60
30
60
Next.js 16.4.0-canary.13 Image Optimizer DNS Rebinding TOCTOU SSRF Still Exists
Next.js 16.4.0-canary.13 Image Optimizer retains a DNS rebinding TOCTOU SSRF in fetchExternalImage() allowing requests to private network resources.
Next.js 16.4.0-canary.13 contains a DNS rebinding time-of-check-to-time-of-use Server-Side Request Forgery vulnerability in the Image Optimizer's fetchExternalImage() function. The code resolves the supplied hostname and checks the resulting addresses with isPrivateIp(), but a TOCTOU gap between resolution and the actual fetch allows an attacker-controlled DNS record to change and reach private network resources.
30
42
CISA Flags Actively Exploited Ray Flaw That Can Trigger Browser
CISA added actively exploited Ray flaw CVE-2025-62593 (CVSS 9.4) to its KEV catalog; the DNS rebinding RCE has powered crypto-mining and DDoS botnet campaigns.
CISA added CVE-2025-62593 (CVSS 9.4) to its Known Exploited Vulnerabilities catalog, citing active exploitation of a DNS rebinding-driven RCE flaw in the Ray distributed computing framework, fixed in version 2.52.0. The flaw stems from missing authentication on critical Ray endpoints and an insufficient User-Agent header guard, exploitable against developers running Ray in Firefox or Safari via malicious websites or ads. RondoDox botnet operators incorporated the PoC exploit before the November 26, 2025 disclosure, and unpatched GPU-equipped clusters were hijacked into self-replicating crypto-mining botnets in the ShadowRay 2.0 campaign. FCEB agencies must apply fixes by August 20, 2026.
75
60
50
60
55
U.S. CISA adds a Ray-Project Ray flaw to its Known Exploited Vulnerabilities catalog
CISA added actively exploited Ray RCE flaw CVE-2025-62593 (CVSS 9.4) to its KEV catalog, ordering federal agencies to patch by August 20, 2026.
CISA added CVE-2025-62593 (CVSS 9.4), a critical remote code execution flaw in the Ray AI compute engine, to its Known Exploited Vulnerabilities catalog with a due date of August 20, 2026. Versions before 2.52.0 relied on a User-Agent header check to guard the dashboard/API, which combined with DNS rebinding allows arbitrary code execution on developers' machines via malicious websites or ads. Aviatrix's analysis describes privilege escalation, lateral movement, command and control, and data exfiltration following exploitation. Federal civilian agencies must remediate under BOD 22-01; the flaw affects Firefox and Safari.
70
57
60
60
57
60
45
30
60
30
60
47
57
60
55
30
60
60