vendor / product	Versions
Drupal / Next.js	affected 0.0.0 before 1.6.4; affected 2.0.0 before 2.0.1

CWE

CWE-942

References

https://www.drupal.org/sa-contrib-2025-122

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.