Skip to main content
cve.nowby Sazabi
← npm
npmPackage

next

65 known vulnerabilities (2 critical, 20 high, 31 medium, 8 low), with the versions each affects and the releases that fix them.

Latest release
16.4.5 (Nov 3, 2026): no advisory affects it
Newest unaffected release
16.4.5 (Nov 3, 2026), the latest release
Advisories
65 · 2 critical, 20 high, 31 medium, 8 low
Weekly downloads
90.6M
Dependents
1,184
Releases
500+ since 15.0.8 (Jan 26, 2026)
Registry
npm
Releases read
Nov 8, 2026

Version timeline

  • CVE-2026-94482
    Affects 15.0.8 to 15.5.27 (15.5.28 is outside it); 16.0.11 to 16.4.0 (16.4.1 is outside it)
  • CVE-2026-94484
    Affects 15.0.8 to 15.5.26 (15.5.27 is outside it); 16.0.11 to 16.3.7 (16.3.8 is outside it)
  • CVE-2026-94485
    Affects 16.0.11 to 16.3.7 (16.3.8 is outside it)
  • CVE-2026-94483
    Affects 16.0.11 to 16.3.7 (16.3.8 is outside it)
  • CVE-2026-94543
    Affects 15.0.8 to 15.5.26 (15.5.27 is outside it); 16.0.11 to 16.3.7 (16.3.8 is outside it)
  • CVE-2026-94544
    Affects 16.3.0 to 16.3.7 (16.3.8 is outside it)
  • CVE-2026-94486
    Affects 16.0.11 to 16.3.7 (16.3.8 is outside it)
  • CVE-2026-103004
    Affects 16.3.0 to 16.3.7 (16.3.8 is outside it)
  • CVE-2026-75604
    Affects 15.0.8 to 15.5.23 (15.5.24 is outside it); 16.0.11 to 16.3.2 (16.3.3 is outside it)
  • CVE-2026-64649
    Affects 15.0.8 to 15.5.20 (15.5.21 is outside it); 16.0.11 to 16.2.10 (16.2.11 is outside it)
  • CVE-2026-64648
    Affects 15.0.8 to 15.5.20 (15.5.21 is outside it); 16.0.11 to 16.2.10 (16.2.11 is outside it)
  • CVE-2026-64647
    Affects 15.0.8 to 15.5.20 (15.5.21 is outside it); 16.0.11 to 16.2.10 (16.2.11 is outside it)
Show all 65 advisoriesShow fewer advisories
  • CVE-2026-64646
    Affects 15.0.8 to 15.5.20 (15.5.21 is outside it); 16.0.11 to 16.2.10 (16.2.11 is outside it)
  • CVE-2026-64644
    Affects 15.5.10 to 15.5.20 (15.5.21 is outside it); 16.0.11 to 16.2.10 (16.2.11 is outside it)
  • CVE-2026-64643
    Affects 15.0.8 to 15.5.20 (15.5.21 is outside it); 16.0.11 to 16.2.10 (16.2.11 is outside it)
  • CVE-2026-64642
    Affects 16.0.11 to 16.2.10 (16.2.11 is outside it)
  • CVE-2026-64641
    Affects 15.0.8 to 15.5.20 (15.5.21 is outside it); 16.0.11 to 16.2.10 (16.2.11 is outside it)
  • CVE-2026-64645
    Affects 15.0.8 to 15.5.20 (15.5.21 is outside it); 16.0.11 to 16.2.10 (16.2.11 is outside it)
  • CVE-2026-45109
    Affects 15.2.9 to 15.5.16 (15.5.18 is outside it); 16.0.11 to 16.2.5 (16.2.6 is outside it)
  • CVE-2026-44582
    Affects 15.0.8 to 15.5.15 (15.5.16 is outside it); 16.0.11 to 16.2.4 (16.2.5 is outside it)
  • CVE-2026-44581
    Affects 15.0.8 to 15.5.15 (15.5.16 is outside it); 16.0.11 to 16.2.4 (16.2.5 is outside it)
  • CVE-2026-44580
    Affects 15.0.8 to 15.5.15 (15.5.16 is outside it); 16.0.11 to 16.2.4 (16.2.5 is outside it)
  • CVE-2026-44579
    Affects 15.0.8 to 15.5.15 (15.5.16 is outside it); 16.0.11 to 16.2.4 (16.2.5 is outside it)
  • CVE-2026-44578
    Affects 15.0.8 to 15.5.15 (15.5.16 is outside it); 16.0.11 to 16.2.4 (16.2.5 is outside it)
  • CVE-2026-44577
    Affects 15.0.8 to 15.5.15 (15.5.16 is outside it); 16.0.11 to 16.2.4 (16.2.5 is outside it)
  • CVE-2026-44576
    Affects 15.0.8 to 15.5.15 (15.5.16 is outside it); 16.0.11 to 16.2.4 (16.2.5 is outside it)
  • CVE-2026-44574
    Affects 15.4.11 to 15.5.15 (15.5.16 is outside it); 16.0.11 to 16.2.4 (16.2.5 is outside it)
  • CVE-2026-44575
    Affects 15.2.9 to 15.5.15 (15.5.16 is outside it); 16.0.11 to 16.2.4 (16.2.5 is outside it)
  • CVE-2026-44573
