Spotted what might be an issue in typescript-recipes/parallel-vercel-template/pnpm-lock.yaml around line 1.
The project uses Next.js version 16.2.3, which is below the fixed versions 15.5.16 and 16.2.5. In affected Next.js versions (12.2.0‑1.5.15/16.2.4), when the Pages Router is configured with i18n and middleware‑based authorization, the locale‑less /_next/data//… routes bypass middleware, allowing an attacker to retrieve SSR JSON for protected pages without passing authorization checks. This can lead to unauthorized access and leakage of sensitive server‑rendered data.
Something like this might fix it:
Upgrade Next.js to version 16.2.5 (or later) by updating the version in package.json (or the appropriate dependency file) and reinstalling dependencies, e.g. `pnpm update next@16.2.5 && pnpm install`.
For reference: rule CVE-2026-44573. Rated high.
I may be wrong about this one — closing it costs you nothing if so.
Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.
Spotted what might be an issue in
typescript-recipes/parallel-vercel-template/pnpm-lock.yamlaround line 1.The project uses Next.js version 16.2.3, which is below the fixed versions 15.5.16 and 16.2.5. In affected Next.js versions (12.2.0‑1.5.15/16.2.4), when the Pages Router is configured with i18n and middleware‑based authorization, the locale‑less /_next/data//… routes bypass middleware, allowing an attacker to retrieve SSR JSON for protected pages without passing authorization checks. This can lead to unauthorized access and leakage of sensitive server‑rendered data.
Something like this might fix it:
For reference: rule
CVE-2026-44573. Rated high.I may be wrong about this one — closing it costs you nothing if so.
Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.