Unrated severityNVD Advisory· Published Jan 28, 2026· Updated Jan 29, 2026
Next.js - Critical - Access bypass - SA-CONTRIB-2025-122
CVE-2025-13984
Description
Permissive Cross-domain Security Policy with Untrusted Domains vulnerability in Drupal Next.Js allows Cross-Site Scripting (XSS).This issue affects Next.Js: from 0.0.0 before 1.6.4, from 2.0.0 before 2.0.1.
Affected products
1- Range: >=0.0.0,<1.6.4, >=2.0.0,<2.0.1
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
1News mentions
0No linked articles in our index yet.