government public service

government

adult content

English

nmstat

OptanonAlertBoxClosed

OptanonConsent

cookieconsent_status

consent

gdpr_consent

_ga_SSQCH0GJHX

euconsent

You're looking at domain 'www.threerivers.gov.uk' on the United Kingdom country-code top-level domain (.gov.uk) and includes subdomain 'www'. The second-level label 'threerivers' is 11 characters long with four vowels and seven consonants. Segmentation suggests 2 words: three, rivers. Expect 5.5 characters per word on average. No strong language cues emerged from the frequency lists.

utf8

email

commit

filter-areaOfRepresentationCounties.name

filter-areaOfRepresentationWards.name

html/5a/20/5a2080a0-3521-4f9d-a659-962a4a8c5535.html.gz

require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/bcfae741e379a885f2ab2cf83ebe6d32/mr

0f47fa6947657a011219baf4f25cb19bee4b94e81f3ffaccde170023d796fc84

d3758227784b8cc3bcdc71db68d326f26af190af27d5afdee07b0711d6e4dc30

31b41b51279709201be1f3e7b799d22053ee3f2a9ff5258e1e8e4f8e8f7de1b5

d12ac0719af4538bc1509d73172be0c4f333a3810e5636fdc41e453e61d14c6e

fb817c362fb09f908cf4d4f4216653c0971bbfaca5bcd6992d4212fd6d1bdb45

09c6486be8218fb54b71c495ea5a8a689085f58553b1b4728230a6b706c21fc4

5e16ff6ca8d8aab0d3e812a489bcde8ee3b13ce0446d4b49bb5f438f75f479c1

f36cc9520274d27ba4cf53c2e6bf8ef040d5f6e8109a9dfb2545dddd20c95714

e90753194184cd568527d6e123b683fb3f57cddaba477a3121dbb6943e2b665b

84cc98171f49e06fbca1a04f614edd757b1e67724f0e3d306978c35fef1426e2

da13549fe7084dca91aecdeb4803e9f046c2bb854b457f2307f2717371a58664

1ec24a2cea522e1e02420251bb951514b1fef8ee5f81ba9a8cb957f57c219eac

01f94efa2287f61c85d0e8c85683b5c8ea4f53aa1ef4cdc13be7cdcb4aaf9f0d

d4d3e0d7f1f0a340026062b89ccea5aec31b169f2a71e302745c9709d776b50e

f45a1876782d6de22f3e9c0bd685c234ba460e0b998ecb096eb24a56ab215267

f3416cf1ce5811f7bf33e6ee1bcc9bf071a3afbd3669c19c5c333662165c20fc

ea5615f3304bc0f6ab5d119b63156a7afbf6280f54801ba1bf91903977e40f9b

8828cb65abb65cb58ee4bd3a96d1906b12504e1434bfafeb32f5b3d66396da50

55d8047620de293012c062f0f6bc8fb50bd91c8e297ff5efa7e68cf6e7345be5

5e13d123f0fc287c419d2976bad90cc521279ad7d2928b7566750a088d2aebd2

49c9048fd049c816d3fc32ec6fcb6689925adc8950343b0a421735125a7282ff

1d4e0885639afd56734ad2208d6c18cfea0fc16f50a71e1c17b48d9f8d2cc281

d9357afe19d9752bfbc556f3c1dc9c17ce92bdf15de4d9b341290eb4575dee65

4dd58c62bc0c68cc49ff4cb2fdb615a48bc748d6f506a43f8b3bdcf7e7e52f2a

dfe8c5bd9afacb7d099df3082786766a8e1a144cb931beba941a7a8074d70f99

2f94f94e4e61e4292d848c13450cecbd4c912f3eb5cb1b884bdb6daaac78e5f7

a3a7fcf39eb6f627484fe7d449a6caa8a0731ab8015b084e90416e5bebe5d67c

beca631b18d32d6ea6dca80abf14c3d59d48f1abda5e64c8e6b706b2bb71ddf9

8024ca8b3c6a07785e28338ea1e4b9c70f921e20a209c58a641fae8a2d7e902a

7206e9d11afd915584e90899454392a35d8e1e59739c3c8182dbe0b6e2df682b

e4e63f0ddd39ff9751564ca83ada2bd75143dc590df63ed9c2f0c2c734725550

64a7feba0bb8d47a062a5f955b06d01762eb8b912c22140d266004eb391baca9

b85263760107e425afdd13493d52c9034c335f571531ff904d143a953aeace75

36d058abb82ec583665a174e0a4213f0090bf9dc5a562885ca38d418330ecc8a

131215d117e948ec90747c6cfc491b57890e617dc39c3f01a567fe0ee488c166

5612fc8d7de5ce811526e0424f70c05537394403361e09ae76b6a9c3e7cc7058

9c8e07ac339ed80dd356bddb74b28fd18d4d7d369f75aeeea5e3f32dec904708

0476144e00a11317090db8a503ffdf249eddb5cd847223772ee7f06c2fbca474

82037ffa6311d2bb6a166e0376302fc51a54e2fc0ec6c011ce936d06e441e5a0

9378cc39f55ec9c3ca7f7a065c966a45d33b47dfe31659b7d2d0530e7328439e

56c02fbd780cfbf049465aa6fc243616826549a82b995cd0cab30548605dd12c