    Affects 15.0.8 to 15.5.15 (15.5.16 is outside it); 16.0.11 to 16.2.4 (16.2.5 is outside it)
  • CVE-2026-44572
    Affects 15.0.8 to 15.5.15 (15.5.16 is outside it); 16.0.11 to 16.2.4 (16.2.5 is outside it)
  • CVE-2026-29057
    Affects 15.0.8 to 15.5.12 (15.5.13 is outside it); 16.0.11 to 16.1.6 (16.1.7 is outside it)
  • CVE-2026-27980
    Affects 15.0.8 to 15.5.13 (15.5.14 is outside it); 16.0.11 to 16.1.6 (16.1.7 is outside it)
  • CVE-2026-27979
    Affects 16.0.11 to 16.1.6 (16.1.7 is outside it)
  • CVE-2026-27978
    Affects 16.0.11 to 16.1.6 (16.1.7 is outside it)
  • CVE-2026-27977
    Affects 16.0.11 to 16.1.6 (16.1.7 is outside it)
  • CVE-2025-59472
    Affects 16.0.11 to 16.1.4 (16.1.5 is outside it)
  • CVE-2025-59471
    Affects 15.0.8 to 15.4.11 (15.5.10 is outside it); 15.6.0-canary.61 to 16.1.4 (16.1.5 is outside it)
  • CVE-2025-57752
    Affects 15.0.8 to 15.3.9 (15.4.11 is outside it)
  • CVE-2025-55173
    Affects 15.0.8 to 15.3.9 (15.4.11 is outside it)
  • CVE-2025-57822
    Affects 15.0.8 to 15.3.9 (15.4.11 is outside it)
  • CVE-2025-49826
    Affects 15.0.8 (15.1.12 is outside it)
  • CVE-2025-49005
    No published release is affected
    No published release is affected
  • CVE-2025-48068
    Affects 15.0.8 to 15.1.12 (15.2.9 is outside it)
  • CVE-2025-32421
    Affects 15.0.8 (15.1.12 is outside it)
  • CVE-2025-30218
    No published release is affected
    No published release is affected
  • CVE-2025-29927
    Affects 15.0.8 to 15.1.12 (15.2.9 is outside it)
  • CVE-2024-56332
    Affects 15.0.8 (15.1.12 is outside it)
  • CVE-2024-51479
    No published release is affected
    No published release is affected
  • CVE-2024-47831
    No published release is affected
    No published release is affected
  • CVE-2024-46982
    No published release is affected
    No published release is affected
  • CVE-2024-39693
    No published release is affected
    No published release is affected
  • CVE-2024-34351
    No published release is affected
    No published release is affected
  • CVE-2024-34350
    No published release is affected
    No published release is affected
  • CVE-2023-46298
    No published release is affected
    No published release is affected
  • CVE-2022-36046
    No published release is affected
    No published release is affected
  • CVE-2022-23646
    No published release is affected
    No published release is affected
  • CVE-2022-21721
    No published release is affected
    No published release is affected
  • CVE-2021-43803
    No published release is affected
    No published release is affected
  • CVE-2021-39178
    No published release is affected
    No published release is affected
  • CVE-2021-37699
    No published release is affected
    No published release is affected
  • CVE-2020-15242
    No published release is affected
    No published release is affected
  • CVE-2020-5284
    No published release is affected
    No published release is affected
  • CVE-2018-18282
    No published release is affected
    No published release is affected
  • CVE-2018-6184
    No published release is affected
    No published release is affected
  • CVE-2017-16877
    No published release is affected
    No published release is affected
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects. Older releases aren't stored, so the earliest spans may start sooner.

Advisories 65

  • Next.js: Denial of Service in App Router using Server Actions

    Affected: from 13.0.0, fixed in 15.5.28; from 16.0.0, fixed in 16.4.1.

