Next.js vulnerabilities
The newest vulnerabilities affecting Next.js, up to 200. Subscribe by RSS.
- CVE-2026-94482Next.js: Denial of Service in App Router using Server Actionsvercel next.js · next
- CVE-2026-109375Vercel deepsec before 1.1.17 Arbitrary File Write via Symlink in Sandbox Tarball ExtractionVercel deepsec
- CVE-2026-94484Next.js: Cache poisoning in Next.js SSG/ISR rendering leads to cross-user content substitution and persistent denial of servicevercel next.js · next
- CVE-2026-94485Next.js: Information disclosure in Next.js App Router metadata image routes via dynamicParams bypassvercel next.js · next
- CVE-2026-94483Next.js: Server-Side Request Forgery in Image Optimizationvercel next.js · next
- CVE-2026-94543Next.js: Cache poisoning of SSG and ISR pages in self-hosted Next.js applicationsvercel next.js · next
- CVE-2026-94544Next.js: Pending `use cache` fill can leak Draft Mode content into regular responses and persisted pagesvercel next.js · next
- CVE-2026-94486Next.js: Information disclosure in the Next.js development server's Model Context Protocol endpointvercel next.js · next
- CVE-2026-103004next.js cache leak on warm `use cache` handlers accessing root paramvercel next.js · next
- CVE-2026-94545Satori-generated SVG has improper escapingvercel satori · vercel next +1
- CVE-2026-75604Next.js: Unauthenticated Remote Code Execution on windows-hosted serversvercel next.js · next
- CVE-2026-64649Next.js: Server-Side Request Forgery in Server Actions on Custom Serversvercel next.js · next
- CVE-2026-64648Next.js: Response Body Cache Confusion for Requests Containing Bodiesvercel next.js · next
- CVE-2026-64647Next.js: Response Body Cache Confusion with Invalid UTF-8 Request Bodiesvercel next.js · next
- CVE-2026-64646Next.js: Unbounded Server Action payload in Edge runtimevercel next.js · next
- CVE-2026-64644Next.js: Denial of Service in the Image Optimization API using SVGsvercel next.js · next
- CVE-2026-64643Next.js: Unauthenticated Disclosure of Internal Server Function endpointsvercel next.js · next
- CVE-2026-64642Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single localevercel next.js · next
- CVE-2026-64641Next.js: Denial of Service in App Router using Server Actionsvercel next.js · next
- CVE-2026-64645Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostnamevercel next.js · next
- CVE-2026-64650AI SDK Codex Harness Tool Relay Authorization Bypassvercel @ai-sdk/harness-codex
- CVE-2026-64651AI SDK OpenCode Harness Tool Relay Authorization Bypassvercel @ai-sdk/harness-opencode
- CVE-2026-8769vercel ai provider-utils response-handler.ts createJsonErrorResponseHandler resource consumptionvercel ai · @ai-sdk/provider-utils
- CVE-2026-8768vercel ai provider-utils download-blob.ts validateDownloadUrl server-side request forgeryvercel ai
- CVE-2026-8767vercel ai PR Branch Name Interpolation prettier-on-automerge.yml run os command injectionvercel ai
- CVE-2026-45773Turborepo: Login callback CSRF/session fixationvercel turborepo · turbo
- CVE-2026-46508Turborepo: VSCode Extension command injectionvercel turborepo
- CVE-2026-45772Turborepo: Unexpected local code execution during Yarn Berry detectionvercel turborepo · @turbo codemod +4
- CVE-2026-45109Next.js: Middleware / Proxy bypass in App Router applications via segment-prefetch routesvercel next.js · next
- CVE-2026-44582Next.js: Cache poisoning via collisions in React Server Component cache-bustingvercel next.js · next
- CVE-2026-44581Next.js: Cross-site scripting in App Router applications using CSP noncesvercel next.js · next
- CVE-2026-44580Next.js: Cross-site scripting in beforeInteractive scripts with untrusted inputvercel next.js · next
- CVE-2026-44579Next.js: Denial of Service via connection exhaustion in applications using Cache Componentsvercel next.js · next
