German

Domain 'cabin-queue.web.app' uses the application-focused generic top-level domain (.app) with subdomain 'cabin-queue'. The second-level label 'web' is 3 characters long with 1 vowel and 2 consonants. Splitting it apart reveals 1 word: web. No strong language cues emerged from the frequency lists.

email

password

c97aca04b7047ac89211689bc9e370bdc0702f751afbe3a5be1ba7d727d095f4

69b480bde4fd3931ee222b39ca2a01f70b041f0f6d2655431710f6d81ca0fe8d

d11ce51e2ebe7c8f9df7cac0b25537957f0d5610387c4b538b6aa8c3ace4b2e2

c02ece6e5487322b4987f94681f1152997fac75c9a0f3ec45e0a5d7af0c99989

f2ae26ff518d9519afd2a3dc277d84e098458e6b6b85fa9548cda2bed24435e7

63c3d41233ffab538bf93ad583cf0562eb9c93edec0752a7df5630e342a8ca76

c52479c69eac1cb84fb48d0aa88255a1699b0c599099c984ee3ddc77d2c021f5

6f5b4aa00d2f8d6aed9935b471806bf7acef464d0c1d390260e5fe27f800c67e

e83e2f7fef8b2012005747bd400c3fcc170675b65fc976319c676c5ba77f2e4b

8b4c6cc3fbc98b7dd88497b19e797e99d70110d8ebf48164ab94a8cf0824382e

f055c3e8486585cb14ba065de062fcb2929a354d9a6f7b6a318a6aa6a8752b72

1fcf7b8403bf80aa0168bcb30ebae254d3ac86d71ffb80006689deecbaa3eb5c

bdd8aca4fc840afff1252e548ca77a4718b0db29ee4a6f64a57cb2fd313734d3

9d7b64e91fbadb7f048c194a00664a8227d0c82eeacae9d05f88cf3e47323835

80ccbd59324b96cd3272cab291e573146c89a7fc08ffb87c8db3c177498ac6ad

562b401e097244c6ee902ce23b501195f1f2bd99163114a6e3d346a69d29e48d

9586144ef14b43612706975daaa75f175b9a1fa1c20fc6a3657480b65c8b92cd

Next.js missing cache-control header may lead to CDN caching empty reply

Next.js Denial of Service (DoS) condition

Next.js Vulnerable to HTTP Request Smuggling

Next.js Allows a Denial of Service (DoS) with Server Actions

Authorization Bypass in Next.js Middleware

Next.js Server-Side Request Forgery in Server Actions

Denial of Service condition in Next.js image optimization

Next.js authorization bypass vulnerability

Next.js Race Condition to Cache Poisoning

Information exposure in Next.js dev server due to lack of origin verification

A cache key confusion bug in Next.js Image Optimization (fixed in v15.4.5 and v14.2.31) caused images served from API routes that vary on request headers like Cookie or Authorization to be incorrectly cached and potentially served to unauthorized users.

A vulnerability in Next.js Image Optimization (fixed in v15.4.5 and v14.2.31) allowed attacker-controlled external image sources to trigger file downloads with arbitrary content and filenames, enabling phishing or malicious file delivery.

A Server-Side Request Forgery (SSRF) vulnerability in Next.js Middleware (fixed in v14.2.32 and v15.4.7) allowed sensitive request headers to be reflected back when passed directly into NextResponse.next() in self-hosted applications.

A vulnerability in React Server Components (versions 19.0.0-19.2.1) and Next.js 15.x/16.x App Router allows a specially crafted HTTP request to cause the server process to hang and consume CPU during deserialization, resulting in Denial of Service.

The fix for CVE-2025-55184 in React Server Components was incomplete. An incomplete patch in React 19.0.2, 19.1.3, and 19.2.2 and Next.js 13.x-16.x App Router allows a specially crafted HTTP request to Server Function endpoints to trigger an infinite loop, causing CPU exhaustion and Denial of Service.

A vulnerability in React Server Components packages (versions 19.0.x-19.2.x) and Next.js 13.x-16.x App Router allows a specially crafted HTTP request to Server Function endpoints to trigger excessive CPU usage, out-of-memory exceptions, or server crashes, resulting in Denial of Service.