    Fixed in 15.5.28 (released Oct 14, 2026, 8 days before disclosure) and 16.4.1 (released Oct 14, 2026, 8 days before disclosure).

    The latest release, 16.4.5, is not affected.

    49% of next downloads last week were affected versions (48.2M).

  • CVE-2026-94484Medium 6.3

    Next.js: Cache poisoning in Next.js SSG/ISR rendering leads to cross-user content substitution and persistent denial of service

    Affected: from 16.0.0, fixed in 16.3.8; from 15.0.0, fixed in 15.5.27.

    Fixed in 15.5.27 (released Sep 30, 2026, 2 days before disclosure) and 16.3.8 (released Sep 30, 2026, 2 days before disclosure).

    The latest release, 16.4.5, is not affected.

    36% of next downloads last week were affected versions (35M).

  • CVE-2026-94485Medium 6.3

    Next.js: Information disclosure in Next.js App Router metadata image routes via dynamicParams bypass

    Affected: from 16.0.0, fixed in 16.3.8.

    Fixed in 16.3.8 (released Sep 30, 2026, 2 days before disclosure).

    The latest release, 16.4.5, is not affected.

    25% of next downloads last week were affected versions (24.1M).

  • Next.js: Server-Side Request Forgery in Image Optimization

    Affected: from 16.0.0, fixed in 16.3.8.

    Fixed in 16.3.8 (released Sep 30, 2026, 2 days before disclosure).

    The latest release, 16.4.5, is not affected.

    25% of next downloads last week were affected versions (24.1M).

  • CVE-2026-94543Medium 6.3

    Next.js: Cache poisoning of SSG and ISR pages in self-hosted Next.js applications

    Affected: from 15.0.0, fixed in 15.5.27; from 16.0.0, fixed in 16.3.8.

    Fixed in 15.5.27 (released Sep 30, 2026, 2 days before disclosure) and 16.3.8 (released Sep 30, 2026, 2 days before disclosure).

    The latest release, 16.4.5, is not affected.

    36% of next downloads last week were affected versions (35M).

  • CVE-2026-94544Medium 6.3

    Next.js: Pending `use cache` fill can leak Draft Mode content into regular responses and persisted pages

    Affected: from 16.3.0, fixed in 16.3.8.

    Fixed in 16.3.8 (released Sep 30, 2026, 2 days before disclosure).

    The latest release, 16.4.5, is not affected.

    10% of next downloads last week were affected versions (9.9M).

  • Next.js: Information disclosure in the Next.js development server's Model Context Protocol endpoint

    Affected: from 16.0.0, fixed in 16.3.8.

    Fixed in 16.3.8 (released Sep 30, 2026, 2 days before disclosure).

    The latest release, 16.4.5, is not affected.

    25% of next downloads last week were affected versions (24.1M).

  • CVE-2026-103004Medium 6.3

    next.js cache leak on warm `use cache` handlers accessing root param

    Affected: from 16.3.0, fixed in 16.3.8.

    Fixed in 16.3.8 (released Sep 30, 2026, 1 day before disclosure).

    The latest release, 16.4.5, is not affected.

    10% of next downloads last week were affected versions (9.9M).

  • CVE-2026-75604Critical 9.0

    Next.js: Unauthenticated Remote Code Execution on windows-hosted servers

    Affected: from 13.4.0, fixed in 15.5.24; from 16.0.0, fixed in 16.3.3.

    Fixed in 15.5.24 (released Aug 25, 2026, 7 days before disclosure) and 16.3.3 (released Aug 25, 2026, 7 days before disclosure).

    The latest release, 16.4.5, is not affected.

    34% of next downloads last week were affected versions (33M).

  • Next.js: Server-Side Request Forgery in Server Actions on Custom Servers

    Affected: from 14.1.1, fixed in 15.5.21; from 16.0.0, fixed in 16.2.11.

    Fixed in 15.5.21 (released Jul 21, 2026, 6 days before disclosure) and 16.2.11 (released Jul 21, 2026, 6 days before disclosure).

    The latest release, 16.4.5, is not affected.

    28% of next downloads last week were affected versions (27.2M).

  • CVE-2026-64648Medium 6.0

    Next.js: Response Body Cache Confusion for Requests Containing Bodies

    Affected: from 13.0.0, fixed in 15.5.21; from 16.0.0, fixed in 16.2.11.

    Fixed in 15.5.21 (released Jul 21, 2026, 6 days before disclosure) and 16.2.11 (released Jul 21, 2026, 6 days before disclosure).

    The latest release, 16.4.5, is not affected.

    29% of next downloads last week were affected versions (28.4M).

