CVE-2021-32702

Что произошло

### Overview Versions before and including `1.4.1` are vulnerable to reflected XSS. An attacker can execute arbitrary code by providing an XSS payload in the `error` query parameter which is then processed by the callback handler as an error message. ### Am I affected? You are affected by this vulnerability if you are using `@auth0/nextjs-auth0` version `1.4.1` or lower **unless** you are using custom error handling that does not return the error message in an HTML response. ### How to fix that? Upgrade to version `1.4.2`. ### Will this update impact my users? The fix adds basic HTML escaping to the error message and it should not impact your users. ### Credit https://github.com/inian https://github.com/git-ishanpatel

Что делать

dpkg-query -W -f='${Package}	${Version}\n'

rpm -qa --qf '%{NAME}\t%{VERSION}-%{RELEASE}\n'

Get-HotFix | Select-Object HotFixID, InstalledOn

Продукты и затронутые версии

{
  "status": "affected",
  "version": "*",
  "versionEndExcluding": "1.4.2"
}

CVSS: оценки и векторы

Оценка CVSS отсутствует.

Источники и ссылки

{
  "cwes": [],
  "epss": {
    "source": "epss",
    "received_at": "2026-11-03T21:06:07.599250+00:00"
  },
  "title": {
    "source": "osv",
    "received_at": "2026-11-02T12:14:13.132614+00:00"
  },
  "scores": [],
  "affected": [
    "osv"
  ],
  "published": {
    "source": "osv",
    "received_at": "2026-11-02T12:14:13.132614+00:00"
  },
  "solutions": [],
  "percentile": {
    "source": "epss",
    "received_at": "2026-11-03T21:06:07.599250+00:00"
  },
  "references": [
    "osv"
  ],
  "description": {
    "source": "osv",
    "received_at": "2026-11-02T12:14:13.132614+00:00"
  },
  "workarounds": [],
  "configurations": []
}

Хронология записи

1. Данные обновлены04.11.2026, 00:06
2. Данные обновлены03.11.2026, 00:06
3. Опубликована02.11.2026, 15:14

Личная заметка и статус

Другие CVE того же продукта