This board is no longer shared, or has been removed

technology software

documentation technical

corporate

English

ajs_anonymous_id

The domain name 'api.miro.com' uses the commercial generic top-level domain (.com) with subdomain 'api'. The core label 'miro' covers 4 characters split between 2 vowels and two consonants. Splitting it apart reveals 1 word: miro. No strong language cues emerged from the frequency lists.

html/dd/aa/ddaa4058-a6fc-48bc-a62c-f40c160ddb9f.html.gz

default-src 'unsafe-inline' 'unsafe-eval' data: blob: filesystem: about: miroapp: wss: ws: *; frame-src 'unsafe-inline' 'unsafe-eval' data: blob: miroapp: *; base-uri 'unsafe-inline' about: data: *; form-action 'unsafe-inline' data: post-it-alpha: post-it: com.mmm.postit.miro: *; worker-src 'unsafe-inline' data: blob: miroapp: *; report-uri https://o881784.ingest.sentry.io/api/4504236954746881/security/?sentry_key=d91c0e40f45348d7afe4293693f9474a&sentry_environment=miro-eu;

c1d66da21e54787f63b8e7d490f6446d941e16fa612e47fdb49a7b6f94637b15

f1824ea94d0973fab2d65ce818c79697c58b0d001420359c367312da39d54200

e876ce18056af8df2ae0365995332012489abe0269d3b795825a12de6f38cf0a

c331f6e804607a7a636ef8b93babcb7d98298d5f50a6ea49144f2c02fdd8ad5b

82178fcd07a4e2087f8d41d1d5816aca3f807c181773468367ae2169e6411ff4

2ac3f8ca3f9936ab1c95e5c075d71b4955eac6081d39c6f07e6e4ef58f2ccd7d

e9c9e61881bda34675fdd5bfe0da7368fa732ce45f8f7db0df0e193f12928eef

f1777afbc5a9db456f4b31e7f4857c2ecabeea14f4c42d71749d06ef03ec9267

ff543e704fb758eec78506cf1a1701240351e1ee68e6f6c196e3dd39984b6c8b

52d7472cd59d21f819c0024a4675d4a6b727608b15f9fe5d9abd1a3ea94246fc

39863041cd22a70c939bbe5406b60d8e0a34c0dd323596b4494c0e3255cfbd2c

4e446ad4625c3e89cc4423df7472ddf3dbf77cb5c6bf7b723425f9f48708cfb6

70120dfaf741782d9b8bc69494d4d34b7093e4e613fcc54f07a684356c5b1387

b4951a3e7cc97098b3624e930d6eda180fe144229fe1bc115d3be9b6c6d6f52c

8e0d45fb8e98d098edfdca34c8ae22084665cb5b39bf502dac6c336da129409b

dabc13401f5ede43446be8b6caea67941d5cdaebab457668d1e9a846f7e7918f

66359017982fdddd9bc0c605e890ab7265e777d19daf30703fd53f5f13e44aa1

1f94526fcd973670b55620152e65208f89e062c5fca7015e2d423164b86d978d

6237e819b2a2fd626ad3cc06a2fb277540ea92cdca3c65bc23bbaf51ed3d01fa

6c6e1aeb7c6264df4f00621577a98ac23afccb40b4ce068ca966cc7dc9c5cb43

78030334123115188167523d4bd2e777c1d762597842449153b86c5fb42b5944

468cbbb63771a7dd3bd94f600adb5fcb0cb6c91561cd12ce5d5624aca1e71e49

419b8f2a104d3e01c1f1587dacb9012f292840faeb930dd9fd32d63cdae3a060

7b96682789fcaaa8898ad657ec7f89c82033f5e0238fb9cad2d6d76682f1c970

742a91dc366728c796e1779cd5bee45603adb8cdef555d76ea5158550a1e95e2

d370afd50d21c76648c26b0e9d417a7297a1fb53b46cf5448be7625f036d11e1

4f088a7e4f263816a6b44c47f5aab14347bb695a1d66d25760bc1807c0dee7f7

da275c6f9e0bccb000f23f7d7a58391c36751ce89c3d6a58a226be9d324c6d43

6f149735fca907c0d417a4755197e5ecb1c536b45ded3c0ddefa87db73255c7b

01ff5114cc2a149386f0fb7fb3709b0398666b76902e260ab56c2996afd22e96

f15a1127d6ff24452a2433782f33eebfa97202d3559f48e530010441d20cce19

9f5b5802537623632862c05721d15f0e7dd18ac900fa6de2521bee4a4cc70b0d

c9a6991bac7f5103ac676d57db830ef441915b9821f6b7cb6ec6c4bac2460843

3c67856742a6397237f0920e0a077cea2554e269fc7842b426b8cc5fd55c4e52

39ff7c8090ab4e453de684664c58525b40d751cf2882d5acb78e61133f02dd02

0a78c5e0a4fc87b0f93e3ec6e8d2d5a223088eccae796bb99a8ac2a40f363d4f

960b9a490ad7d5a058fba7b4f7c575062baa83b9de873b8a202df43571f9c57c

36b1963d323719fc1c78ae8358c1e4a6c76c7ed758e5c54b11fccb24747183ea

114e94a5045fb363d6d0d4f9df3b2c20532bb1cd9440e8baaa81d1fdc8844ef7

d481b79428180da785bc9ddf96e137cc62a0d3bb608100deb3098c6fd6a7a06e

