TAG
#ssrf
Stories connected through a shared idea, actor, technology or theme.
Next.js ships a coordinated security release for supported branchesThe fixes affect both current and previous maintained release lines. The advisories cover image optimisation, App Router metadata image routes and self-hosted SSG or ISR deployments.→Pydantic AI 2.44 closes four web-fetch and telemetry security pathsPydantic AI 2.44 fixes four vulnerabilities reachable through web fetching or OpenTelemetry instrumentation. The fixes cover an IPv6 zone-identifier bypass of private-network blocklists, superlinear processing of attacker-controlled pages, alternate spellings of blocked domains and sensitive content remaining in spans despite `include_content=False`.→Bifrost HTTP transport receives a new unauthenticated RCE disclosureThe CVE describes unauthenticated plugin-path submission through POST /api/plugins when management authentication is disabled, allowing native code execution on affected dynamically linked builds. The published static Docker image is expected to be limited to SSRF, but operators should still upgrade or enable management authentication.→