Issue Station
Sign In
Tools hereToolbox

nextjs - 💡(How to fix) Fix Docs: Possible inconsistencies on published advisories [3 comments, 3 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
vercel/next.js#84555•Fetched 2026-04-08 02:19:03
View on GitHub
Comments
3
Participants
3
Timeline
9
Reactions
0
Author
cfi-gbcfi-gb
Participants
cfi-gbcfi-gbgithub-actions[bot]github-actions[bot]wim-vercelwim-vercel
Timeline (top)
commented ×3closed ×1issue_type_added ×1labeled ×1

Root Cause

i had reported the following below to [email protected] more then a month ago but never received an answer / action so trying it here as well because this is not really a new vulnerability report but an update to existing advisories. If this is not the correct place feel free to close again and push this topic to the responsible team again.

Fix Action

Fix / Workaround

Affected versions: >15.0.4 and <15.2.0 Patched versions: ≤15.0.4 and ≥15.2.0

RAW_BUFFERClick to expand / collapse

What is the documentation issue?

Hi,

i had reported the following below to [email protected] more then a month ago but never received an answer / action so trying it here as well because this is not really a new vulnerability report but an update to existing advisories. If this is not the correct place feel free to close again and push this topic to the responsible team again.

Is there any context that might help us understand?

Example 1

This is addressing the following advisories

It seems the following at the top of the GitHub advisory:

Affected versions: >15.0.4 and <15.2.0 Patched versions: ≤15.0.4 and ≥15.2.0

doesn't match the other existing info on both URLs:

It impacted versions >=15.1.0 <15.1.8

Example 2

Furthermore the following advisory:

https://github.com/vercel/next.js/security/advisories/GHSA-f82v-jwr5-mffw

includes the following at the top:

Affected versions

>11.1.4 >14.0 >15.0

but when reading external sources like e.g. https://zhero-web-sec.github.io/research-and-things/nextjs-and-the-corrupt-middleware correctly:

starting with version 11.1.4 were vulnerable

these probably should be:

>=11.1.4 >=14.0 >=15.0

similar to the existing ">= 13.0.0" instead.

Example 3

Finally the following advisory:

https://github.com/vercel/next.js/security/advisories/GHSA-223j-4rm8-mrmf

currently only includes single versions like "12.3.5" in the "Affected versions" section. Are really only these single versions affected or should these be e.g. "<= 12.3.5"?

Does the docs page already exist? Please link to it.

extent analysis

TL;DR

Update the affected version ranges in the security advisories to accurately reflect the vulnerable versions.

Guidance

  • Review the existing advisories and compare the version ranges with external sources to ensure consistency.
  • Update the version ranges to use inclusive operators (e.g., >= and <=) to clearly indicate the affected versions.
  • Verify that the updated version ranges match the intended meaning, such as changing > 11.1.4 to >= 11.1.4.
  • Consider adding a note to explain the update and provide context for the change.

Example

No code snippet is provided as this issue is related to documentation updates.

Notes

The updates should be made to the specific advisories mentioned in the issue, and it is essential to ensure that the changes accurately reflect the vulnerable versions to avoid confusion.

Recommendation

Apply workaround: Update the documentation to reflect the correct version ranges, as this will help to clarify the affected versions and provide accurate information to users.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…
#tensor shape#autograd error#model save/load#optimization#mixed precision

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING