Tyage

**Name of the Vulnerable Software and Affected Versions** Next.js versions prior to 14.2.15 **Description** The issue is related to authorization bypass in Next.js applications when authorization is performed in middleware based on pathname. This allows attackers to bypass security checks for pages directly under the application's root directory. For example, `https://example.com/foo` is affected, while `https://example.com/` and `https://example.com/foo/bar` are not. The vulnerability affects millions of developers and has been automatically mitigated for applications hosted on Vercel, regardless of the Next.js version. There are no official workarounds for this vulnerability. **Recommendations** For Next.js versions prior to 14.2.15, upgrade to version 14.2.15 or later to resolve the issue. If your Next.js application is hosted on Vercel, no action is required as the vulnerability has been automatically mitigated. As a temporary workaround, consider restricting access to sensitive pages or disabling middleware-based authorization until a patch is applied.

**Name of the Vulnerable Software and Affected Versions** Rails versions 5.2.0 through 7.0.8.0 Rails versions 6.1.0 through 6.1.7.6 **Description** The issue is related to a possible sensitive session information leak in Active Storage. By default, Active Storage sends a `Set-Cookie` header along with the user's session cookie when serving blobs. It also sets `Cache-Control` to public. Certain proxies may cache the `Set-Cookie`, leading to an information leak. This may cause users to share sessions, potentially allowing an attacker to receive a user's session or vice versa. **Recommendations** For Rails versions 5.2.0 through 7.0.8.0, upgrade to version 7.0.8.1 or configure caching proxies not to cache the `Set-Cookie` headers. For Rails versions 6.1.0 through 6.1.7.6, upgrade to version 6.1.7.7 or configure caching proxies not to cache the `Set-Cookie` headers. As a temporary workaround, consider configuring caching proxies to exclude the `Set-Cookie` headers from being cached.

**Name of the Vulnerable Software and Affected Versions** webmention.js versions prior to 0.5.5 **Description** The issue is related to Cross-site Scripting (XSS) - DOM in the webmention.js GitHub repository. This type of attack occurs when an application includes user input in its output without proper validation, allowing an attacker to inject malicious scripts into the website. No information is provided about the estimated number of potentially affected devices or real-world incidents where this issue was exploited. **Recommendations** For versions prior to 0.5.5, update to version 0.5.5 or later to resolve the issue. As a temporary workaround, consider restricting user input to minimize the risk of exploitation.