  • CVE-2026-64647Medium 6.3

    Next.js: Response Body Cache Confusion with Invalid UTF-8 Request Bodies

    Affected: from 13.0.0, fixed in 15.5.21; from 16.0.0, fixed in 16.2.11.

    Fixed in 15.5.21 (released Jul 21, 2026, 6 days before disclosure) and 16.2.11 (released Jul 21, 2026, 6 days before disclosure).

    The latest release, 16.4.5, is not affected.

    29% of next downloads last week were affected versions (28.4M).

  • CVE-2026-64646Medium 6.3

    Next.js: Unbounded Server Action payload in Edge runtime

    Affected: from 13.0.0, fixed in 15.5.21; from 16.0.0, fixed in 16.2.11.

    Fixed in 15.5.21 (released Jul 21, 2026, 6 days before disclosure) and 16.2.11 (released Jul 21, 2026, 6 days before disclosure).

    The latest release, 16.4.5, is not affected.

    29% of next downloads last week were affected versions (28.4M).

  • CVE-2026-64644Medium 6.3

    Next.js: Denial of Service in the Image Optimization API using SVGs

    Affected: from 15.5.0, fixed in 15.5.21; from 16.0.0, fixed in 16.2.11.

    Fixed in 15.5.21 (released Jul 21, 2026, 6 days before disclosure) and 16.2.11 (released Jul 21, 2026, 6 days before disclosure).

    The latest release, 16.4.5, is not affected.

    18% of next downloads last week were affected versions (17.5M).

  • CVE-2026-64643Medium 6.3

    Next.js: Unauthenticated Disclosure of Internal Server Function endpoints

    Affected: from 13.0.0, fixed in 15.5.21; from 16.0.0, fixed in 16.2.11.

    Fixed in 15.5.21 (released Jul 21, 2026, 6 days before disclosure) and 16.2.11 (released Jul 21, 2026, 6 days before disclosure).

    The latest release, 16.4.5, is not affected.

    29% of next downloads last week were affected versions (28.4M).

Show all 65 advisoriesShow fewer advisories

  • Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale

    Affected: from 16.0.0, fixed in 16.2.11.

    Fixed in 16.2.11 (released Jul 21, 2026, 6 days before disclosure).

    The latest release, 16.4.5, is not affected.

    13% of next downloads last week were affected versions (12.6M).

  • Next.js: Denial of Service in App Router using Server Actions

    Affected: from 13.0.0, fixed in 15.5.21; from 16.0.0, fixed in 16.2.11.

    Fixed in 15.5.21 (released Jul 21, 2026, 6 days before disclosure) and 16.2.11 (released Jul 21, 2026, 6 days before disclosure).

    The latest release, 16.4.5, is not affected.

    29% of next downloads last week were affected versions (28.4M).

  • Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname

    Affected: from 12.0.0, fixed in 15.5.21; from 16.0.0, fixed in 16.2.11.

    Fixed in 15.5.21 (released Jul 21, 2026, 6 days before disclosure) and 16.2.11 (released Jul 21, 2026, 6 days before disclosure).

    The latest release, 16.4.5, is not affected.

    29% of next downloads last week were affected versions (28.9M).

  • Next.js: Middleware / Proxy bypass in App Router applications via segment-prefetch routes

    Affected: from 15.2.0, fixed in 15.5.18; from 16.0.0, fixed in 16.2.6.

    Fixed in 15.5.18 (released May 7, 2026, 6 days before disclosure) and 16.2.6 (released May 7, 2026, 6 days before disclosure).

    The latest release, 16.4.5, is not affected.

    13% of next downloads last week were affected versions (12.6M).

  • Next.js: Cache poisoning via collisions in React Server Component cache-busting

    Affected: from 13.4.6, fixed in 15.5.16; from 16.0.0, fixed in 16.2.5.

    Fixed in 15.5.16 (released May 6, 2026, 7 days before disclosure) and 16.2.5 (released May 6, 2026, 7 days before disclosure).

    The latest release, 16.4.5, is not affected.

    22% of next downloads last week were affected versions (21.2M).

  • CVE-2026-44581Medium 4.7

    Next.js: Cross-site scripting in App Router applications using CSP nonces

    Affected: from 13.4.0, fixed in 15.5.16; from 16.0.0, fixed in 16.2.5.

    Fixed in 15.5.16 (released May 6, 2026, 7 days before disclosure) and 16.2.5 (released May 6, 2026, 7 days before disclosure).

    The latest release, 16.4.5, is not affected.

    22% of next downloads last week were affected versions (21.2M).

