education learning

documentation technical

Swedish

ep203

ep201

_splunk_rum_sid

You're looking at domain 'sv.surveymonkey.com' on the commercial generic top-level domain (.com) with subdomain 'sv'. The registrable portion 'surveymonkey' spans 12 characters with 4 vowels and 8 consonants. Breaking it apart gives 2 words: survey, monkey. The median word length lands at six characters. No strong language cues emerged from the frequency lists.

default-src https: data: wss: wss://identity.surveymonkey.com 'self'; script-src 'unsafe-eval' 'unsafe-inline' https: 'self' 'strict-dynamic' 'nonce-ZmJiNzNiYTMtNmM5ZC00ZDI5LTlkM2MtNWMzYWM0MzVkYWZm'; style-src 'unsafe-eval' 'unsafe-inline' 'self' https://*.trustedshops.com https://*.smassets.net https://*.surveymonkey.com https://fonts.googleapis.com https://fonts.gstatic.com; object-src 'none'; base-uri 'self'; upgrade-insecure-requests

default-src https: data: blob: 'unsafe-eval' 'unsafe-inline' https://*.smassets.net https://www.google.com https://www.gstatic.com https://www.recaptcha.net https://api.amplitude.com https://api2.amplitude.com https://*.crazyegg.com wss://*.hotjar.com wss://*.qualified.com 'self'; upgrade-insecure-requests; frame-ancestors 'self' https://*.zendesk.com https://*.myshopify.com https://teams.microsoft.com https://*.eloqua.com https://*.surveymonkey.com https://*.sharepoint.com https://*.worldpay.com https://*.cardinalcommerce.com https://*.office.com https://*.office365.com https://*.microsoft365.com https://*.cloud.microsoft

default-src https: data: 'unsafe-eval' 'unsafe-inline' https://*.smassets.net https://www.google.com https://www.gstatic.com https://www.recaptcha.net wss://*.hotjar.com wss://*.qualified.com https://api.amplitude.com https://api2.amplitude.com https://*.crazyegg.com; upgrade-insecure-requests; connect-src https: wss: https://rum-ingest.us1.signalfx.com/ https://api.schedule.zoominfo.com https://ws.zoominfo.com 'self'; script-src https: 'unsafe-eval' 'unsafe-inline' https://js.zi-scripts.com https://schedule.zoominfo.com https://ws-assets.zoominfo.com https://www.googletagmanager.com 'self'; worker-src https: blob: 'self'; frame-ancestors 'self' https://*.zendesk.com https://*.myshopify.com https://teams.microsoft.com https://*.eloqua.com https://*.surveymonkey.com https://*.sharepoint.com https://*.worldpay.com https://*.cardinalcommerce.com https://*.office.com https://*.office365.com https://*.microsoft365.com https://*.cloud.microsoft

require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes

02e6c37ce0bcf545b52d80d8a821aa2eb38bf0eeaf6928a4f5c42e6b71ec1e46

00613d4400494e0b97fa780845361f5f9a6fbbd0d97b3682177ad573d67eaa1a

2876b008906d5b8485f16441badf3045a25ef7804c2cdd522136f08a3dd6cb15

49821369de3e3a77e8be590178159cbf0489ce647e0193914e025f44df385bca

b8aabdf598189b9d8cdcd4e03b47ed578d09f4065ef287cd823f8e9b9d4967bc

4610d7a3d070f91b666f86472507921cd1b5a6fa9a1604fc4c1d255318fe7697

63b459277e889d34efcc6105c238f75a7de0b03233d5c80c549acc12fb76a1c3

72dc92607b3767fd8e8726484d1b50757f3178a4f699c3c674679a0cc58a06d7

6f5b4aa00d2f8d6aed9935b471806bf7acef464d0c1d390260e5fe27f800c67e

dc59903a0bcbbc83b2cf4792dae1d209b2251a775eb0ffe272e2153961cb3bb2

c8a48c718dd651da7b812745914eef516b11e642bb0c23f281350619b183c047

d0be2f65338a8de6910b116187287e07259bf05177fb74ba865b21f7776ffe0f

8a7c749b847d5a040f0d2089fcd13fed33d724fbc8641b2a6b797bea02f9f0d8

fcbb2b43e72e8edd83c25128b3e5f644b11445a8dd3dc5b2bf92bff8202854c6

a4daee9541214ebdfe2fc966f0cd457c357846447f9ebb90cf7a82601badfe35

25240067be74d5b63d597c9be82e7423bc32fa6047f35f51e571971fdc0819dd

3127a8806cf3fec6f90169c5cb1394607f013fb9ac3c96d3d7cde7df58468bbf

598f72a9ed7804739ebb943fa54ec292576f353631bb96d1c399633ca5335ed9

A vulnerability affects certain React Server Components packages for versions 19.0.x, 19.1.x, and 19.2.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. The issue is tracked upstream as [CVE-2026-23864](https://github.com/facebook/react/security/advisories/GHSA-83fc-fqcc-2hmg).

