social media network

technology software

documentation technical

download file sharing

corporate

English

Within the application-focused generic top-level domain (.app), 'wormhole.app' is registered while skipping any subdomain. The registrable portion 'wormhole' spans 8 characters split between 3 vowels and five consonants. It segments into 1 word: wormhole. Expect eight characters per word on average. No strong language cues emerged from the frequency lists.

html/a6/4a/a64a143b-2dee-4558-8423-468d318539be.html.gz

default-src 'self' ; connect-src 'self' blob: wss://wormhole.app https://*.backblaze.com https://*.backblazeb2.com ; img-src 'self' blob: data: ; media-src 'self' blob: ; object-src 'none' ; script-src 'self' ; style-src 'self' 'unsafe-inline' ; base-uri 'none' ; frame-ancestors 'self' ; form-action 'self' ;

2a7da730f180be8026dcb6513264f9d7150a3387eeaa478d8df6daa962d4c3b1

dbb30a9c9fbed23b803d93d58d20c96479e56a26cd8fc4ccd1f6e59666c84d41

71bc69c41a732695f1c620fa598822f960ad6e756b04a4a7b96f3442051fcd8c

aaaecd2de6d93897b4c145ffd425f16652b6625e0c1593dc118ad869ec3150c9

d9481c543b5be57b8a7c91588a50f438670ae2129b3121e9faf87001d9d606ab

667adcc04c0d34ab14d0342305b7523d3152ab201b8f3ee9f647973f02c76469

93c74eca1b4cb45f6c3a154deecb0cb3c51512b2c013aba13f3f54e93a1ab3bb

a3d2683d867eae4925ff30852cbd617ed607f3ad1c9703e58b2c96ce01d7fd51

5f45bb5d2865dbf44b817296cbdccb035cba0868a449c187443d9ac872154db7

ed8faed94c9932e7fb5b9b98199081b8b06588cce035b8bd19712814f5b528a3

1d31b15173b7ace668a668de0986c11af7578664447b8cf6475d0fd5a79a17aa

def51f0dc68ec690b4338acf153090811b773536d090bbdcf68e65f060bf0ed8

6790088383e8ae0e081dd9432fa27ace98b7de9d62ad4ba02ffc88bde15c1bcd

3073cf3fe8b639efc4dff8ab5dbf8af6947542ea57a54f2a7a33aaa570420204

50248a61bef8f64f71aa0ef9f2e805358a76b5aaa675e2a863ae899f4e008ace

15a598d4b4be864e5a021adf30cbbf35174472c72353901618d7c0e1e1db9c46

d910b2c8206ec05256c68e629c5a026250bbde613c0682beb058437e38798992

38e04ff1f5e317a0417ed3a15b8ddedb3f2341e6abe3a29e0b817ff7cb55e03a

a7790d8fb531a1386ca426043ed501c06f7d31a2a7da56199d98903c4088901c

d8535c69d3da00d87780db50744be93ec6d5c7161bca434b06455ed378b1a6d0

46174023366273edd5128dcd6c5d279767b585a79f09910af9b2aa518f7348d5

0dcedb83a20c92b1758bf750dab53a8ed3213361633d40f22880f9a085b4dbeb

de5341313a4dc5d982ca50ae4a491e84bc5e80b0f439d87f05fc3973c1b7e59a

e28e75d2a21f91b146928ae948d8aa66cb84d9a7b5ae620d518c8826f030d57d

720c5c64c8e13e0a54872373bb689c10ed4a6f564a7f4d7fe9a119f39d511ee1

3aafef96c1bc6ff1a33dfabbe69d4be0568b4bbd327462cbd05e4da90ac440d4

Authorization Bypass in Next.js Middleware

Next.js missing cache-control header may lead to CDN caching empty reply

Denial of Service condition in Next.js image optimization

Next.js authorization bypass vulnerability

Next.js Race Condition to Cache Poisoning

A vulnerability in Next.js Image Optimization has been fixed in v15.4.5 and v14.2.31. When images returned from API routes vary based on request headers (such as `Cookie` or `Authorization`), these responses could be incorrectly cached and served to unauthorized users due to a cache key confusion bug.

All users are encouraged to upgrade if they use API routes to serve images that depend on request headers and have image optimization enabled.

