AIKIDO-2025-10903

TL;DR

Affected versions of this package are vulnerable to access bypass through insecure cors behavior: the module automatically enables CORS with Access-Control-Allow-Origin: *, overriding any existing services.yml settings and allowing any origin to make cross-origin requests without administrator approval. All installations are affected because this behavior cannot be disabled. Updating the module resolves the issue—upgrade to Next.js 2.0.1 for Drupal 10/11 or Next.js 1.6.4 for Drupal 9—and then review your CORS configuration in sites/default/services.yml, especially if you previously relied on the module’s automatic settings.