Vercel rolls out protection against stolen session cookie attacks
Vercel binds logins to device TPM to prevent stolen cookie reuse
1
Stories per day · 30 days
2 RSS
Relatedcloudflare3brotli2waf2appsec1aspm1checkmarx1cve-2025-551821lighthouse1managed-ruleset1nodejs1protection1remote-code-execution1session-cookies1snyk1static-sites1vercel1web-performance1wiz1
9 stories, newest first · one card per story
Stories tagged #nextjs
Cloudflare adds log-only WAF rules tied to Brotli flaw CVE-2026-111497
The October 25 rules watch Brotli request bodies and Next.js /_next/image traffic; customers must opt in to blocking.
1
Cloudflare adds WAF rules for CVE-2026-111497, logging by default
Two Managed Ruleset detections cover Brotli request bodies and Next.js /_next/image traffic, and matches can include legitimate requests.
1
ASPM in the AI Era Part 1: Unified Visibility Across Your Stack
Wiz promotes ASPM connectors that centralize scanner findings and prioritize exploitable application risks.
React Server Components Flaw Lets Attackers Freeze Next.js Servers With a Single POST Request
CVE-2026-23870 lets attackers freeze vulnerable Next.js servers with one crafted POST to React Server Functions.
Progress security advisory (AV26-999)
Canada's Cyber Centre urges updates for Progress Fiddler Classic and the Sitefinity Next.js SDK.
Critical Next.js ImageResponse Flaw Can Lead to Server Code Execution via Crafted SVG Input
Vercel patched critical Next.js ImageResponse flaw CVE-2026-94545 (CVSS 9.5) allowing server code execution via crafted SVG input; no attacks reported yet.
Next.js 16.4.0-canary.13 Image Optimizer DNS Rebinding TOCTOU SSRF Still Exists
Next.js 16.4.0-canary.13 Image Optimizer retains a DNS rebinding TOCTOU SSRF in fetchExternalImage() allowing requests to private network resources.
Next.js security advisory (AV26-851)
Canada's Cyber Centre warns Next.js 15.5 and 16.3 are affected by critical vulnerabilities; users should update to 15.5.24 and 16.3.3.