More details at [Vercel Changelog](https://vercel.com/changelog/cve-2025-57752)

A vulnerability in **Next.js Image Optimization** has been fixed in **v15.4.5** and **v14.2.31**. The issue allowed attacker-controlled external image sources to trigger file downloads with arbitrary content and filenames under specific configurations. This behavior could be abused for phishing or malicious file delivery.

All users relying on `images.domains` or `images.remotePatterns` are encouraged to upgrade and verify that external image sources are strictly validated.

More details at [Vercel Changelog](https://vercel.com/changelog/cve-2025-55173)

A vulnerability in **Next.js Middleware** has been fixed in **v14.2.32** and **v15.4.7**. The issue occurred when request headers were directly passed into `NextResponse.next()`. In self-hosted applications, this could allow Server-Side Request Forgery (SSRF) if certain sensitive headers from the incoming request were reflected back into the response.

All users implementing custom middleware logic in self-hosted environments are strongly encouraged to upgrade and verify correct usage of the `next()` function.

More details at [Vercel Changelog](https://vercel.com/changelog/cve-2025-57822)

A DoS vulnerability exists in self-hosted Next.js applications that have `remotePatterns` configured for the Image Optimizer. The image optimization endpoint (`/_next/image`) loads external images entirely into memory without enforcing a maximum size limit, allowing an attacker to cause out-of-memory conditions by requesting optimization of arbitrarily large images. This vulnerability requires that `remotePatterns` is configured to allow image optimization from external domains and that the attacker can serve or control a large image on an allowed domain.

Strongly consider upgrading to 15.5.10 and 16.1.5 to reduce risk and prevent availability issues in Next applications.

## Summary
When Next.js rewrites proxy traffic to an external backend, a crafted `DELETE`/`OPTIONS` request using `Transfer-Encoding: chunked` could trigger request boundary disagreement between the proxy and backend. This could allow request smuggling through rewritten routes.

## Impact
An attacker could smuggle a second request to unintended backend routes (for example, internal/admin endpoints), bypassing assumptions that only the configured rewrite destination/path is reachable. This does not impact applications hosted on providers that handle rewrites at the CDN level, such as Vercel. 

## Patches
The vulnerability originated in an upstream library vendored by Next.js. It is fixed by updating that dependency’s behavior so `content-length: 0` is added only when both `content-length` and `transfer-encoding` are absent, and `transfer-encoding` is no longer removed in that code path.

## Workarounds
If upgrade is not immediately possible:
- Block chunked `DELETE`/`OPTIONS` requests on rewritten routes at your edge/proxy.
- Enforce authentication/authorization on backend routes per our [security guidance](https://nextjs.org/docs/app/guides/data-security).

## Summary
The default Next.js image optimization disk cache (`/_next/image`) did not have a configurable upper bound, allowing unbounded cache growth.

## Impact
An attacker could generate many unique image-optimization variants and exhaust disk space, causing denial of service.

## Patches
Fixed by adding an LRU-backed disk cache with `images.maximumDiskCacheSize`, including eviction of least-recently-used entries when the limit is exceeded. Setting `maximumDiskCacheSize: 0` disables disk caching. 

## Workarounds
If upgrade is not immediately possible:
- Periodically clean `.next/cache/images`.
- Reduce variant cardinality (e.g., tighten values for `images.localPatterns`, `images.remotePatterns`, and `images.qualities`)

7cb5a87a6c0d05aab2245cbf6a26adad80cd322540d5f6360dde621bf922743f

46dcbd577177a889a750c8778df24233c67008aefa33dd6abb5874d3f2319478

width=device-width, initial-scale=1, viewport-fit=cover

viewport

Wormhole lets you share files with end-to-end encryption and a link that automatically expires.

Requests	IP Address	Location	AS Autonomous System
32	104.26.13.214	United States	AS13335Cloudflare, Inc.
32	1	-	-

Security Scan Report: wormhole.app

Summary

AI Security Verdict

High Risk

Risk Factors

Details

Screenshot

Page Load Overview

Language Analysis

Primary Language

Detection Details

Website Classification

Primary Category

All Detected Categories

Detected Features

Domain & IP Information

Detected Technologies7

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

ssdeep (Context Triggered Piecewise Hashing)

sdhash (Similarity Digest Hashing)

Image Hashes

Perceptual Hashes

Other Hashes

Scan History