  • CVE-2026-44580Medium 6.1

    Next.js: Cross-site scripting in beforeInteractive scripts with untrusted input

    Affected: from 13.0.0, fixed in 15.5.16; from 16.0.0, fixed in 16.2.5.

    Fixed in 15.5.16 (released May 6, 2026, 7 days before disclosure) and 16.2.5 (released May 6, 2026, 7 days before disclosure).

    The latest release, 16.4.5, is not affected.

    22% of next downloads last week were affected versions (21.4M).

  • Next.js: Denial of Service via connection exhaustion in applications using Cache Components

    Affected: from 15.0.0, fixed in 15.5.16; from 16.0.0, fixed in 16.2.5.

    Fixed in 15.5.16 (released May 6, 2026, 7 days before disclosure) and 16.2.5 (released May 6, 2026, 7 days before disclosure).

    The latest release, 16.4.5, is not affected.

    14% of next downloads last week were affected versions (14M).

  • Next.js: Server-side request forgery in applications using WebSocket upgrades

    Affected: from 13.4.13, fixed in 15.5.16; from 16.0.0, fixed in 16.2.5.

    Fixed in 15.5.16 (released May 6, 2026, 7 days before disclosure) and 16.2.5 (released May 6, 2026, 7 days before disclosure).

    The latest release, 16.4.5, is not affected.

    21% of next downloads last week were affected versions (21.1M).

  • CVE-2026-44577Medium 5.9

    Next.js: Denial of Service in the Image Optimization API

    Affected: from 10.0.0, fixed in 15.5.16; from 16.0.0, fixed in 16.2.5.

    Fixed in 15.5.16 (released May 6, 2026, 7 days before disclosure) and 16.2.5 (released May 6, 2026, 7 days before disclosure).

    The latest release, 16.4.5, is not affected.

    22% of next downloads last week were affected versions (22.1M).

  • CVE-2026-44576Medium 5.4

    Next.js: Cache poisoning in React Server Component responses

    Affected: from 14.2.0, fixed in 15.5.16; from 16.0.0, fixed in 16.2.5.

    Fixed in 15.5.16 (released May 6, 2026, 7 days before disclosure) and 16.2.5 (released May 6, 2026, 7 days before disclosure).

    The latest release, 16.4.5, is not affected.

    20% of next downloads last week were affected versions (20M).

  • Next.js: Middleware / Proxy bypass through dynamic route parameter injection

    Affected: from 15.4.0, fixed in 15.5.16; from 16.0.0, fixed in 16.2.5.

    Fixed in 15.5.16 (released May 6, 2026, 7 days before disclosure) and 16.2.5 (released May 6, 2026, 7 days before disclosure).

    The latest release, 16.4.5, is not affected.

    11% of next downloads last week were affected versions (11.1M).

  • Next.js: Middleware / Proxy bypass in App Router applications via segment-prefetch routes

    Affected: from 15.2.0, fixed in 15.5.16; from 16.0.0, fixed in 16.2.5.

    Fixed in 15.5.16 (released May 6, 2026, 7 days before disclosure) and 16.2.5 (released May 6, 2026, 7 days before disclosure).

    The latest release, 16.4.5, is not affected.

    13% of next downloads last week were affected versions (12.4M).

  • Next.js: Middleware / Proxy bypass in Pages Router applications using i18n

    Affected: from 12.2.0, fixed in 15.5.16; from 16.0.0, fixed in 16.2.5.

    Fixed in 15.5.16 (released May 6, 2026, 7 days before disclosure) and 16.2.5 (released May 6, 2026, 7 days before disclosure).

    The latest release, 16.4.5, is not affected.

    22% of next downloads last week were affected versions (21.8M).

  • Next.js: Middleware / Proxy redirects can be cache-poisoned

    Affected: from 12.2.0, fixed in 15.5.16; from 16.0.0, fixed in 16.2.5.

    Fixed in 15.5.16 (released May 6, 2026, 7 days before disclosure) and 16.2.5 (released May 6, 2026, 7 days before disclosure).

    The latest release, 16.4.5, is not affected.

    22% of next downloads last week were affected versions (21.8M).

  • CVE-2026-29057Medium 6.3

    Next.js: HTTP request smuggling in rewrites

    Affected: from 16.0.0-beta.0, fixed in 16.1.7; from 9.5.0, fixed in 15.5.13.

    Fixed in 15.5.13 (released Mar 16, 2026, 2 days before disclosure) and 16.1.7 (released Mar 16, 2026, 2 days before disclosure).

    The latest release, 16.4.5, is not affected.

