SB2026110622 - Multiple vulnerabilities in IBM InfoSphere Optim Archive Viewer
Published: November 6, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 8 vulnerabilities.
1) Acceptance of Extraneous Untrusted Data With Trusted Data (CVE-ID: CVE-2026-44572)
CWE-ID: CWE-349 - Acceptance of Extraneous Untrusted Data With Trusted Data
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to acceptance of extraneous untrusted data with trusted data in middleware / proxy redirect handling when processing a normal request with a spoofed x-nextjs-data header on a path that returns a redirect. A remote attacker can send a specially crafted request to cause a denial of service.
Exploitation requires the application to be deployed behind a caching CDN or reverse proxy that caches 3xx responses for the affected path without varying on the x-nextjs-data header.
2) Improper access control (CVE-ID: CVE-2026-44573)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to improper access control in middleware authorization for Pages Router data routes when handling locale-less /_next/data//.json requests. A remote attacker can send a specially crafted request to disclose sensitive information.
Only applications using the Pages Router with i18n configured and relying on middleware or proxy-based authorization for protected page data are vulnerable.
3) Interpretation Conflict (CVE-ID: CVE-2026-44576)
CWE-ID: CWE-436 - Interpretation Conflict
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause cache poisoning that results in component payloads being served instead of the expected HTML.
The vulnerability exists due to interpretation conflict in React Server Component response handling when shared caches do not correctly partition response variants. A remote attacker can cause an RSC response to be served from the original URL to cause cache poisoning that results in component payloads being served instead of the expected HTML.
The issue affects applications using React Server Components with shared caches under affected conditions.
4) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-44577)
CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling
CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to allocation of resources without limits or throttling in the Image Optimization API when handling requests to the /_next/image endpoint for large local assets matching configured local patterns. A remote attacker can request large local assets to cause a denial of service.
Only self-hosted deployments using the default image loader are vulnerable. By default, all local patterns are allowed.
5) Improper access control (CVE-ID: CVE-2026-44578)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to improper access control in WebSocket upgrade handling in the built-in Node.js server when processing crafted WebSocket upgrade requests. A remote attacker can send a specially crafted WebSocket upgrade request to disclose sensitive information.
Only self-hosted applications using the built-in Node.js server are affected; Vercel-hosted deployments are not affected.
6) Cross-site scripting (CVE-ID: CVE-2026-44580)
CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
The vulnerability allows a remote attacker to execute arbitrary JavaScript in a visitor's browser.
The vulnerability exists due to improper neutralization of input during web page generation in beforeInteractive script content serialization when embedding untrusted content into the document. A remote attacker can supply specially crafted input to execute arbitrary JavaScript in a visitor's browser.
User interaction is required to load the affected page.
7) Cross-site scripting (CVE-ID: CVE-2026-44581)
CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
The vulnerability allows a remote attacker to execute arbitrary script in victims' browsers.
The vulnerability exists due to cross-site scripting in App Router HTML rendering when processing malformed nonce values derived from request headers behind shared caches. A remote attacker can supply a malformed nonce value to poison cached responses and execute arbitrary script in victims' browsers.
User interaction is required, and exploitation affects App Router applications that rely on CSP nonces when deployed behind shared caches.
8) Reversible One-Way Hash (CVE-ID: CVE-2026-44582)
CWE-ID: CWE-328 - Use of Weak Hash
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to poison shared cache entries and cause users to receive the wrong response variant for a given URL.
The vulnerability exists due to use of a weak hash in the React Server Component cache-busting mechanism when generating the _rsc cache-busting value for shared caches with insufficient response partitioning. A remote attacker can trigger collisions in crafted requests to poison shared cache entries and cause users to receive the wrong response variant for a given URL.
Only deployments that rely on shared caches with insufficient response partitioning are vulnerable.
Remediation
Install update from vendor's website.