11de11ecb230b4bffb5fe858f448fcc765d884570954f7dcae1b36281d3830d7

3d591a0ad26ba69f5ecc22f17c99717a2ebbdf3c88ad246ea8b1114d79922f27

6f5b4aa00d2f8d6aed9935b471806bf7acef464d0c1d390260e5fe27f800c67e

1a66485b70a4c6f504a17c2225cff6fb40893a40c6bc4bfe02b7b10bde3ab080

be90d9edcd24296555f7f7e95f9ae44dbf046452a50988cbd7b078728b4e1e24

add30d3f3da31d14315ab120b7f27c5f3aa0c070146f96acf5fdc7b7bc5acee7

7dec9217660680a8dc35d660527e790e6ad1e636c8126142c9299cfbe9afa6fd

f1f48d81712a7f031fa136f7b69007fee8fdda7f7c2f1c48b176a0adb1acdf28

fed5922affddc85bdaa06202fd4fab9dac4ea946e86c9a7284c4473dcd484242

03c75174a936b9cc409b936c2a585357b75d2ad8351a82a7413a3db38903a5d0

0a6e0007b05d7a7c2edcd7b76376d754d825f94d1d2f413880054ab9466e73e6

38d152fde61fecf27fd010b4a3a08f842153df4a9c00afa5c2d15f93a4c668f7

3bdda664d139c7a07c28e427f57d61d1a43525f79eaa810693f2b3f8b548b5f3

5c6b575707e59b733cde69a73a2739b307eb3dd9841cd5b5079d85fcd8167aad

6fe633c10ba857af0b5aaa98432c7b23cb585d30fcaae256a616bd97b24fb1a6

c46c78a5b5c5a99626a792bada54a918bb6b4e80d55ceefed0c0bd47c1aa3b53

f67c723a93fd6314571963eae17109d9b5dbeece9dda1a9338aa12756d423090

Next.js Server-Side Request Forgery in Server Actions

Denial of Service condition in Next.js image optimization

Next.js authorization bypass vulnerability

Next.js Allows a Denial of Service (DoS) with Server Actions

Next.js Race Condition to Cache Poisoning

Authorization Bypass in Next.js Middleware

Information exposure in Next.js dev server due to lack of origin verification

A vulnerability in Next.js Image Optimization has been fixed in v15.4.5 and v14.2.31. When images returned from API routes vary based on request headers (such as `Cookie` or `Authorization`), these responses could be incorrectly cached and served to unauthorized users due to a cache key confusion bug.

All users are encouraged to upgrade if they use API routes to serve images that depend on request headers and have image optimization enabled.

More details at [Vercel Changelog](https://vercel.com/changelog/cve-2025-57752)

A vulnerability in **Next.js Image Optimization** has been fixed in **v15.4.5** and **v14.2.31**. The issue allowed attacker-controlled external image sources to trigger file downloads with arbitrary content and filenames under specific configurations. This behavior could be abused for phishing or malicious file delivery.

All users relying on `images.domains` or `images.remotePatterns` are encouraged to upgrade and verify that external image sources are strictly validated.

More details at [Vercel Changelog](https://vercel.com/changelog/cve-2025-55173)

A vulnerability in **Next.js Middleware** has been fixed in **v14.2.32** and **v15.4.7**. The issue occurred when request headers were directly passed into `NextResponse.next()`. In self-hosted applications, this could allow Server-Side Request Forgery (SSRF) if certain sensitive headers from the incoming request were reflected back into the response.

All users implementing custom middleware logic in self-hosted environments are strongly encouraged to upgrade and verify correct usage of the `next()` function.

More details at [Vercel Changelog](https://vercel.com/changelog/cve-2025-57822)

A vulnerability affects certain React packages for versions 19.0.0, 19.0.1, 19.1.0, 19.1.1, 19.1.2, 19.2.0, and 19.2.1 and frameworks that use the affected packages, including Next.js 15.x and 16.x using the App Router. The issue is tracked upstream as [CVE-2025-55184](https://www.cve.org/CVERecord?id=CVE-2025-55184).