    19% of next downloads last week were affected versions (19.1M).

  • CVE-2026-27980Medium 6.9

    Next.js: Unbounded next/image disk cache growth can exhaust storage

    Affected: from 16.0.0-beta.0, fixed in 16.1.7; from 10.0.0, fixed in 15.5.14.

    Fixed in 15.5.14 (released Mar 19, 2026, 1 day after disclosure) and 16.1.7 (released Mar 16, 2026, 2 days before disclosure).

    The latest release, 16.4.5, is not affected.

    19% of next downloads last week were affected versions (19.2M).

  • CVE-2026-27979Medium 6.9

    Next.js: Unbounded postponed resume buffering can lead to DoS

    Affected: from 16.0.1, fixed in 16.1.7.

    Fixed in 16.1.7 (released Mar 16, 2026, 2 days before disclosure).

    The latest release, 16.4.5, is not affected.

    4.7% of next downloads last week were affected versions (4.6M).

  • CVE-2026-27978Medium 5.3

    Next.js: null origin can bypass Server Actions CSRF checks

    Affected: from 16.0.1, fixed in 16.1.7.

    Fixed in 16.1.7 (released Mar 16, 2026, 1 day before disclosure).

    The latest release, 16.4.5, is not affected.

    4.7% of next downloads last week were affected versions (4.6M).

  • Next.js: null origin can bypass dev HMR websocket CSRF checks

    Affected: from 16.0.1, fixed in 16.1.7.

    Fixed in 16.1.7 (released Mar 16, 2026, 1 day before disclosure).

    The latest release, 16.4.5, is not affected.

    4.7% of next downloads last week were affected versions (4.6M).

  • CVE-2025-59472Medium 5.9

    A denial of service vulnerability exists in Next.js versions with Partial Prerendering (PPR) enabled when running in minimal mode.

    Affected: from 16.0.0-beta.0, fixed in 16.1.5; from 15.0.0-canary.0, through 15.0.0-canary.205; from 15.0.1-canary.0, through 15.0.1-canary.3; from 15.0.2-canary.0, through 15.0.2-canary.11; from 15.0.3-canary.0, through 15.0.3-canary.9; from 15.0.4-canary.0, through 15.0.4-canary.52; from 15.1.1-canary.0, through 15.1.1-canary.27; from 15.2.0-canary.0, through 15.2.0-canary.77; from 15.2.1-canary.0, through 15.2.1-canary.6; from 15.2.2-canary.0, through 15.2.2-canary.7; from 15.3.0-canary.0, through 15.3.0-canary.46; from 15.3.1-canary.0, through 15.3.1-canary.15; from 15.4.0-canary.0, through 15.4.0-canary.130; from 15.4.2-canary.0, through 15.4.2-canary.56; from 15.5.1-canary.0, through 15.5.1-canary.39; from 15.6.0-canary.0, fixed in 15.6.0-canary.61.

    Fixed in 15.6.0-canary.61 (released Jan 26, 2026, the day of disclosure) and 16.1.5 (released Jan 26, 2026, the day of disclosure).

    The latest release, 16.4.5, is not affected.

    3.3% of next downloads last week were affected versions (3.2M).

  • CVE-2025-59471Medium 5.9

    A denial of service vulnerability exists in self-hosted Next.js applications that have `remotePatterns` configured for the Image Optimizer.

    Affected: from 10.0.0, fixed in 15.5.10; from 15.6.0-canary.0, fixed in 16.1.5.

    Fixed in 15.5.10 (released Jan 26, 2026, the day of disclosure) and 16.1.5 (released Jan 26, 2026, the day of disclosure).

    The latest release, 16.4.5, is not affected.

    17% of next downloads last week were affected versions (17M).

  • CVE-2025-57752Medium 6.2

    Next.js Affected by Cache Key Confusion for Image Optimization API Routes

    Affected: from 0.9.9, fixed in 14.2.31; from 15.0.0, fixed in 15.4.5.

    Fixed in 14.2.31 and 15.4.11 (released Jan 26, 2026, 150 days after disclosure, the advisory names 15.4.5, which was never published).

    The latest release, 16.4.5, is not affected.

    7.8% of next downloads last week were affected versions (7.7M).

  • CVE-2025-55173Medium 4.3

    Next.js Content Injection Vulnerability for Image Optimization

    Affected: from 0.9.9, fixed in 14.2.31; from 15.0.0, fixed in 15.4.5.

    Fixed in 14.2.31 and 15.4.11 (released Jan 26, 2026, 150 days after disclosure, the advisory names 15.4.5, which was never published).

    The latest release, 16.4.5, is not affected.

    7.8% of next downloads last week were affected versions (7.7M).

  • CVE-2025-57822Medium 6.5

    Next.js Improper Middleware Redirect Handling Leads to SSRF

    Affected: from 0.9.9, fixed in 14.2.32; from 15.0.0-canary.0, fixed in 15.4.7.

    Fixed in 14.2.32 and 15.4.11 (released Jan 26, 2026, 150 days after disclosure, the advisory names 15.4.7, which was never published).

    The latest release, 16.4.5, is not affected.

    8% of next downloads last week were affected versions (7.9M).

  • Next.js DoS vulnerability via cache poisoning

    Affected: from 15.0.4-canary.51, fixed in 15.1.8.

    Fixed in 15.1.12 (released Jan 26, 2026, 207 days after disclosure, the advisory names 15.1.8, which was never published).

    The latest release, 16.4.5, is not affected.

    1.3% of next downloads last week were affected versions (1.3M).

  • Next.js cache poisoning due to omission of Vary header

    Affected: from 15.3.0, fixed in 15.3.3.

    Fixed in 15.3.9 (released Jan 26, 2026, 207 days after disclosure, the advisory names 15.3.3, which was never published).

    The latest release, 16.4.5, is not affected.

    0.3% of next downloads last week were affected versions (260.2K).

  • Information exposure in Next.js dev server due to lack of origin verification

    Affected: from 15.0.0, fixed in 15.2.2; from 13.0, fixed in 14.2.30.

    Fixed in 14.2.30 and 15.2.9 (released Jan 26, 2026, 241 days after disclosure, the advisory names 15.2.2, which was never published).

    The latest release, 16.4.5, is not affected.

    5.4% of next downloads last week were affected versions (5.3M).

  • Next.js Race Condition to Cache Poisoning

    Affected: from 0.9.9, fixed in 14.2.24; from 15.0.0, fixed in 15.1.6.

    Fixed in 14.2.24 and 15.1.12 (released Jan 26, 2026, 257 days after disclosure, the advisory names 15.1.6, which was never published).

    The latest release, 16.4.5, is not affected.

    5.2% of next downloads last week were affected versions (5.1M).

  • Next.js may leak x-middleware-subrequest-id to external hosts

    Affected: from 12.3.5, fixed in 12.3.6; from 13.5.9, fixed in 13.5.10; from 14.2.25, fixed in 14.2.26; from 15.2.3, fixed in 15.2.4.

    Fixed in 12.3.6, 13.5.10, 14.2.26 and 1 other version.

    The latest release, 16.4.5, is not affected.

    0.3% of next downloads last week were affected versions (247.7K).

  • CVE-2025-29927Critical 9.1

    Authorization Bypass in Next.js Middleware

    Affected: from 13.0.0, fixed in 13.5.9; from 14.0.0, fixed in 14.2.25; from 15.0.0, fixed in 15.2.3; from 12.0.0, fixed in 12.3.5.

    Fixed in 12.3.5, 13.5.9, 14.2.25 and 1 other version.

    The latest release, 16.4.5, is not affected.

    4.9% of next downloads last week were affected versions (4.8M).

  • CVE-2024-56332Medium 5.3

    Next.js Vulnerable to Denial of Service (DoS) with Server Actions

    Affected: from 13.0.0, fixed in 13.5.8; from 14.0.0, fixed in 14.2.21; from 15.0.0, fixed in 15.1.2.

    Fixed in 13.5.8, 14.2.21 and 15.1.12 (released Jan 26, 2026, 388 days after disclosure, the advisory names 15.1.2, which was never published).

    The latest release, 16.4.5, is not affected.

    3.1% of next downloads last week were affected versions (3M).

  • Authorization bypass in Next.js

    Affected: from 9.5.5, fixed in 14.2.15.

    Fixed in 14.2.15.

    The latest release, 16.4.5, is not affected.

    3.4% of next downloads last week were affected versions (3.3M).

  • CVE-2024-47831Medium 5.9

    Next.js image optimization has Denial of Service condition

    Affected: from 10.0.0, fixed in 14.2.7.

    Fixed in 14.2.7.

    The latest release, 16.4.5, is not affected.

    3.2% of next downloads last week were affected versions (3.1M).

  • Cache Poisoning in next.js

    Affected: from 13.5.1, fixed in 13.5.7; from 14.0.0, fixed in 14.2.10.

    Fixed in 13.5.7 and 14.2.10.

    The latest release, 16.4.5, is not affected.

    1.9% of next downloads last week were affected versions (1.8M).

  • Next.js Denial of Service (DoS) condition

    Affected: from 13.3.1, fixed in 13.5.0.

    Fixed in 13.5.0.

    The latest release, 16.4.5, is not affected.

    0.2% of next downloads last week were affected versions (205.2K).

  • Next.js Server-Side Request Forgery in Server Actions

    Affected: from 13.4.0, fixed in 14.1.1.

    Fixed in 14.1.1.

    The latest release, 16.4.5, is not affected.

    1% of next downloads last week were affected versions (1M).

  • Next.js Vulnerable to HTTP Request Smuggling

    Affected: from 13.4.0, fixed in 13.5.1.

    Fixed in 13.5.1.

    The latest release, 16.4.5, is not affected.

    0.2% of next downloads last week were affected versions (183.2K).

  • Next.js before 13.4.20-canary.13 lacks a cache-control header and thus empty prefetch responses may sometimes be cached by a CDN, causing…

    Affected: from 0.9.9, fixed in 13.4.20-canary.13.

    Fixed in 13.4.20-canary.13.

    The latest release, 16.4.5, is not affected.

    1.1% of next downloads last week were affected versions (1.1M).

  • CVE-2022-36046Medium 5.3

    Unexpected server crash in Next.js version 12.2.3

    Affected: from 12.2.3, fixed in 12.2.4.

    Fixed in 12.2.4.

    The latest release, 16.4.5, is not affected.

    <0.1% of next downloads last week were affected versions (7.3K).

  • CVE-2022-23646Medium 5.9

    Improper CSP in Image Optimization API for Next.js

    Affected: from 10.0.0, fixed in 12.1.0.

    Fixed in 12.1.0.

    The latest release, 16.4.5, is not affected.

    0.2% of next downloads last week were affected versions (196.8K).

  • CVE-2022-21721Medium 5.9

    DOS Vulnerability in next.js

    Affected: from 12.0.0, fixed in 12.0.9.

    Fixed in 12.0.9.

    The latest release, 16.4.5, is not affected.

    <0.1% of next downloads last week were affected versions (81.5K).

  • Unexpected server crash in Next.js

    Affected: from 12.0.0, fixed in 12.0.5; from 0.9.9, fixed in 11.1.3.

    Fixed in 11.1.3 and 12.0.5.

    The latest release, 16.4.5, is not affected.

    0.2% of next downloads last week were affected versions (174.5K).

  • XSS in Image Optimization API for Next.js versions between 10.0.0 and 11.1.0

    Affected: from 10.0.0, fixed in 11.1.1.

    Fixed in 11.1.1.

    The latest release, 16.4.5, is not affected.

    <0.1% of next downloads last week were affected versions (68.7K).

  • CVE-2021-37699Medium 6.9

    Open Redirect in Next.js versions below 11.1.0

    Affected: from 0.9.9, fixed in 11.1.0.

    Fixed in 11.1.0.

    The latest release, 16.4.5, is not affected.

    0.1% of next downloads last week were affected versions (145.4K).

  • CVE-2020-15242Medium 4.7

    Open Redirect in Next.js

    Affected: from 9.5.0, fixed in 9.5.4.

    Fixed in 9.5.4.

    The latest release, 16.4.5, is not affected.

    <0.1% of next downloads last week were affected versions (5.4K).

  • CVE-2020-5284Medium 4.4

    Directory Traversal in Next.js versions below 9.3.2

    Affected: from 0.9.9, fixed in 9.3.2.

    Fixed in 9.3.2.

    The latest release, 16.4.5, is not affected.

    <0.1% of next downloads last week were affected versions (53.8K).

  • Next.js 7.0.0 and 7.0.1 has XSS via the 404 or 500 /_error page.

    Affected: from 7.0.0, fixed in 7.0.2.

    Fixed in 7.0.2.

    The latest release, 16.4.5, is not affected.

    <0.1% of next downloads last week were affected versions (1.3K).

  • ZEIT Next.js 4 before 4.2.3 has Directory Traversal under the /_next request namespace.

    Affected: from 1.0.0, fixed in 4.2.3.

    Fixed in 4.2.3.

    The latest release, 16.4.5, is not affected.

    <0.1% of next downloads last week were affected versions (7.4K).

  • ZEIT Next.js before 2.4.1 has directory traversal under the /_next and /static request namespace, allowing attackers to obtain sensitive…

    Affected: from 1.0.0, fixed in 2.4.1.

    Fixed in 2.4.1.

    The latest release, 16.4.5, is not affected.

    <0.1% of next downloads last week were affected versions (1.9K).