Mar 21, 2025
2 new incidents, 0 with updates.
Started
- ClosedPatched
Next.js middleware authorization bypass via x-middleware-subrequest (CVE-2025-29927)
Sending a crafted x-middleware-subrequest header made self-hosted Next.js skip middleware entirely, bypassing auth checks done there. Apps hosted on Vercel were protected. Fixed in 12.3.5, 13.5.9, 14.2.25 and 15.2.3; otherwise strip the header at the edge.
Next.js (self-hosted)Closed Mar 22, 2025
- ClosedHighNo fix needed
Oracle Cloud login servers breached: ~6M SSO/LDAP records offered for sale
A hacker using the name rose87168 claimed in March 2025 to have stolen about 6 million SSO and LDAP records from Oracle Cloud login servers. Oracle first denied an OCI breach, then told customers privately that two obsolete servers (reportedly Oracle Cloud Classic / Gen 1) were accessed, exposing usernames and hashed or encrypted passwords.
Oracle Cloud Classic (Gen 1) login/IDM serversClosed Apr 8, 2025