A malicious HTTP request can be crafted and sent to any App Router endpoint that, when deserialized, can cause the server process to hang and consume CPU. This can result in denial of service in unpatched environments.

It was found that the fix addressing [CVE-2025-55184](https://github.com/advisories/GHSA-2m3v-v2m8-q956) in React Server Components was incomplete and did not fully prevent denial-of-service attacks in all payload types. This affects React package versions 19.0.2, 19.1.3, and 19.2.2 and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x and 16.x using the App Router. The issue is tracked upstream as [CVE-2025-67779](https://www.cve.org/CVERecord?id=CVE-2025-67779).

A malicious HTTP request can be crafted and sent to any Server Function endpoint that, when deserialized, can enter an infinite loop within the React Server Components runtime. This can cause the server process to hang and consume CPU, resulting in denial of service in unpatched environments.

A vulnerability affects certain React Server Components packages for versions 19.0.x, 19.1.x, and 19.2.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. The issue is tracked upstream as [CVE-2026-23864](https://github.com/facebook/react/security/advisories/GHSA-83fc-fqcc-2hmg).

A specially crafted HTTP request can be sent to any App Router Server Function endpoint that, when deserialized, may trigger excessive CPU usage, out-of-memory exceptions, or server crashes. This can result in denial of service in unpatched environments.

A DoS vulnerability exists in self-hosted Next.js applications that have `remotePatterns` configured for the Image Optimizer. The image optimization endpoint (`/_next/image`) loads external images entirely into memory without enforcing a maximum size limit, allowing an attacker to cause out-of-memory conditions by requesting optimization of arbitrarily large images. This vulnerability requires that `remotePatterns` is configured to allow image optimization from external domains and that the attacker can serve or control a large image on an allowed domain.

Strongly consider upgrading to 15.5.10 and 16.1.5 to reduce risk and prevent availability issues in Next applications.

## Summary
When Next.js rewrites proxy traffic to an external backend, a crafted `DELETE`/`OPTIONS` request using `Transfer-Encoding: chunked` could trigger request boundary disagreement between the proxy and backend. This could allow request smuggling through rewritten routes.

## Impact
An attacker could smuggle a second request to unintended backend routes (for example, internal/admin endpoints), bypassing assumptions that only the configured rewrite destination/path is reachable. This does not impact applications hosted on providers that handle rewrites at the CDN level, such as Vercel. 

## Patches
The vulnerability originated in an upstream library vendored by Next.js. It is fixed by updating that dependency’s behavior so `content-length: 0` is added only when both `content-length` and `transfer-encoding` are absent, and `transfer-encoding` is no longer removed in that code path.

## Workarounds
If upgrade is not immediately possible:
- Block chunked `DELETE`/`OPTIONS` requests on rewritten routes at your edge/proxy.
- Enforce authentication/authorization on backend routes per our [security guidance](https://nextjs.org/docs/app/guides/data-security).

## Summary
The default Next.js image optimization disk cache (`/_next/image`) did not have a configurable upper bound, allowing unbounded cache growth.

## Impact
An attacker could generate many unique image-optimization variants and exhaust disk space, causing denial of service.

## Patches
Fixed by adding an LRU-backed disk cache with `images.maximumDiskCacheSize`, including eviction of least-recently-used entries when the limit is exceeded. Setting `maximumDiskCacheSize: 0` disables disk caching. 

## Workarounds
If upgrade is not immediately possible:
- Periodically clean `.next/cache/images`.
- Reduce variant cardinality (e.g., tighten values for `images.localPatterns`, `images.remotePatterns`, and `images.qualities`)

parseHTML() executes scripts in event handlers

jQuery 1.x and 2.x are End-of-Life and no longer receiving security updates

jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution

passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code.

Regex in its jQuery.htmlPrefilter sometimes may introduce XSS

0225eb034d024a03bdc90ea6c79f56193662e7c3eee909696298820e517cbb83

edaac0bedf59a0bb59a31c2644aebc40a0060e491e392418aed8189249e548ed

22b8c6420c53ed310419b9a18fc8bb589c88961d8f6aad39c1f2858bb2c60db5

22031038e39e75078c3c197b952ade3153e626f53ad9b73a97c1dcb065e76d67

viewport

description

twitter:title

twitter:description

twitter:card

next-head-count

AlK2UR5SkAlj8jjdEc9p3F3xuFYlF6LYjAML3EOqw1g26eCwWPjdmecULvBH5MVPoqKYrOfPhYVL71xAXI1IBQoAAAB8eyJvcmlnaW4iOiJodHRwczovL2RvdWJsZWNsaWNrLm5ldDo0NDMiLCJmZWF0dXJlIjoiV2ViVmlld1hSZXF1ZXN0ZWRXaXRoRGVwcmVjYXRpb24iLCJleHBpcnkiOjE3NTgwNjcxOTksImlzU3ViZG9tYWluIjp0cnVlfQ==