A specially crafted HTTP request can be sent to any App Router Server Function endpoint that, when deserialized, may trigger excessive CPU usage, out-of-memory exceptions, or server crashes. This can result in denial of service in unpatched environments.

A DoS vulnerability exists in self-hosted Next.js applications that have `remotePatterns` configured for the Image Optimizer. The image optimization endpoint (`/_next/image`) loads external images entirely into memory without enforcing a maximum size limit, allowing an attacker to cause out-of-memory conditions by requesting optimization of arbitrarily large images. This vulnerability requires that `remotePatterns` is configured to allow image optimization from external domains and that the attacker can serve or control a large image on an allowed domain.

Strongly consider upgrading to 15.5.10 and 16.1.5 to reduce risk and prevent availability issues in Next applications.

## Summary
When Next.js rewrites proxy traffic to an external backend, a crafted `DELETE`/`OPTIONS` request using `Transfer-Encoding: chunked` could trigger request boundary disagreement between the proxy and backend. This could allow request smuggling through rewritten routes.

## Impact
An attacker could smuggle a second request to unintended backend routes (for example, internal/admin endpoints), bypassing assumptions that only the configured rewrite destination/path is reachable. This does not impact applications hosted on providers that handle rewrites at the CDN level, such as Vercel. 

## Patches
The vulnerability originated in an upstream library vendored by Next.js. It is fixed by updating that dependency’s behavior so `content-length: 0` is added only when both `content-length` and `transfer-encoding` are absent, and `transfer-encoding` is no longer removed in that code path.

## Workarounds
If upgrade is not immediately possible:
- Block chunked `DELETE`/`OPTIONS` requests on rewritten routes at your edge/proxy.
- Enforce authentication/authorization on backend routes per our [security guidance](https://nextjs.org/docs/app/guides/data-security).

## Summary
The default Next.js image optimization disk cache (`/_next/image`) did not have a configurable upper bound, allowing unbounded cache growth.

## Impact
An attacker could generate many unique image-optimization variants and exhaust disk space, causing denial of service.

## Patches
Fixed by adding an LRU-backed disk cache with `images.maximumDiskCacheSize`, including eviction of least-recently-used entries when the limit is exceeded. Setting `maximumDiskCacheSize: 0` disables disk caching. 

## Workarounds
If upgrade is not immediately possible:
- Periodically clean `.next/cache/images`.
- Reduce variant cardinality (e.g., tighten values for `images.localPatterns`, `images.remotePatterns`, and `images.qualities`)

54c5b7083cd22611a75c5b6ab0d7555dc1a6be81afd15c852954f5c2aa87fb10

0eafe69906e4865b4146b99512ccaa41fdfa6055de6e83184627551e0e1a1b03

twitter:card

https://sv.surveymonkey.com/collect/images/default_custom_meta_image.jpg

Take this survey powered by surveymonkey.com. Create your own surveys for free.

width=device-width, initial-scale=1, user-scalable=yes

viewport

robots

next-head-count

default-src https: data: wss: wss://identity.surveymonkey.com 'self'; script-src 'unsafe-eval' 'unsafe-inline' https: 'self' 'strict-dynamic' 'nonce-OWE1NTMyNzEtZjAyNS00ZTc4LThhNjMtZTMzZjljZDFmNjg5'; style-src 'unsafe-eval' 'unsafe-inline' 'self' https://*.trustedshops.com https://*.smassets.net https://*.surveymonkey.com https://fonts.googleapis.com https://fonts.gstatic.com; object-src 'none'; base-uri 'self'; upgrade-insecure-requests

Requests	IP Address	Location	AS Autonomous System
14	16.182.38.153Aws · CLOUD	Ashburn, Virginia, United States	AS16509Amazon.com, Inc.
12	65.9.130.43Cloudfront · CDN	United States	AS16509Amazon.com, Inc.
12	65.9.130.98Cloudfront · CDN	United States	AS16509Amazon.com, Inc.
38	3	-	-

Security Scan Report: sv.surveymonkey.com

Summary

AI Security Verdict

Safe Website

Safety Factors

Details

Screenshot

Page Load Overview

Language Analysis

Primary Language

Detection Details

Website Classification

Primary Category

All Detected Categories

Detected Features

Domain & IP Information

Page Statistics

Detected Technologies4

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

ssdeep (Context Triggered Piecewise Hashing)

sdhash (Similarity Digest Hashing)

Image Hashes

Perceptual Hashes

Other Hashes

Scan History