entertainment media

education learning

adult content

government public service

news media journalism

English

Domain 'www.bbfc.co.uk' uses the United Kingdom country-code top-level domain (.co.uk), featuring subdomain 'www'. The second-level label 'bbfc' is 4 characters long containing 0 vowels alongside four consonants. It segments into two words: bb, fc. The median word length lands at two characters. No strong language cues emerged from the frequency lists.

html/e4/8c/e48c23f6-a1b2-4fcd-9aef-c23f1a008a58.html.gz

object-src 'none';frame-ancestors 'self';default-src * 'self' 'unsafe-eval' 'unsafe-inline' blob:

86453342bdf35a64839e6870f7966641267de3dba9a83f8c2fd7a388dd142081

1fd0a52d7a0a17a083bd9cc33aca4738d2ba198472e1946695f6c0e76a293454

4887146a3395c4bf2f710bed1334c7d26477151390710db1caf0ca28ba7cb79d

ae7be6e21ef1f0b160e8538202d0f2c9dc16194f1504bd175ee2466530214dbe

e6f9388f704c23cac64a14a9bd78238fe0aab19764fd1884dedcca6b9f83e928

a84e86eeaf34df5b348b1ad3bdd9682bdcad0db8950ecf494080fb7a79ca76f8

a535c3d6be303471f6fe9c89af4457772bdd5c3acf895c914e00ad43458aa2e3

53f040ec8ab84e2fc18f7b36e7a4468daea065604a137eab5f14c619d1e6ceaf

709ec2bfb8c8b226a3a6a374cd5643b0c5930b4ff99d8a8f7689e4be697ce5fc

0799b054c5b46f666aef625c55e623e37d02bc79173362ead6f8275e9694ee13

0319acc5032d3150657aaae0da686c174ab5e8ae3020e8542a0dffa346109ef4

1fe66642dfa6cfb459ee0080b4616913fd52b3f1e5a62193c235a9cebd16c424

24b8bc523d8d9cd910db113f49e3aa5ffaa3ac424832d61429a6069e64edae81

10e455e02f72935668901f407d0b7f13eb01f2394340e8a39bc56d4c35f36525

0dae9f51c031be17334118217cd7f6148d79c996a8cdaea823e181ebf39a52ac

b6fa3c9929d0d5c43da6452ce91609009c83ed03270bd630e243059681f9c1fe

919ce0b7f9d12f9d6c5d0ca597d2c16f751dbd4c5a67446814ac1e2f7d2e9c03

60c6f5c27ae0aea4042ec4f5ca0f7134afd81a2e94576a97b3c0b2d30ef6fcb9

653f3e53e89b4f8548ff86c19e92bb3c6b84b6be7485a320b1e00893ed877479

fca84a5560465b104bde6724b2fb0a6389f2f61cdcfe439b812c83c10037071f

4d53b914be2f69fda14122daaeca30df2f76f36f21bd6af0a03c739f1bc03cd1

aabefaa60fe9e09ae05d1ea53ccacf8d83cadaf4ac0a433d490423c55b35b4a2

3fb8da0e7a28f480216f2d478b5f0ea45a51223bd3a52a2255ad7d44a06fbe9d

2d43849ffb69c96d23273a8fe2bbd7df0e75aa0a761c1e362c481ee66f089f5e

e90f0da30a7d353c85de81384b3ca3954706236877a816b373fea5b4734c5705

03d3bfb35c321d4ed72bd1a4b267ae111463df4651a47e092c881d732c5e1c8b

8d1172378da1f63d7b2b45d8f09e16ee69f578c776caa2d8064082129d93443d

741fa82c7ed2ee40b90b603cf8093450e4275f1f8084cf274a5866e5da153199

8aa7969d4e901aa0e3e4a16080078fe08a179a82f9575b67a8c8e2b4a3d3f834

f7c0e250b0873a665c51c01eb398629762b0a767664f0f5d4c4e3eb0e5a6da13

fbe7e89501c367bad358eab7507380e72f634ef9c5af01c347cea87e5e4b0907

a7655b1dc2725a8c26af589c627d5dc6b56a1edcfa723547f17b2bf5b019a296

Unexpected server crash in Next.js versions

Next.js missing cache-control header may lead to CDN caching empty reply

Denial of Service condition in Next.js image optimization

Next.js authorization bypass vulnerability

Next.js Race Condition to Cache Poisoning

A vulnerability in Next.js Image Optimization has been fixed in v15.4.5 and v14.2.31. When images returned from API routes vary based on request headers (such as `Cookie` or `Authorization`), these responses could be incorrectly cached and served to unauthorized users due to a cache key confusion bug.

All users are encouraged to upgrade if they use API routes to serve images that depend on request headers and have image optimization enabled.

