CVE-2025-13465

Next.js 16.3.0が公開。同梱lodashをCVE-2025-13465の修正版(4.17.23)へ更新し、依存経由の脆弱性リスクを解消。App Router周りのバグ修正やTurbopackのHMR改善も多数入っています。

Next.js 16.3.0が同梱lodashの脆弱性CVE-2025-13465を修正。RSC周りのデプロイ不具合修正も入り、16系ユーザーは早めのパッチ適用が安心です。

Next.js 16.3.0公開。同梱lodashのCVE-2025-13465を修正するセキュリティ対応入りで、16系利用者は早めの更新を推奨。TurbopackのHMR改善も地味に効きます。

Next.js 16.3.0が公開。同梱lodashの脆弱性CVE-2025-13465を修正し、Turbopackのapp routeでHMRが有効に。Prisma Next 0.17は@prismaパッケージ構成に破壊的変更ありで、生成コードの書き換えが必要です。

今週の目玉はNext.js 16.3.0。同梱lodash由来のCVE-2025-13465を修正しており、16系を運用中なら上げ時です。Prisma Nextは0.17でパッケージ体系を破壊的に刷新、Docker 29.7系は回帰修正が続きました。合計24件のリリース週

Next.js 16.3.0は同梱lodashのCVE-2025-13465修正入りで16系は上げ時。Prisma Nextは0.17でパッケージ構成が破壊的変更、@prisma単一化で移行に注意。Node.js 26.7も新機能多数。

Next.js 16.3.0がlodash由来のCVE-2025-13465を修正。RSCルートの不正なHTML応答やPages Routerのdata JSON応答も改善されました。16系を運用しているなら早めの取り込みを検討したいリリースです。

Next.js 16.3 patches CVE-2025-13465 and renames the HMR endpoint — check your proxy configs. LiteLLM gets Rust-backed Anthropic routing.

🟠 HIGH (CVSS 8.2) — CVE-2025-13465 Published: 2026-01-21 lodash: prototype pollution in _[dot]unset and _[dot]omit functions 🧬 CVSS 3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H #CVE #CyberSecurity #InfoSec #Vulnerability ━━━━━━━━━━━

🚨*CVE* CVE-2026-2950 Impact: Lodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the _.unset and _.omit functions. The fix for (CVE-2025-13465: https://t.co/I2P3GU38NL… https://t.co/ASDj5M1WxX ----- Traducción: Impacto de CV… https://t.co/utmtNg

CVE-2026-2950 Impact: Lodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the _.unset and _.omit functions. The fix for (CVE-2025-13465: https://t.co/Sr53IytKMp… https://t.co/wilANcmmSh

Just submitted my FIRST ever bug bounty report on @intigriti! Found a Prototype Pollution vulnerability via Lodash (CVE-2025-13465) — rated Medium severity, currently in Triage #BugBounty #Intigriti #CyberSecurity #Infosec #EthicalHacking #PenTest https://t.co/5cuuaJJj6m

Critical patch for #openSUSE Leap 16.0: SLE-WU-2026-38129-5. It fixes prototype pollution in Cockpit (CVE-2025-13465) and js-yaml (CVE-2025-64718). Read more: 👉 https://t.co/X1YInsoZA8 #Security https://t.co/5x5ZaJIoQU

Deep-dive: #SUSE security update for Cockpit (CVE-2025-13465) is out. 🔒 Read more: 👉https://t.co/RDPKihUSmE #Security https://t.co/6PA2rtusxf

Critical Patch Alert for #SUSE Linux Enterprise Server 16.0 The SUSE security team has released an urgent update for cockpit-packages to fix CVE-2025-13465, a prototype pollution flaw in the _.unset and _.omit functions. Read more: 👉 https://t.co/jFL2HTfPg9 #Security https:/

URGENT: #Fedora 42 security patch released for yarnpkg prototype pollution vulnerability (CVE-2025-13465). Read more: 👉 https://t.co/rN806nM2Tn #Security https://t.co/yL6Odt49wu

Just published a deep dive on the critical pgAdmin 4 security update for #Fedora 42 (CVE-2025-13465). It's more than just a "run dnf update" notice. Read more: 👉 https://t.co/z80fo5PUWj #Security https://t.co/VBknMP9L2H

🛠️ In-depth breakdown of the #security fix for CVE-2025-13465 in #Lodash: root cause, prototype pollution mechanics in _.unset/_.omit, and details of the patch. https://t.co/jnVlvggC4j

CVE-2025-13465: Lodash: The Delete Button for the Universe (CVE-2025-13465) A prototype pollution vulnerability in the ubiquitous Lodash library allows attackers to delete critical properties from the global Object prototype. Unlike traditional pollut... https://t.co/0jOaz03V3q

CVE-2025-13465 Prototype Pollution Vulnerability in Lodash _.unset and _.omit Functions https://t.co/2nTLBqtXX1

CVE-2025-13465 Lodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution in the _.unset and _.omit functions. An attacker can pass crafted paths which cause Lodash… https://t.co/pvBJst8bNj