db4f1a32ff7b1c0aed3357026c71143b7eed5cff76e83010b594fa152b66c4eb

495d77197394065f8d51840fc34ee9d9be4a948c36edf2e5bb8f07e4442b66a3

cefaedc2c14a8a205b15edd44b1504148597ed5393fda5670b9fb7e6a03daf96

5c9cd87f465d8aa47b990533c7415a7736373925b090dbf323924cc4f80d74d6

f77dfa01d5a1e7a6d32e6d2a5259c85ead1baae8130432718eac31948f3b1555

2b63d3ca93bef9d3177ec372687c8694c2b1fe13d0471e8a9ee2fb28c7ec9634

A vulnerability affects certain React packages for versions 19.0.0, 19.0.1, 19.1.0, 19.1.1, 19.1.2, 19.2.0, and 19.2.1 and frameworks that use the affected packages, including Next.js 15.x and 16.x using the App Router. The issue is tracked upstream as [CVE-2025-55184](https://www.cve.org/CVERecord?id=CVE-2025-55184).

A malicious HTTP request can be crafted and sent to any App Router endpoint that, when deserialized, can cause the server process to hang and consume CPU. This can result in denial of service in unpatched environments.

A vulnerability affects certain React packages for versions 19.0.0, 19.0.1, 19.1.0, 19.1.1, 19.1.2, 19.2.0, and 19.2.1 and frameworks that use the affected packages, including Next.js 15.x and 16.x using the App Router. The issue is tracked upstream as [CVE-2025-55183](https://www.cve.org/CVERecord?id=CVE-2025-55183).

A malicious HTTP request can be crafted and sent to any App Router endpoint that can return the compiled source code of [Server Functions](https://react.dev/reference/rsc/server-functions). This could reveal business logic, but would not expose secrets unless they were hardcoded directly into [Server Function](https://react.dev/reference/rsc/server-functions) code.

A vulnerability affects certain React Server Components packages for versions 19.0.x, 19.1.x, and 19.2.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. The issue is tracked upstream as [CVE-2026-23864](https://github.com/facebook/react/security/advisories/GHSA-83fc-fqcc-2hmg).

A specially crafted HTTP request can be sent to any App Router Server Function endpoint that, when deserialized, may trigger excessive CPU usage, out-of-memory exceptions, or server crashes. This can result in denial of service in unpatched environments.

A vulnerability in Next.js Image Optimization has been fixed in v15.4.5 and v14.2.31. When images returned from API routes vary based on request headers (such as `Cookie` or `Authorization`), these responses could be incorrectly cached and served to unauthorized users due to a cache key confusion bug.

All users are encouraged to upgrade if they use API routes to serve images that depend on request headers and have image optimization enabled.

More details at [Vercel Changelog](https://vercel.com/changelog/cve-2025-57752)

A vulnerability in **Next.js Image Optimization** has been fixed in **v15.4.5** and **v14.2.31**. The issue allowed attacker-controlled external image sources to trigger file downloads with arbitrary content and filenames under specific configurations. This behavior could be abused for phishing or malicious file delivery.

All users relying on `images.domains` or `images.remotePatterns` are encouraged to upgrade and verify that external image sources are strictly validated.

More details at [Vercel Changelog](https://vercel.com/changelog/cve-2025-55173)

A vulnerability in **Next.js Middleware** has been fixed in **v14.2.32** and **v15.4.7**. The issue occurred when request headers were directly passed into `NextResponse.next()`. In self-hosted applications, this could allow Server-Side Request Forgery (SSRF) if certain sensitive headers from the incoming request were reflected back into the response.

