6 ms·
Critical Next.js RCE Still Missing from GitHub Advisory Database and OSV
- stacktrace 15d agoWe use Grype for container vulnerability scanning, but the recent `GHSA-2xp9-vwfh-vxw4` (CVSS 9.5 rating) vulnerability, which was initially reported on repository advisory on 25th Aug, was completely missed by our scanners. Even our socket.dev scans returned nothing related to vulnerability The advisory exists through GitHub’s repository-advisory API: - GET /repos/vercel/next.js/security-advisories/GHSA-2xp9-vwfh-vxw4 - HTTP 200 - state: "published" - severity: "critical" - published_at: "2026-08-25T16:16:28Z" but it's completely missing from the public DB's our scanners rely on: - https://api.github.com/advisories/GHSA-2xp9-vwfh-vxw4 https://api.github.com/advisories/GHSA-2xp9-vwfh-vxw4 - HTTP 404 - https://api.osv.dev/v1/vulns/GHSA-2xp9-vwfh-vxw4 https://api.osv.dev/v1/vulns/GHSA-2xp9-vwfh-vxw4 - HTTP 404 There's already a blog published by Vercel about this, which is seriously concerning because some developers might not know about it until it's too late. Is this delay expected? If so, how is everyone covering this gap in the scanning pipeline?
- feross 12d agoThanks for pointing this out. Socket is building our own vulnerability database to reduce dependence on the increasingly unreliable GHSA database.