Amm8/NmvvQfhwCib6I7ZsmUxiSCfOxWxHayJwyU1r3gRIItzr7bNQid6O8ZYaE1GSQTa69WwhPC9flq/oYkRBwsAAACCeyJvcmlnaW4iOiJodHRwczovL2dvb2dsZXN5bmRpY2F0aW9uLmNvbTo0NDMiLCJmZWF0dXJlIjoiV2ViVmlld1hSZXF1ZXN0ZWRXaXRoRGVwcmVjYXRpb24iLCJleHBpcnkiOjE3NTgwNjcxOTksImlzU3ViZG9tYWluIjp0cnVlfQ==

A9nrunKdU5m96PSN1XsSGr3qOP0lvPFUB2AiAylCDlN5DTl17uDFkpQuHj1AFtgWLxpLaiBZuhrtb2WOu7ofHwEAAACKeyJvcmlnaW4iOiJodHRwczovL2RvdWJsZWNsaWNrLm5ldDo0NDMiLCJmZWF0dXJlIjoiQUlQcm9tcHRBUElNdWx0aW1vZGFsSW5wdXQiLCJleHBpcnkiOjE3NzQzMTA0MDAsImlzU3ViZG9tYWluIjp0cnVlLCJpc1RoaXJkUGFydHkiOnRydWV9

A93bovR+QVXNx2/38qDbmeYYf1wdte9EO37K9eMq3r+541qo0byhYU899BhPB7Cv9QqD7wIbR1B6OAc9kEfYCA4AAACQeyJvcmlnaW4iOiJodHRwczovL2dvb2dsZXN5bmRpY2F0aW9uLmNvbTo0NDMiLCJmZWF0dXJlIjoiQUlQcm9tcHRBUElNdWx0aW1vZGFsSW5wdXQiLCJleHBpcnkiOjE3NzQzMTA0MDAsImlzU3ViZG9tYWluIjp0cnVlLCJpc1RoaXJkUGFydHkiOnRydWV9

A1S5fojrAunSDrFbD8OfGmFHdRFZymSM/1ss3G+NEttCLfHkXvlcF6LGLH8Mo5PakLO1sCASXU1/gQf6XGuTBgwAAACQeyJvcmlnaW4iOiJodHRwczovL2dvb2dsZXRhZ3NlcnZpY2VzLmNvbTo0NDMiLCJmZWF0dXJlIjoiQUlQcm9tcHRBUElNdWx0aW1vZGFsSW5wdXQiLCJleHBpcnkiOjE3NzQzMTA0MDAsImlzU3ViZG9tYWluIjp0cnVlLCJpc1RoaXJkUGFydHkiOnRydWV9

HSTS header missing - vulnerable to protocol downgrade attacks

CSP header missing - vulnerable to XSS attacks

Abuse contact

Three Rivers District Council

Exponential-e Limited

threerivers.gov.uk

Amazon EC2 Abuse

IP Management

Amazon AWS Network Operations

Amazon.com, Inc.

AWS RPKI Management POC

IP Routing

Amazon EC2 Network Operations

AMAZO-CF

Home

{"props":{"pageProps":{"pageData":{"__typename":"PublishedPage","id":"c1ddcf00-fb74-11ec-b5c1-8da4a48a1f28","name":"Home","preparedPageBuilderComponents":[{"type":"row","settings":{"canShowInEditorVie

Requests	IP Address	Location	AS Autonomous System
19	143.204.181.34	United States	AS16509Amazon.com, Inc.
17	172.67.142.245	United States	AS13335Cloudflare, Inc.
17	142.250.154.95	United States	AS15169Google LLC
17	142.251.127.97	United States	AS15169Google LLC
17	13.33.187.11	New York, New York, United States	AS16509Amazon.com, Inc.
87	5	-	-

Security Scan Report: www.threerivers.gov.uk

Summary

AI Security Verdict

Low Risk

Risk Factors

Safety Factors

Details

Screenshot

Page Load Overview

Language Analysis

Primary Language

Detection Details

Website Classification

Primary Category

All Detected Categories

Detected Features

Domain & IP Information

Detected Technologies1

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

ssdeep (Context Triggered Piecewise Hashing)

sdhash (Similarity Digest Hashing)

Image Hashes

Perceptual Hashes

Other Hashes

Scan History