All users implementing custom middleware logic in self-hosted environments are strongly encouraged to upgrade and verify correct usage of the `next()` function.

More details at [Vercel Changelog](https://vercel.com/changelog/cve-2025-57822)

A DoS vulnerability exists in self-hosted Next.js applications that have `remotePatterns` configured for the Image Optimizer. The image optimization endpoint (`/_next/image`) loads external images entirely into memory without enforcing a maximum size limit, allowing an attacker to cause out-of-memory conditions by requesting optimization of arbitrarily large images. This vulnerability requires that `remotePatterns` is configured to allow image optimization from external domains and that the attacker can serve or control a large image on an allowed domain.

Strongly consider upgrading to 15.5.10 and 16.1.5 to reduce risk and prevent availability issues in Next applications.

## Summary
When Next.js rewrites proxy traffic to an external backend, a crafted `DELETE`/`OPTIONS` request using `Transfer-Encoding: chunked` could trigger request boundary disagreement between the proxy and backend. This could allow request smuggling through rewritten routes.

## Impact
An attacker could smuggle a second request to unintended backend routes (for example, internal/admin endpoints), bypassing assumptions that only the configured rewrite destination/path is reachable. This does not impact applications hosted on providers that handle rewrites at the CDN level, such as Vercel. 

## Patches
The vulnerability originated in an upstream library vendored by Next.js. It is fixed by updating that dependency’s behavior so `content-length: 0` is added only when both `content-length` and `transfer-encoding` are absent, and `transfer-encoding` is no longer removed in that code path.

## Workarounds
If upgrade is not immediately possible:
- Block chunked `DELETE`/`OPTIONS` requests on rewritten routes at your edge/proxy.
- Enforce authentication/authorization on backend routes per our [security guidance](https://nextjs.org/docs/app/guides/data-security).

A denial of service vulnerability exists in Next.js versions with Partial Prerendering (PPR) enabled when running in minimal mode. The PPR resume endpoint accepts unauthenticated POST requests with the `Next-Resume: 1` header and processes attacker-controlled postponed state data. Two closely related vulnerabilities allow an attacker to crash the server process through memory exhaustion:

1. **Unbounded request body buffering**: The server buffers the entire POST request body into memory using `Buffer.concat()` without enforcing any size limit, allowing arbitrarily large payloads to exhaust available memory.

2. **Unbounded decompression (zipbomb)**: The resume data cache is decompressed using `inflateSync()` without limiting the decompressed output size. A small compressed payload can expand to hundreds of megabytes or gigabytes, causing memory exhaustion.

Both attack vectors result in a fatal V8 out-of-memory error (`FATAL ERROR: Reached heap limit Allocation failed - JavaScript heap out of memory`) causing the Node.js process to terminate. The zipbomb variant is particularly dangerous as it can bypass reverse proxy request size limits while still causing large memory allocation on the server.

To be affected, an application must run with `experimental.ppr: true` or `cacheComponents: true` configured along with the NEXT_PRIVATE_MINIMAL_MODE=1 environment variable.

Strongly consider upgrading to 15.6.0-canary.61 or 16.1.5 to reduce risk and prevent availability issues in Next applications.

## Summary
The default Next.js image optimization disk cache (`/_next/image`) did not have a configurable upper bound, allowing unbounded cache growth.

## Impact
An attacker could generate many unique image-optimization variants and exhaust disk space, causing denial of service.

## Patches
Fixed by adding an LRU-backed disk cache with `images.maximumDiskCacheSize`, including eviction of least-recently-used entries when the limit is exceeded. Setting `maximumDiskCacheSize: 0` disables disk caching. 

## Workarounds
If upgrade is not immediately possible:
- Periodically clean `.next/cache/images`.
- Reduce variant cardinality (e.g., tighten values for `images.localPatterns`, `images.remotePatterns`, and `images.qualities`)

2b85acda829d3c7caddf7064053da606dfff3b45f011737d27d43ecab6b2a528

d086c71e1eecf379eb1ce48b38ffa38757a9a9975d002e75da6b46d055fc599b

d08a8ee43de607a20ae0158089f5fbc8b4ba664e0b8d16c358ef97711edb0bbb

3e2344719158fd60a410bc59c116081ef2d81904b4737419f5d4de6ab6f007b8

acf9171428b8e366837d07163aa09813844e4e4eb500a365c3fb4acf64140167

f3214eed41a9f148d1e4ff2a1d084364517b0eeb8c19ecf924a36054b7dbd54d

viewport

https://mirostatic.com/website/1785321484869/assets/images/miro.png

twitter:card

twitter:url

twitter:title

twitter:image

w9ld7s6-k1sgt064fgtd0onubirhhz5agmkbckiwizt-7qgsjt8za6wrfsby5kucji2vigd377lzy1i3q-3m5307wjol1jorjgttyu1qcuu5ddja7b37urwxv5koavm2

norton-safeweb-site-verification

WIon1vu5R2WfrHPhaNYKxsaWzrg9FDdXOvSyubpwmC8

google-site-verification

p:domain_verify

description

twitter:description

Amazon Registrar, Inc.

