Proof
Fixture results
Expected verdicts for all 16 advisory and demo app combinations.
Expected verdicts, checked by npm test with fixed checklists and by npm run test:serv with live SERV compiles.
| Demo app | next | Hosting | Setup | CVE-2025-29927 | CVE-2026-64642 |
|---|---|---|---|---|---|
| Acme Dental | 14.2.24 | self-hosted | middleware with session check | Confirmed | Absent |
| Brightline Legal | 14.2.25 | self-hosted | middleware with session check | Absent | Absent |
| Cobalt Coffee | 14.2.24 | vercel | middleware | Absent | Absent |
| Dune Outfitters | 15.1.0 | self-hosted | middleware without an auth check | Absent | Absent |
| Evergreen Clinic | 15.2.0 | not declared | middleware | Needs manual review | Absent |
| Fjord Studio | 16.1.0 | self-hosted | proxy, Turbopack build, 1 locale | Absent | Confirmed |
| Granite Realty | 16.1.0 | self-hosted | proxy, custom build script, 1 locale | Absent | Needs manual review |
| Harbor Bikes | 16.1.0 | self-hosted | proxy, Turbopack build, 3 locales | Absent | Absent |
“Absent” is short for Absent within inspected scope.
Fixture sources: fixtures/.