More details at [Vercel Changelog](https://vercel.com/changelog/cve-2025-57752)

A vulnerability in **Next.js Image Optimization** has been fixed in **v15.4.5** and **v14.2.31**. The issue allowed attacker-controlled external image sources to trigger file downloads with arbitrary content and filenames under specific configurations. This behavior could be abused for phishing or malicious file delivery.

All users relying on `images.domains` or `images.remotePatterns` are encouraged to upgrade and verify that external image sources are strictly validated.

More details at [Vercel Changelog](https://vercel.com/changelog/cve-2025-55173)

A vulnerability in **Next.js Middleware** has been fixed in **v14.2.32** and **v15.4.7**. The issue occurred when request headers were directly passed into `NextResponse.next()`. In self-hosted applications, this could allow Server-Side Request Forgery (SSRF) if certain sensitive headers from the incoming request were reflected back into the response.

All users implementing custom middleware logic in self-hosted environments are strongly encouraged to upgrade and verify correct usage of the `next()` function.

More details at [Vercel Changelog](https://vercel.com/changelog/cve-2025-57822)

A DoS vulnerability exists in self-hosted Next.js applications that have `remotePatterns` configured for the Image Optimizer. The image optimization endpoint (`/_next/image`) loads external images entirely into memory without enforcing a maximum size limit, allowing an attacker to cause out-of-memory conditions by requesting optimization of arbitrarily large images. This vulnerability requires that `remotePatterns` is configured to allow image optimization from external domains and that the attacker can serve or control a large image on an allowed domain.

Strongly consider upgrading to 15.5.10 and 16.1.5 to reduce risk and prevent availability issues in Next applications.

## Summary
When Next.js rewrites proxy traffic to an external backend, a crafted `DELETE`/`OPTIONS` request using `Transfer-Encoding: chunked` could trigger request boundary disagreement between the proxy and backend. This could allow request smuggling through rewritten routes.

## Impact
An attacker could smuggle a second request to unintended backend routes (for example, internal/admin endpoints), bypassing assumptions that only the configured rewrite destination/path is reachable. This does not impact applications hosted on providers that handle rewrites at the CDN level, such as Vercel. 

## Patches
The vulnerability originated in an upstream library vendored by Next.js. It is fixed by updating that dependency’s behavior so `content-length: 0` is added only when both `content-length` and `transfer-encoding` are absent, and `transfer-encoding` is no longer removed in that code path.

## Workarounds
If upgrade is not immediately possible:
- Block chunked `DELETE`/`OPTIONS` requests on rewritten routes at your edge/proxy.
- Enforce authentication/authorization on backend routes per our [security guidance](https://nextjs.org/docs/app/guides/data-security).

## Summary
The default Next.js image optimization disk cache (`/_next/image`) did not have a configurable upper bound, allowing unbounded cache growth.

## Impact
An attacker could generate many unique image-optimization variants and exhaust disk space, causing denial of service.

## Patches
Fixed by adding an LRU-backed disk cache with `images.maximumDiskCacheSize`, including eviction of least-recently-used entries when the limit is exceeded. Setting `maximumDiskCacheSize: 0` disables disk caching. 

## Workarounds
If upgrade is not immediately possible:
- Periodically clean `.next/cache/images`.
- Reduce variant cardinality (e.g., tighten values for `images.localPatterns`, `images.remotePatterns`, and `images.qualities`)

e98e9302d866cea66264a8989ab80dd1dd2f37c7ffb5251c9b56f6ffe5cd8287

134e32f58b8ba64cc95dadd8a380505dad17405e8aff412ed907e6dcb599f58c

Welcome to the British Board of Film Classification
Our age ratings provide children and families wi

Finding Emily
moderate sex references, drug references, infrequent strong language
Romantic comedy i

viewport

width=device-width, initial-scale=1, viewport-fit=cover

facebook-domain-verification

twitter:card

twitter:site

robots

googlebot

We help children and families across the UK choose content well – whatever they watch, wherever and however they watch it.

Requests	IP Address	Location	AS Autonomous System
32	34.147.215.88	City of London, England, United Kingdom	AS396982Google LLC
31	184.24.77.144	Frankfurt am Main, Hesse, Germany	AS20940Akamai International B.V.
31	185.111.111.157	Frankfurt am Main, Hesse, Germany	AS212238Datacamp Limited
94	3	-	-

Security Scan Report: www.bbfc.co.uk

Summary

AI Security Verdict

Safe Website

Safety Factors

Details

Screenshot

Page Load Overview

Language Analysis

Primary Language

Detection Details

Website Classification

Primary Category

All Detected Categories

Detected Features

Domain & IP Information

Detected Technologies3

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

ssdeep (Context Triggered Piecewise Hashing)

sdhash (Similarity Digest Hashing)

Image Hashes

Perceptual Hashes

Other Hashes

Scan History