MIRO.COM

GC Abuse

Google LLC

GOOGL-2

globalThis.config_env = JSON.parse('{"NEXT_PUBLIC_FEATURE_FLAG_KEY":"QoFZgKza2g7SsIrwVd7wP0ikoeFLzAhw","NEXT_PUBLIC_SENTRY_DSN":"https://967954a774f946f975ae17ad4da3097e@o881784.ingest.us.sentry.io/4509094117703681","NEXT_PUBLIC_SIGN_IN_SERVICE_URL":"https://svc.eu01.miro.com/api/sign-in","NEXT_PUBLIC_WEBSITE_DATA_URL":"https://website-data-app-public.svc.miro.com/","NEXT_PUBLIC_SERVICE_VERSION":"2026.729.103804-272d08","NEXT_PUBLIC_GOOGLE_CLIENT_ID":"1062019541050-8mvc17gv9c3ces694hq5k1h6uqio1cfn.apps.googleusercontent.com","NEXT_PUBLIC_SENTRY_ENABLED":"true","NEXT_PUBLIC_BILLING_AND_PAYMENTS":"https://svc.eu01.miro.com","NEXT_PUBLIC_ANALYTICS_EVENTHUB_AUTH":"dGQcphBu9zMNgc3hNep9F4wFVvzVI936","NEXT_PUBLIC_ANALYTICS_EVENTHUB_ENDPOINT":"https://eventhub.eu01.miro.com/api/stream","NEXT_PUBLIC_ANALYTICS_EVENTHUB_URL":"/static/vendor/segment.io.js","NEXT_PUBLIC_ANALYTICS_GTM_ID":"GTM-N5MCLT8","NEXT_PUBLIC_ANALYTICS_GTM_AUTH":"CBAK1gBBSfPGTh5B458efg","NEXT_PUBLIC_CHANGES_CONTENTFUL_SPACE":"udc161ufuk3a","NEXT_PUBLIC_CHANGES_CONTENTFUL_ENVIRONMENT":"master","NEXT_PUBLIC_API_BASE_PATH":"/miro-site-lp-build-api","NEXT_PUBLIC_CONTENT_HUB_ENVIRONMENT":"master","NEXT_PUBLIC_CONTENT_HUB_SPACE":"x3tur5ylnyf2","NEXT_PUBLIC_LP_BUILDER_CONTENTFUL_ENVIRONMENT":"master","NEXT_PUBLIC_LP_BUILDER_CONTENTFUL_SPACE":"w6r2i5d8q73s","NEXT_PUBLIC_SPLITIO_CLIENT_KEY":"[REDACTED SECRET]","NEXT_PUBLIC_ANALYTICS_EVENTHUB_EXIT_EVENT":"website_tab_exited","NEXT_PUBLIC_SERVICE_NAME":"website"}');

Miro

{"props":{"pageProps":{"_nextI18Next":{"initialI18nStore":{"en-US":{"lpb":{},"pricing":{}},"en":{"lpb":{"lpb.banner.left.cursor":"October 14","lpb.banner.right.cursor":"NYC or Virtual","lpb.bookADemoC

Requests	IP Address	Location	AS Autonomous System
29	13.33.187.2Cloudfront · CDN	New York, New York, United States	AS16509Amazon.com, Inc.
29	18.244.18.70Cloudfront · CDN	United States	AS16509Amazon.com, Inc.
29	65.9.130.114Cloudfront · CDN	United States	AS16509Amazon.com, Inc.
87	3	-	-

Security Scan Report: api.miro.com

Summary

AI Security Verdict

Not Assessed

Details

Bot Protection Detected

Screenshot

Page Load Overview

Language Analysis

Primary Language

Detection Details

Website Classification

Primary Category

All Detected Categories

Detected Features

Domain & IP Information

Detected Technologies7

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

ssdeep (Context Triggered Piecewise Hashing)

sdhash (Similarity Digest Hashing)

Image Hashes

Perceptual Hashes

Other Hashes

Scan History