Practical Security Guides For Your Team

Your website's Next.js framework has a flaw in how it forwards certain web requests to your backend servers. Under specific conditions, an attacker could craft a specially shaped request that tricks the system into reaching internal or admin areas of your backend that were never meant to be publicly accessible. This only affects self-hosted setups — if your site runs on Vercel, you are not affected.

Your application uses a JavaScript library called Axios to make web requests. A flaw in one of its supporting components means that if your app routes traffic through an authenticated proxy server, those proxy login credentials could be accidentally sent to the wrong destination when a redirect occurs. This only affects you if your app uses proxy authentication — if it doesn't, you're not at risk.