A Denial of Service vulnerability exists in self-hosted Next.js applications with remotePatterns configured for the Image Optimizer. The /_next/image endpoint loads external images entirely into memory without a size limit, allowing an attacker to exhaust server memory by requesting optimization of arbitrarily large images from allowed domains.

Next.js is vulnerable to HTTP request smuggling when proxying traffic through rewrites. A crafted DELETE or OPTIONS request using Transfer-Encoding: chunked can trigger request boundary disagreement between the Next.js proxy and the backend, allowing an attacker to smuggle requests to unintended backend routes including internal or admin endpoints.

The Next.js image optimization disk cache had no configurable upper bound, allowing unbounded growth. An attacker could generate many unique image optimization variants to exhaust disk space and cause Denial of Service, fixed by adding an LRU-backed disk cache with configurable maximum size.

A vulnerability in React Server Components (version 19.x) and Next.js 13.x-16.x App Router allows a specially crafted HTTP request to Server Function endpoints to trigger excessive CPU usage, resulting in Denial of Service.

Self-hosted Next.js applications are vulnerable to Denial of Service via the Image Optimization API for local images. The /_next/image endpoint fetches local images entirely into memory without enforcing a maximum response size, allowing an attacker to cause out-of-memory conditions by requesting large local assets matching the configured localPatterns.

Next.js Pages Router applications with i18n configured are vulnerable to middleware authorization bypass. Locale-less /_next/data/<buildId>/<page>.json requests do not trigger middleware execution, allowing attackers to retrieve server-side rendered JSON for protected pages without passing authorization checks.

Next.js is vulnerable to cache poisoning and Denial of Service via the x-nextjs-data request header. An external client sending this header on a request to a redirect-returning middleware path causes the standard Location header to be replaced with the internal x-nextjs-redirect header, which browsers do not follow; if a CDN caches the malformed response, all subsequent visitors to that path receive a broken redirect.

Next.js is vulnerable to Cross-Site Scripting when beforeInteractive scripts are used with untrusted content. Serialized script content was not HTML-escaped before embedding into the document, allowing attacker-controlled input to break out of the inline script context and execute arbitrary JavaScript in visitors' browsers.

Next.js App Router applications using CSP nonces are vulnerable to stored Cross-Site Scripting when deployed behind shared caches. Malformed nonce values derived from request headers can be reflected into rendered HTML unsafely, allowing cache poisoning that causes script execution for subsequent visitors.

Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname

Next.js: Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences

Next.js: Unbounded Server Action payload in Edge runtime

Next.js: Cache confusion of response bodies for requests with bodies

Next.js: Unauthenticated disclosure of internal Server Function endpoints

Next.js: Denial of Service in App Router using Server Actions

Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used

Next.js: Unauthenticated Remote Code Execution on windows-hosted servers

Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used

0225eb034d024a03bdc90ea6c79f56193662e7c3eee909696298820e517cbb83

4b6a96a3f3a61665bbae5edfb1cf5e2baf45ec05b487f6f0a63aeb92f34b5059

viewport

next-head-count

CSP header missing - vulnerable to XSS attacks

Prudence Malinki

MarkMonitor Inc.

web.app

Google Inc.

Google LLC

MEEBO

PasswordField

HTTP/3 is the third major version of the Hypertext Transfer Protocol used to exchange information on the World Wide Web.

HTTP/3

HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.

HSTS

Firebase is a Google-backed application development software that enables developers to develop iOS, Android and Web apps.

Requests	IP Address	Location	AS Autonomous System
31	199.36.158.100Fastly · CDN	United States	AS54113Fastly, Inc.
31	1	-	-

Security Scan Report: cabin-queue.web.app

Summary

AI Security Verdict

High Risk

Details

Screenshot

Page Load Overview

Language Analysis

Primary Language

Detection Details

All Detected Languages

Website Classification

Primary Category

All Detected Categories

Detected Features

Domain & IP Information

Detected Technologies4

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

ssdeep (Context Triggered Piecewise Hashing)

sdhash (Similarity Digest Hashing)

Image Hashes

Perceptual Hashes

Other Hashes

Scan History