Project: 
Next.js
Date: 
2025-December-03
Security risk: 
Critical 16 ∕ 25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:All
Vulnerability: 
Access bypass
Affected versions: 
<1.6.4 || >=2.0.0 <2.0.1
CVE IDs: 
CVE-2025-13984
Description: 

This module enables integration between Next.js and Drupal for headless CMS functionality.

When installed, the module automatically enables cross-origin resource sharing (CORS) with insecure default settings (Access-Control-Allow-Origin: *), overriding any services.yml CORS configuration. This allows any origin to make cross-origin requests to the site without administrator knowledge or consent.

This vulnerability affects all installations as there are no configuration options to disable this behavior.

Solution: 

There are two steps to resolve the issue: Install the latest version and review your configuration,

  1. Update the module:
    • If you use the Next.js module for Drupal 10 or 11, upgrade to Next.js 2.0.1.
    • If you use the Next.js module for Drupal 9 (1.x branch), upgrade to Next.js 1.6.4.

  2. After upgrading, review the CORS configuration in sites/default/services.yml. (See this module's CORS.md for details.). This is especially important if you previously relied on the automatic CORS configuration.

Reported By: 
Fixed By: 
Coordinated By: