# next (npm) vulnerabilities

65 known vulnerabilities (2 critical, 20 high, 31 medium, 8 low), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: 16.4.5 (Nov 3, 2026): no advisory affects it
- Newest unaffected release: 16.4.5 (Nov 3, 2026), the latest release
- Weekly downloads: 90.6M
- Dependents: 1,184
- Releases: 500+ since 15.0.8 (Jan 26, 2026)
- Registry: https://www.npmjs.com/package/next
- Releases read: Nov 8, 2026

## Version timeline

Affected versions per advisory, in version order:

- CVE-2026-94482: 15.0.8 to 15.5.27 (15.5.28 is outside it); 16.0.11 to 16.4.0 (16.4.1 is outside it)
- CVE-2026-94484: 15.0.8 to 15.5.26 (15.5.27 is outside it); 16.0.11 to 16.3.7 (16.3.8 is outside it)
- CVE-2026-94485: 16.0.11 to 16.3.7 (16.3.8 is outside it)
- CVE-2026-94483: 16.0.11 to 16.3.7 (16.3.8 is outside it)
- CVE-2026-94543: 15.0.8 to 15.5.26 (15.5.27 is outside it); 16.0.11 to 16.3.7 (16.3.8 is outside it)
- CVE-2026-94544: 16.3.0 to 16.3.7 (16.3.8 is outside it)
- CVE-2026-94486: 16.0.11 to 16.3.7 (16.3.8 is outside it)
- CVE-2026-103004: 16.3.0 to 16.3.7 (16.3.8 is outside it)
- CVE-2026-75604: 15.0.8 to 15.5.23 (15.5.24 is outside it); 16.0.11 to 16.3.2 (16.3.3 is outside it)
- CVE-2026-64649: 15.0.8 to 15.5.20 (15.5.21 is outside it); 16.0.11 to 16.2.10 (16.2.11 is outside it)
- CVE-2026-64648: 15.0.8 to 15.5.20 (15.5.21 is outside it); 16.0.11 to 16.2.10 (16.2.11 is outside it)
- CVE-2026-64647: 15.0.8 to 15.5.20 (15.5.21 is outside it); 16.0.11 to 16.2.10 (16.2.11 is outside it)
- CVE-2026-64646: 15.0.8 to 15.5.20 (15.5.21 is outside it); 16.0.11 to 16.2.10 (16.2.11 is outside it)
- CVE-2026-64644: 15.5.10 to 15.5.20 (15.5.21 is outside it); 16.0.11 to 16.2.10 (16.2.11 is outside it)
- CVE-2026-64643: 15.0.8 to 15.5.20 (15.5.21 is outside it); 16.0.11 to 16.2.10 (16.2.11 is outside it)
- CVE-2026-64642: 16.0.11 to 16.2.10 (16.2.11 is outside it)
- CVE-2026-64641: 15.0.8 to 15.5.20 (15.5.21 is outside it); 16.0.11 to 16.2.10 (16.2.11 is outside it)
- CVE-2026-64645: 15.0.8 to 15.5.20 (15.5.21 is outside it); 16.0.11 to 16.2.10 (16.2.11 is outside it)
- CVE-2026-45109: 15.2.9 to 15.5.16 (15.5.18 is outside it); 16.0.11 to 16.2.5 (16.2.6 is outside it)
- CVE-2026-44582: 15.0.8 to 15.5.15 (15.5.16 is outside it); 16.0.11 to 16.2.4 (16.2.5 is outside it)
- CVE-2026-44581: 15.0.8 to 15.5.15 (15.5.16 is outside it); 16.0.11 to 16.2.4 (16.2.5 is outside it)
- CVE-2026-44580: 15.0.8 to 15.5.15 (15.5.16 is outside it); 16.0.11 to 16.2.4 (16.2.5 is outside it)
- CVE-2026-44579: 15.0.8 to 15.5.15 (15.5.16 is outside it); 16.0.11 to 16.2.4 (16.2.5 is outside it)
- CVE-2026-44578: 15.0.8 to 15.5.15 (15.5.16 is outside it); 16.0.11 to 16.2.4 (16.2.5 is outside it)
- CVE-2026-44577: 15.0.8 to 15.5.15 (15.5.16 is outside it); 16.0.11 to 16.2.4 (16.2.5 is outside it)
- CVE-2026-44576: 15.0.8 to 15.5.15 (15.5.16 is outside it); 16.0.11 to 16.2.4 (16.2.5 is outside it)
- CVE-2026-44574: 15.4.11 to 15.5.15 (15.5.16 is outside it); 16.0.11 to 16.2.4 (16.2.5 is outside it)
- CVE-2026-44575: 15.2.9 to 15.5.15 (15.5.16 is outside it); 16.0.11 to 16.2.4 (16.2.5 is outside it)
- CVE-2026-44573: 15.0.8 to 15.5.15 (15.5.16 is outside it); 16.0.11 to 16.2.4 (16.2.5 is outside it)
- CVE-2026-44572: 15.0.8 to 15.5.15 (15.5.16 is outside it); 16.0.11 to 16.2.4 (16.2.5 is outside it)
- CVE-2026-29057: 15.0.8 to 15.5.12 (15.5.13 is outside it); 16.0.11 to 16.1.6 (16.1.7 is outside it)
- CVE-2026-27980: 15.0.8 to 15.5.13 (15.5.14 is outside it); 16.0.11 to 16.1.6 (16.1.7 is outside it)
- CVE-2026-27979: 16.0.11 to 16.1.6 (16.1.7 is outside it)
- CVE-2026-27978: 16.0.11 to 16.1.6 (16.1.7 is outside it)
- CVE-2026-27977: 16.0.11 to 16.1.6 (16.1.7 is outside it)
- CVE-2025-59472: 16.0.11 to 16.1.4 (16.1.5 is outside it)
- CVE-2025-59471: 15.0.8 to 15.4.11 (15.5.10 is outside it); 15.6.0-canary.61 to 16.1.4 (16.1.5 is outside it)
- CVE-2025-57752: 15.0.8 to 15.3.9 (15.4.11 is outside it)
- CVE-2025-55173: 15.0.8 to 15.3.9 (15.4.11 is outside it)
- CVE-2025-57822: 15.0.8 to 15.3.9 (15.4.11 is outside it)
- CVE-2025-49826: 15.0.8 (15.1.12 is outside it)
- CVE-2025-49005: no published release is affected
- CVE-2025-48068: 15.0.8 to 15.1.12 (15.2.9 is outside it)
- CVE-2025-32421: 15.0.8 (15.1.12 is outside it)
- CVE-2025-30218: no published release is affected
- CVE-2025-29927: 15.0.8 to 15.1.12 (15.2.9 is outside it)
- CVE-2024-56332: 15.0.8 (15.1.12 is outside it)
- CVE-2024-51479: no published release is affected
- CVE-2024-47831: no published release is affected
- CVE-2024-46982: no published release is affected
- CVE-2024-39693: no published release is affected
- CVE-2024-34351: no published release is affected
- CVE-2024-34350: no published release is affected
- CVE-2023-46298: no published release is affected
- CVE-2022-36046: no published release is affected
- CVE-2022-23646: no published release is affected
- CVE-2022-21721: no published release is affected
- CVE-2021-43803: no published release is affected
- CVE-2021-39178: no published release is affected
- CVE-2021-37699: no published release is affected
- CVE-2020-15242: no published release is affected
- CVE-2020-5284: no published release is affected
- CVE-2018-18282: no published release is affected
- CVE-2018-6184: no published release is affected
- CVE-2017-16877: no published release is affected

Older releases aren't stored, so the earliest spans may start sooner.

## Advisories (65)

### [CVE-2026-94482](https://cve.now/CVE-2026-94482): Next.js: Denial of Service in App Router using Server Actions

- Severity: High 8.2
- Published: Oct 22, 2026
- Affected: from 13.0.0, fixed in 15.5.28; from 16.0.0, fixed in 16.4.1.
- Fixed in 15.5.28 (released Oct 14, 2026, 8 days before disclosure) and 16.4.1 (released Oct 14, 2026, 8 days before disclosure).
- The latest release, 16.4.5, is not affected.
- 49% of next downloads last week were affected versions (48.2M).

### [CVE-2026-94484](https://cve.now/CVE-2026-94484): Next.js: Cache poisoning in Next.js SSG/ISR rendering leads to cross-user content substitution and persistent denial of service

- Severity: Medium 6.3
- Published: Oct 2, 2026
- Affected: from 16.0.0, fixed in 16.3.8; from 15.0.0, fixed in 15.5.27.
- Fixed in 15.5.27 (released Sep 30, 2026, 2 days before disclosure) and 16.3.8 (released Sep 30, 2026, 2 days before disclosure).
- The latest release, 16.4.5, is not affected.
- 36% of next downloads last week were affected versions (35M).

### [CVE-2026-94485](https://cve.now/CVE-2026-94485): Next.js: Information disclosure in Next.js App Router metadata image routes via dynamicParams bypass

- Severity: Medium 6.3
- Published: Oct 2, 2026
- Affected: from 16.0.0, fixed in 16.3.8.
- Fixed in 16.3.8 (released Sep 30, 2026, 2 days before disclosure).
- The latest release, 16.4.5, is not affected.
- 25% of next downloads last week were affected versions (24.1M).

### [CVE-2026-94483](https://cve.now/CVE-2026-94483): Next.js: Server-Side Request Forgery in Image Optimization

- Severity: High 8.3
- Published: Oct 2, 2026
- Affected: from 16.0.0, fixed in 16.3.8.
- Fixed in 16.3.8 (released Sep 30, 2026, 2 days before disclosure).
- The latest release, 16.4.5, is not affected.
- 25% of next downloads last week were affected versions (24.1M).

### [CVE-2026-94543](https://cve.now/CVE-2026-94543): Next.js: Cache poisoning of SSG and ISR pages in self-hosted Next.js applications

- Severity: Medium 6.3
- Published: Oct 2, 2026
- Affected: from 15.0.0, fixed in 15.5.27; from 16.0.0, fixed in 16.3.8.
- Fixed in 15.5.27 (released Sep 30, 2026, 2 days before disclosure) and 16.3.8 (released Sep 30, 2026, 2 days before disclosure).
- The latest release, 16.4.5, is not affected.
- 36% of next downloads last week were affected versions (35M).

### [CVE-2026-94544](https://cve.now/CVE-2026-94544): Next.js: Pending \`use cache\` fill can leak Draft Mode content into regular responses and persisted pages

- Severity: Medium 6.3
- Published: Oct 2, 2026
- Affected: from 16.3.0, fixed in 16.3.8.
- Fixed in 16.3.8 (released Sep 30, 2026, 2 days before disclosure).
- The latest release, 16.4.5, is not affected.
- 10% of next downloads last week were affected versions (9.9M).

### [CVE-2026-94486](https://cve.now/CVE-2026-94486): Next.js: Information disclosure in the Next.js development server's Model Context Protocol endpoint

- Severity: Low 2.3
- Published: Oct 2, 2026
- Affected: from 16.0.0, fixed in 16.3.8.
- Fixed in 16.3.8 (released Sep 30, 2026, 2 days before disclosure).
- The latest release, 16.4.5, is not affected.
- 25% of next downloads last week were affected versions (24.1M).

### [CVE-2026-103004](https://cve.now/CVE-2026-103004): next.js cache leak on warm \`use cache\` handlers accessing root param

- Severity: Medium 6.3
- Published: Oct 1, 2026
- Affected: from 16.3.0, fixed in 16.3.8.
- Fixed in 16.3.8 (released Sep 30, 2026, 1 day before disclosure).
- The latest release, 16.4.5, is not affected.
- 10% of next downloads last week were affected versions (9.9M).

### [CVE-2026-75604](https://cve.now/CVE-2026-75604): Next.js: Unauthenticated Remote Code Execution on windows-hosted servers

- Severity: Critical 9.0
- Published: Sep 1, 2026
- Affected: from 13.4.0, fixed in 15.5.24; from 16.0.0, fixed in 16.3.3.
- Fixed in 15.5.24 (released Aug 25, 2026, 7 days before disclosure) and 16.3.3 (released Aug 25, 2026, 7 days before disclosure).
- The latest release, 16.4.5, is not affected.
- 34% of next downloads last week were affected versions (33M).

### [CVE-2026-64649](https://cve.now/CVE-2026-64649): Next.js: Server-Side Request Forgery in Server Actions on Custom Servers

- Severity: High 8.3
- Published: Jul 27, 2026
- Affected: from 14.1.1, fixed in 15.5.21; from 16.0.0, fixed in 16.2.11.
- Fixed in 15.5.21 (released Jul 21, 2026, 6 days before disclosure) and 16.2.11 (released Jul 21, 2026, 6 days before disclosure).
- The latest release, 16.4.5, is not affected.
- 28% of next downloads last week were affected versions (27.2M).

### [CVE-2026-64648](https://cve.now/CVE-2026-64648): Next.js: Response Body Cache Confusion for Requests Containing Bodies

- Severity: Medium 6.0
- Published: Jul 27, 2026
- Affected: from 13.0.0, fixed in 15.5.21; from 16.0.0, fixed in 16.2.11.
- Fixed in 15.5.21 (released Jul 21, 2026, 6 days before disclosure) and 16.2.11 (released Jul 21, 2026, 6 days before disclosure).
- The latest release, 16.4.5, is not affected.
- 29% of next downloads last week were affected versions (28.4M).

### [CVE-2026-64647](https://cve.now/CVE-2026-64647): Next.js: Response Body Cache Confusion with Invalid UTF-8 Request Bodies

- Severity: Medium 6.3
- Published: Jul 27, 2026
- Affected: from 13.0.0, fixed in 15.5.21; from 16.0.0, fixed in 16.2.11.
- Fixed in 15.5.21 (released Jul 21, 2026, 6 days before disclosure) and 16.2.11 (released Jul 21, 2026, 6 days before disclosure).
- The latest release, 16.4.5, is not affected.
- 29% of next downloads last week were affected versions (28.4M).

### [CVE-2026-64646](https://cve.now/CVE-2026-64646): Next.js: Unbounded Server Action payload in Edge runtime

- Severity: Medium 6.3
- Published: Jul 27, 2026
- Affected: from 13.0.0, fixed in 15.5.21; from 16.0.0, fixed in 16.2.11.
- Fixed in 15.5.21 (released Jul 21, 2026, 6 days before disclosure) and 16.2.11 (released Jul 21, 2026, 6 days before disclosure).
- The latest release, 16.4.5, is not affected.
- 29% of next downloads last week were affected versions (28.4M).

### [CVE-2026-64644](https://cve.now/CVE-2026-64644): Next.js: Denial of Service in the Image Optimization API using SVGs

- Severity: Medium 6.3
- Published: Jul 27, 2026
- Affected: from 15.5.0, fixed in 15.5.21; from 16.0.0, fixed in 16.2.11.
- Fixed in 15.5.21 (released Jul 21, 2026, 6 days before disclosure) and 16.2.11 (released Jul 21, 2026, 6 days before disclosure).
- The latest release, 16.4.5, is not affected.
- 18% of next downloads last week were affected versions (17.5M).

### [CVE-2026-64643](https://cve.now/CVE-2026-64643): Next.js: Unauthenticated Disclosure of Internal Server Function endpoints

- Severity: Medium 6.3
- Published: Jul 27, 2026
- Affected: from 13.0.0, fixed in 15.5.21; from 16.0.0, fixed in 16.2.11.
- Fixed in 15.5.21 (released Jul 21, 2026, 6 days before disclosure) and 16.2.11 (released Jul 21, 2026, 6 days before disclosure).
- The latest release, 16.4.5, is not affected.
- 29% of next downloads last week were affected versions (28.4M).

### [CVE-2026-64642](https://cve.now/CVE-2026-64642): Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale

- Severity: High 8.3
- Published: Jul 27, 2026
- Affected: from 16.0.0, fixed in 16.2.11.
- Fixed in 16.2.11 (released Jul 21, 2026, 6 days before disclosure).
- The latest release, 16.4.5, is not affected.
- 13% of next downloads last week were affected versions (12.6M).

### [CVE-2026-64641](https://cve.now/CVE-2026-64641): Next.js: Denial of Service in App Router using Server Actions

- Severity: High 8.2
- Published: Jul 27, 2026
- Affected: from 13.0.0, fixed in 15.5.21; from 16.0.0, fixed in 16.2.11.
- Fixed in 15.5.21 (released Jul 21, 2026, 6 days before disclosure) and 16.2.11 (released Jul 21, 2026, 6 days before disclosure).
- The latest release, 16.4.5, is not affected.
- 29% of next downloads last week were affected versions (28.4M).

### [CVE-2026-64645](https://cve.now/CVE-2026-64645): Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname

- Severity: High 8.3
- Published: Jul 27, 2026
- Affected: from 12.0.0, fixed in 15.5.21; from 16.0.0, fixed in 16.2.11.
- Fixed in 15.5.21 (released Jul 21, 2026, 6 days before disclosure) and 16.2.11 (released Jul 21, 2026, 6 days before disclosure).
- The latest release, 16.4.5, is not affected.
- 29% of next downloads last week were affected versions (28.9M).

### [CVE-2026-45109](https://cve.now/CVE-2026-45109): Next.js: Middleware / Proxy bypass in App Router applications via segment-prefetch routes

- Severity: High 7.5
- Published: May 13, 2026
- Affected: from 15.2.0, fixed in 15.5.18; from 16.0.0, fixed in 16.2.6.
- Fixed in 15.5.18 (released May 7, 2026, 6 days before disclosure) and 16.2.6 (released May 7, 2026, 6 days before disclosure).
- The latest release, 16.4.5, is not affected.
- 13% of next downloads last week were affected versions (12.6M).

### [CVE-2026-44582](https://cve.now/CVE-2026-44582): Next.js: Cache poisoning via collisions in React Server Component cache-busting

- Severity: Low 3.7
- Published: May 13, 2026
- Affected: from 13.4.6, fixed in 15.5.16; from 16.0.0, fixed in 16.2.5.
- Fixed in 15.5.16 (released May 6, 2026, 7 days before disclosure) and 16.2.5 (released May 6, 2026, 7 days before disclosure).
- The latest release, 16.4.5, is not affected.
- 22% of next downloads last week were affected versions (21.2M).

### [CVE-2026-44581](https://cve.now/CVE-2026-44581): Next.js: Cross-site scripting in App Router applications using CSP nonces

- Severity: Medium 4.7
- Published: May 13, 2026
- Affected: from 13.4.0, fixed in 15.5.16; from 16.0.0, fixed in 16.2.5.
- Fixed in 15.5.16 (released May 6, 2026, 7 days before disclosure) and 16.2.5 (released May 6, 2026, 7 days before disclosure).
- The latest release, 16.4.5, is not affected.
- 22% of next downloads last week were affected versions (21.2M).

### [CVE-2026-44580](https://cve.now/CVE-2026-44580): Next.js: Cross-site scripting in beforeInteractive scripts with untrusted input

- Severity: Medium 6.1
- Published: May 13, 2026
- Affected: from 13.0.0, fixed in 15.5.16; from 16.0.0, fixed in 16.2.5.
- Fixed in 15.5.16 (released May 6, 2026, 7 days before disclosure) and 16.2.5 (released May 6, 2026, 7 days before disclosure).
- The latest release, 16.4.5, is not affected.
- 22% of next downloads last week were affected versions (21.4M).

### [CVE-2026-44579](https://cve.now/CVE-2026-44579): Next.js: Denial of Service via connection exhaustion in applications using Cache Components

- Severity: High 7.5
- Published: May 13, 2026
- Affected: from 15.0.0, fixed in 15.5.16; from 16.0.0, fixed in 16.2.5.
- Fixed in 15.5.16 (released May 6, 2026, 7 days before disclosure) and 16.2.5 (released May 6, 2026, 7 days before disclosure).
- The latest release, 16.4.5, is not affected.
- 14% of next downloads last week were affected versions (14M).

### [CVE-2026-44578](https://cve.now/CVE-2026-44578): Next.js: Server-side request forgery in applications using WebSocket upgrades

- Severity: High 8.6
- Published: May 13, 2026
- Affected: from 13.4.13, fixed in 15.5.16; from 16.0.0, fixed in 16.2.5.
- Fixed in 15.5.16 (released May 6, 2026, 7 days before disclosure) and 16.2.5 (released May 6, 2026, 7 days before disclosure).
- The latest release, 16.4.5, is not affected.
- 21% of next downloads last week were affected versions (21.1M).

### [CVE-2026-44577](https://cve.now/CVE-2026-44577): Next.js: Denial of Service in the Image Optimization API

- Severity: Medium 5.9
- Published: May 13, 2026
- Affected: from 10.0.0, fixed in 15.5.16; from 16.0.0, fixed in 16.2.5.
- Fixed in 15.5.16 (released May 6, 2026, 7 days before disclosure) and 16.2.5 (released May 6, 2026, 7 days before disclosure).
- The latest release, 16.4.5, is not affected.
- 22% of next downloads last week were affected versions (22.1M).

### [CVE-2026-44576](https://cve.now/CVE-2026-44576): Next.js: Cache poisoning in React Server Component responses

- Severity: Medium 5.4
- Published: May 13, 2026
- Affected: from 14.2.0, fixed in 15.5.16; from 16.0.0, fixed in 16.2.5.
- Fixed in 15.5.16 (released May 6, 2026, 7 days before disclosure) and 16.2.5 (released May 6, 2026, 7 days before disclosure).
- The latest release, 16.4.5, is not affected.
- 20% of next downloads last week were affected versions (20M).

### [CVE-2026-44574](https://cve.now/CVE-2026-44574): Next.js: Middleware / Proxy bypass through dynamic route parameter injection

- Severity: High 8.1
- Published: May 13, 2026
- Affected: from 15.4.0, fixed in 15.5.16; from 16.0.0, fixed in 16.2.5.
- Fixed in 15.5.16 (released May 6, 2026, 7 days before disclosure) and 16.2.5 (released May 6, 2026, 7 days before disclosure).
- The latest release, 16.4.5, is not affected.
- 11% of next downloads last week were affected versions (11.1M).

### [CVE-2026-44575](https://cve.now/CVE-2026-44575): Next.js: Middleware / Proxy bypass in App Router applications via segment-prefetch routes

- Severity: High 7.5
- Published: May 13, 2026
- Affected: from 15.2.0, fixed in 15.5.16; from 16.0.0, fixed in 16.2.5.
- Fixed in 15.5.16 (released May 6, 2026, 7 days before disclosure) and 16.2.5 (released May 6, 2026, 7 days before disclosure).
- The latest release, 16.4.5, is not affected.
- 13% of next downloads last week were affected versions (12.4M).

### [CVE-2026-44573](https://cve.now/CVE-2026-44573): Next.js: Middleware / Proxy bypass in Pages Router applications using i18n

- Severity: High 7.5
- Published: May 13, 2026
- Affected: from 12.2.0, fixed in 15.5.16; from 16.0.0, fixed in 16.2.5.
- Fixed in 15.5.16 (released May 6, 2026, 7 days before disclosure) and 16.2.5 (released May 6, 2026, 7 days before disclosure).
- The latest release, 16.4.5, is not affected.
- 22% of next downloads last week were affected versions (21.8M).

### [CVE-2026-44572](https://cve.now/CVE-2026-44572): Next.js: Middleware / Proxy redirects can be cache-poisoned

- Severity: Low 3.7
- Published: May 13, 2026
- Affected: from 12.2.0, fixed in 15.5.16; from 16.0.0, fixed in 16.2.5.
- Fixed in 15.5.16 (released May 6, 2026, 7 days before disclosure) and 16.2.5 (released May 6, 2026, 7 days before disclosure).
- The latest release, 16.4.5, is not affected.
- 22% of next downloads last week were affected versions (21.8M).

### [CVE-2026-29057](https://cve.now/CVE-2026-29057): Next.js: HTTP request smuggling in rewrites

- Severity: Medium 6.3
- Published: Mar 18, 2026
- Affected: from 16.0.0-beta.0, fixed in 16.1.7; from 9.5.0, fixed in 15.5.13.
- Fixed in 15.5.13 (released Mar 16, 2026, 2 days before disclosure) and 16.1.7 (released Mar 16, 2026, 2 days before disclosure).
- The latest release, 16.4.5, is not affected.
- 19% of next downloads last week were affected versions (19.1M).

### [CVE-2026-27980](https://cve.now/CVE-2026-27980): Next.js: Unbounded next/image disk cache growth can exhaust storage

- Severity: Medium 6.9
- Published: Mar 18, 2026
- Affected: from 16.0.0-beta.0, fixed in 16.1.7; from 10.0.0, fixed in 15.5.14.
- Fixed in 15.5.14 (released Mar 19, 2026, 1 day after disclosure) and 16.1.7 (released Mar 16, 2026, 2 days before disclosure).
- The latest release, 16.4.5, is not affected.
- 19% of next downloads last week were affected versions (19.2M).

### [CVE-2026-27979](https://cve.now/CVE-2026-27979): Next.js: Unbounded postponed resume buffering can lead to DoS

- Severity: Medium 6.9
- Published: Mar 18, 2026
- Affected: from 16.0.1, fixed in 16.1.7.
- Fixed in 16.1.7 (released Mar 16, 2026, 2 days before disclosure).
- The latest release, 16.4.5, is not affected.
- 4.7% of next downloads last week were affected versions (4.6M).

### [CVE-2026-27978](https://cve.now/CVE-2026-27978): Next.js: null origin can bypass Server Actions CSRF checks

- Severity: Medium 5.3
- Published: Mar 17, 2026
- Affected: from 16.0.1, fixed in 16.1.7.
- Fixed in 16.1.7 (released Mar 16, 2026, 1 day before disclosure).
- The latest release, 16.4.5, is not affected.
- 4.7% of next downloads last week were affected versions (4.6M).

### [CVE-2026-27977](https://cve.now/CVE-2026-27977): Next.js: null origin can bypass dev HMR websocket CSRF checks

- Severity: Low 2.3
- Published: Mar 17, 2026
- Affected: from 16.0.1, fixed in 16.1.7.
- Fixed in 16.1.7 (released Mar 16, 2026, 1 day before disclosure).
- The latest release, 16.4.5, is not affected.
- 4.7% of next downloads last week were affected versions (4.6M).

### [CVE-2025-59472](https://cve.now/CVE-2025-59472): A denial of service vulnerability exists in Next.js versions with Partial Prerendering (PPR) enabled when running in minimal mode.

- Severity: Medium 5.9
- Published: Jan 26, 2026
- Affected: from 16.0.0-beta.0, fixed in 16.1.5; from 15.0.0-canary.0, through 15.0.0-canary.205; from 15.0.1-canary.0, through 15.0.1-canary.3; from 15.0.2-canary.0, through 15.0.2-canary.11; from 15.0.3-canary.0, through 15.0.3-canary.9; from 15.0.4-canary.0, through 15.0.4-canary.52; from 15.1.1-canary.0, through 15.1.1-canary.27; from 15.2.0-canary.0, through 15.2.0-canary.77; from 15.2.1-canary.0, through 15.2.1-canary.6; from 15.2.2-canary.0, through 15.2.2-canary.7; from 15.3.0-canary.0, through 15.3.0-canary.46; from 15.3.1-canary.0, through 15.3.1-canary.15; from 15.4.0-canary.0, through 15.4.0-canary.130; from 15.4.2-canary.0, through 15.4.2-canary.56; from 15.5.1-canary.0, through 15.5.1-canary.39; from 15.6.0-canary.0, fixed in 15.6.0-canary.61.
- Fixed in 15.6.0-canary.61 (released Jan 26, 2026, the day of disclosure) and 16.1.5 (released Jan 26, 2026, the day of disclosure).
- The latest release, 16.4.5, is not affected.
- 3.3% of next downloads last week were affected versions (3.2M).

### [CVE-2025-59471](https://cve.now/CVE-2025-59471): A denial of service vulnerability exists in self-hosted Next.js applications that have \`remotePatterns\` configured for the Image Optimizer.

- Severity: Medium 5.9
- Published: Jan 26, 2026
- Affected: from 10.0.0, fixed in 15.5.10; from 15.6.0-canary.0, fixed in 16.1.5.
- Fixed in 15.5.10 (released Jan 26, 2026, the day of disclosure) and 16.1.5 (released Jan 26, 2026, the day of disclosure).
- The latest release, 16.4.5, is not affected.
- 17% of next downloads last week were affected versions (17M).

### [CVE-2025-57752](https://cve.now/CVE-2025-57752): Next.js Affected by Cache Key Confusion for Image Optimization API Routes

- Severity: Medium 6.2
- Published: Aug 29, 2025
- Affected: from 0.9.9, fixed in 14.2.31; from 15.0.0, fixed in 15.4.5.
- Fixed in 14.2.31 and 15.4.11 (released Jan 26, 2026, 150 days after disclosure, the advisory names 15.4.5, which was never published).
- The latest release, 16.4.5, is not affected.
- 7.8% of next downloads last week were affected versions (7.7M).

### [CVE-2025-55173](https://cve.now/CVE-2025-55173): Next.js Content Injection Vulnerability for Image Optimization

- Severity: Medium 4.3
- Published: Aug 29, 2025
- Affected: from 0.9.9, fixed in 14.2.31; from 15.0.0, fixed in 15.4.5.
- Fixed in 14.2.31 and 15.4.11 (released Jan 26, 2026, 150 days after disclosure, the advisory names 15.4.5, which was never published).
- The latest release, 16.4.5, is not affected.
- 7.8% of next downloads last week were affected versions (7.7M).

### [CVE-2025-57822](https://cve.now/CVE-2025-57822): Next.js Improper Middleware Redirect Handling Leads to SSRF

- Severity: Medium 6.5
- Published: Aug 29, 2025
- Affected: from 0.9.9, fixed in 14.2.32; from 15.0.0-canary.0, fixed in 15.4.7.
- Fixed in 14.2.32 and 15.4.11 (released Jan 26, 2026, 150 days after disclosure, the advisory names 15.4.7, which was never published).
- The latest release, 16.4.5, is not affected.
- 8% of next downloads last week were affected versions (7.9M).

### [CVE-2025-49826](https://cve.now/CVE-2025-49826): Next.js DoS vulnerability via cache poisoning

- Severity: High 7.5
- Published: Jul 3, 2025
- Affected: from 15.0.4-canary.51, fixed in 15.1.8.
- Fixed in 15.1.12 (released Jan 26, 2026, 207 days after disclosure, the advisory names 15.1.8, which was never published).
- The latest release, 16.4.5, is not affected.
- 1.3% of next downloads last week were affected versions (1.3M).

### [CVE-2025-49005](https://cve.now/CVE-2025-49005): Next.js cache poisoning due to omission of Vary header

- Severity: Low 3.7
- Published: Jul 3, 2025
- Affected: from 15.3.0, fixed in 15.3.3.
- Fixed in 15.3.9 (released Jan 26, 2026, 207 days after disclosure, the advisory names 15.3.3, which was never published).
- The latest release, 16.4.5, is not affected.
- 0.3% of next downloads last week were affected versions (260.2K).

### [CVE-2025-48068](https://cve.now/CVE-2025-48068): Information exposure in Next.js dev server due to lack of origin verification

- Severity: Low 2.3
- Published: May 30, 2025
- Affected: from 15.0.0, fixed in 15.2.2; from 13.0, fixed in 14.2.30.
- Fixed in 14.2.30 and 15.2.9 (released Jan 26, 2026, 241 days after disclosure, the advisory names 15.2.2, which was never published).
- The latest release, 16.4.5, is not affected.
- 5.4% of next downloads last week were affected versions (5.3M).

### [CVE-2025-32421](https://cve.now/CVE-2025-32421): Next.js Race Condition to Cache Poisoning

- Severity: Low 3.7
- Published: May 14, 2025
- Affected: from 0.9.9, fixed in 14.2.24; from 15.0.0, fixed in 15.1.6.
- Fixed in 14.2.24 and 15.1.12 (released Jan 26, 2026, 257 days after disclosure, the advisory names 15.1.6, which was never published).
- The latest release, 16.4.5, is not affected.
- 5.2% of next downloads last week were affected versions (5.1M).

### [CVE-2025-30218](https://cve.now/CVE-2025-30218): Next.js may leak x-middleware-subrequest-id to external hosts

- Severity: Low 1.7
- Published: Apr 2, 2025
- Affected: from 12.3.5, fixed in 12.3.6; from 13.5.9, fixed in 13.5.10; from 14.2.25, fixed in 14.2.26; from 15.2.3, fixed in 15.2.4.
- Fixed in 12.3.6, 13.5.10, 14.2.26 and 1 other version.
- The latest release, 16.4.5, is not affected.
- 0.3% of next downloads last week were affected versions (247.7K).

### [CVE-2025-29927](https://cve.now/CVE-2025-29927): Authorization Bypass in Next.js Middleware

- Severity: Critical 9.1
- Published: Mar 21, 2025
- Affected: from 13.0.0, fixed in 13.5.9; from 14.0.0, fixed in 14.2.25; from 15.0.0, fixed in 15.2.3; from 12.0.0, fixed in 12.3.5.
- Fixed in 12.3.5, 13.5.9, 14.2.25 and 1 other version.
- The latest release, 16.4.5, is not affected.
- 4.9% of next downloads last week were affected versions (4.8M).

### [CVE-2024-56332](https://cve.now/CVE-2024-56332): Next.js Vulnerable to Denial of Service (DoS) with Server Actions

- Severity: Medium 5.3
- Published: Jan 3, 2025
- Affected: from 13.0.0, fixed in 13.5.8; from 14.0.0, fixed in 14.2.21; from 15.0.0, fixed in 15.1.2.
- Fixed in 13.5.8, 14.2.21 and 15.1.12 (released Jan 26, 2026, 388 days after disclosure, the advisory names 15.1.2, which was never published).
- The latest release, 16.4.5, is not affected.
- 3.1% of next downloads last week were affected versions (3M).

### [CVE-2024-51479](https://cve.now/CVE-2024-51479): Authorization bypass in Next.js

- Severity: High 7.5
- Published: Dec 17, 2024
- Affected: from 9.5.5, fixed in 14.2.15.
- Fixed in 14.2.15.
- The latest release, 16.4.5, is not affected.
- 3.4% of next downloads last week were affected versions (3.3M).

### [CVE-2024-47831](https://cve.now/CVE-2024-47831): Next.js image optimization has Denial of Service condition

- Severity: Medium 5.9
- Published: Oct 14, 2024
- Affected: from 10.0.0, fixed in 14.2.7.
- Fixed in 14.2.7.
- The latest release, 16.4.5, is not affected.
- 3.2% of next downloads last week were affected versions (3.1M).

### [CVE-2024-46982](https://cve.now/CVE-2024-46982): Cache Poisoning in next.js

- Severity: High 7.5
- Published: Sep 17, 2024
- Affected: from 13.5.1, fixed in 13.5.7; from 14.0.0, fixed in 14.2.10.
- Fixed in 13.5.7 and 14.2.10.
- The latest release, 16.4.5, is not affected.
- 1.9% of next downloads last week were affected versions (1.8M).

### [CVE-2024-39693](https://cve.now/CVE-2024-39693): Next.js Denial of Service (DoS) condition

- Severity: High 7.5
- Published: Jul 10, 2024
- Affected: from 13.3.1, fixed in 13.5.0.
- Fixed in 13.5.0.
- The latest release, 16.4.5, is not affected.
- 0.2% of next downloads last week were affected versions (205.2K).

### [CVE-2024-34351](https://cve.now/CVE-2024-34351): Next.js Server-Side Request Forgery in Server Actions

- Severity: High 7.5
- Published: May 9, 2024
- Affected: from 13.4.0, fixed in 14.1.1.
- Fixed in 14.1.1.
- The latest release, 16.4.5, is not affected.
- 1% of next downloads last week were affected versions (1M).

### [CVE-2024-34350](https://cve.now/CVE-2024-34350): Next.js Vulnerable to HTTP Request Smuggling

- Severity: High 7.5
- Published: May 9, 2024
- Affected: from 13.4.0, fixed in 13.5.1.
- Fixed in 13.5.1.
- The latest release, 16.4.5, is not affected.
- 0.2% of next downloads last week were affected versions (183.2K).

### [CVE-2023-46298](https://cve.now/CVE-2023-46298): Next.js before 13.4.20-canary.13 lacks a cache-control header and thus empty prefetch responses may sometimes be cached by a CDN, causing…

- Severity: Unrated
- Published: Oct 22, 2023
- Affected: from 0.9.9, fixed in 13.4.20-canary.13.
- Fixed in 13.4.20-canary.13.
- The latest release, 16.4.5, is not affected.
- 1.1% of next downloads last week were affected versions (1.1M).

### [CVE-2022-36046](https://cve.now/CVE-2022-36046): Unexpected server crash in Next.js version 12.2.3

- Severity: Medium 5.3
- Published: Aug 31, 2022
- Affected: from 12.2.3, fixed in 12.2.4.
- Fixed in 12.2.4.
- The latest release, 16.4.5, is not affected.
- <0.1% of next downloads last week were affected versions (7.3K).

### [CVE-2022-23646](https://cve.now/CVE-2022-23646): Improper CSP in Image Optimization API for Next.js

- Severity: Medium 5.9
- Published: Feb 17, 2022
- Affected: from 10.0.0, fixed in 12.1.0.
- Fixed in 12.1.0.
- The latest release, 16.4.5, is not affected.
- 0.2% of next downloads last week were affected versions (196.8K).

### [CVE-2022-21721](https://cve.now/CVE-2022-21721): DOS Vulnerability in next.js

- Severity: Medium 5.9
- Published: Jan 28, 2022
- Affected: from 12.0.0, fixed in 12.0.9.
- Fixed in 12.0.9.
- The latest release, 16.4.5, is not affected.
- <0.1% of next downloads last week were affected versions (81.5K).

### [CVE-2021-43803](https://cve.now/CVE-2021-43803): Unexpected server crash in Next.js

- Severity: High 7.5
- Published: Dec 9, 2021
- Affected: from 12.0.0, fixed in 12.0.5; from 0.9.9, fixed in 11.1.3.
- Fixed in 11.1.3 and 12.0.5.
- The latest release, 16.4.5, is not affected.
- 0.2% of next downloads last week were affected versions (174.5K).

### [CVE-2021-39178](https://cve.now/CVE-2021-39178): XSS in Image Optimization API for Next.js versions between 10.0.0 and 11.1.0

- Severity: High 7.5
- Published: Aug 30, 2021
- Affected: from 10.0.0, fixed in 11.1.1.
- Fixed in 11.1.1.
- The latest release, 16.4.5, is not affected.
- <0.1% of next downloads last week were affected versions (68.7K).

### [CVE-2021-37699](https://cve.now/CVE-2021-37699): Open Redirect in Next.js versions below 11.1.0

- Severity: Medium 6.9
- Published: Aug 11, 2021
- Affected: from 0.9.9, fixed in 11.1.0.
- Fixed in 11.1.0.
- The latest release, 16.4.5, is not affected.
- 0.1% of next downloads last week were affected versions (145.4K).

### [CVE-2020-15242](https://cve.now/CVE-2020-15242): Open Redirect in Next.js

- Severity: Medium 4.7
- Published: Oct 8, 2020
- Affected: from 9.5.0, fixed in 9.5.4.
- Fixed in 9.5.4.
- The latest release, 16.4.5, is not affected.
- <0.1% of next downloads last week were affected versions (5.4K).

### [CVE-2020-5284](https://cve.now/CVE-2020-5284): Directory Traversal in Next.js versions below 9.3.2

- Severity: Medium 4.4
- Published: Mar 30, 2020
- Affected: from 0.9.9, fixed in 9.3.2.
- Fixed in 9.3.2.
- The latest release, 16.4.5, is not affected.
- <0.1% of next downloads last week were affected versions (53.8K).

### [CVE-2018-18282](https://cve.now/CVE-2018-18282): Next.js 7.0.0 and 7.0.1 has XSS via the 404 or 500 /\_error page.

- Severity: Unrated
- Published: Oct 12, 2018
- Affected: from 7.0.0, fixed in 7.0.2.
- Fixed in 7.0.2.
- The latest release, 16.4.5, is not affected.
- <0.1% of next downloads last week were affected versions (1.3K).

### [CVE-2018-6184](https://cve.now/CVE-2018-6184): ZEIT Next.js 4 before 4.2.3 has Directory Traversal under the /\_next request namespace.

- Severity: Unrated
- Published: Jan 24, 2018
- Affected: from 1.0.0, fixed in 4.2.3.
- Fixed in 4.2.3.
- The latest release, 16.4.5, is not affected.
- <0.1% of next downloads last week were affected versions (7.4K).

### [CVE-2017-16877](https://cve.now/CVE-2017-16877): ZEIT Next.js before 2.4.1 has directory traversal under the /\_next and /static request namespace, allowing attackers to obtain sensitive…

- Severity: Unrated
- Published: Nov 17, 2017
- Affected: from 1.0.0, fixed in 2.4.1.
- Fixed in 2.4.1.
- The latest release, 16.4.5, is not affected.
- <0.1% of next downloads last week were affected versions (1.9K).

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/npm/next
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.