- CVE-2026-44578Next.js: Server-side request forgery in applications using WebSocket upgradesvercel next.js · next
- CVE-2026-44577Next.js: Denial of Service in the Image Optimization APIvercel next.js · next
- CVE-2026-44576Next.js: Cache poisoning in React Server Component responsesvercel next.js · next
- CVE-2026-44574Next.js: Middleware / Proxy bypass through dynamic route parameter injectionvercel next.js · next
- CVE-2026-44575Next.js: Middleware / Proxy bypass in App Router applications via segment-prefetch routesvercel next.js · next
- CVE-2026-44573Next.js: Middleware / Proxy bypass in Pages Router applications using i18nvercel next.js · next
- CVE-2026-44572Next.js: Middleware / Proxy redirects can be cache-poisonedvercel next.js · next
- CVE-2026-44479Vercel: Non-interactive mode includes CLI arguments in suggested command outputvercel
- CVE-2026-29057Next.js: HTTP request smuggling in rewritesvercel next.js · next
- CVE-2026-27980Next.js: Unbounded next/image disk cache growth can exhaust storagevercel next.js · next
- CVE-2026-27979Next.js: Unbounded postponed resume buffering can lead to DoSvercel next.js · next
- CVE-2026-27978Next.js: null origin can bypass Server Actions CSRF checksvercel next.js · next
- CVE-2026-27977Next.js: null origin can bypass dev HMR websocket CSRF checksvercel next.js · next
- CVE-2025-59472A denial of service vulnerability exists in Next.js versions with Partial Prerendering (PPR) enabled when running in minimal mode.vercel next · next
- CVE-2025-59471A denial of service vulnerability exists in self-hosted Next.js applications that have `remotePatterns` configured for the Image Optimizer.vercel next · next
- CVE-2025-48985A vulnerability in Vercel’s AI SDK has been fixed in versions 5.0.52, 5.1.0-beta.9, and 6.0.0-beta.Vercel AI SDK · ai
- CVE-2025-52662A vulnerability in Nuxt DevTools has been fixed in version **2.6.4***.Vercel Nuxt Devtools · @nuxt/devtools
- CVE-2025-57752Next.js Affected by Cache Key Confusion for Image Optimization API Routesvercel next.js · next
- CVE-2025-55173Next.js Content Injection Vulnerability for Image Optimizationvercel next.js · next
- CVE-2025-57822Next.js Improper Middleware Redirect Handling Leads to SSRFvercel next.js · next
- CVE-2025-7074vercel hyper rimraf-standalone.js ignoreMap redosvercel hyper
- CVE-2025-49826Next.js DoS vulnerability via cache poisoningvercel next.js · next
- CVE-2025-49005Next.js cache poisoning due to omission of Vary headervercel next.js · next
- CVE-2025-48068Information exposure in Next.js dev server due to lack of origin verificationvercel next.js · next
- CVE-2025-32421Next.js Race Condition to Cache Poisoningvercel next.js · next
- CVE-2025-46332Information Disclosure via Flags override linkvercel flags · flags +1
- CVE-2025-30218Next.js may leak x-middleware-subrequest-id to external hostsvercel next.js · next
- CVE-2025-29927Authorization Bypass in Next.js Middlewarevercel next.js · next
- CVE-2024-56332Next.js Vulnerable to Denial of Service (DoS) with Server Actionsvercel next.js · next
- CVE-2024-51479Authorization bypass in Next.jsvercel next.js · next
- CVE-2024-47831Next.js image optimization has Denial of Service conditionvercel next.js · next
- CVE-2024-46982Cache Poisoning in next.jsvercel next.js · next
- CVE-2024-39693Next.js Denial of Service (DoS) conditionvercel next.js · next
- CVE-2024-34351Next.js Server-Side Request Forgery in Server Actionsvercel next.js · next
- CVE-2024-34350Next.js Vulnerable to HTTP Request Smugglingvercel next.js · next
- CVE-2024-24828Local Privilege Escalation in execuatables bundled by pkgvercel pkg · pkg
- CVE-2023-46298Next.js before 13.4.20-canary.13 lacks a cache-control header and thus empty prefetch responses may sometimes be cached by a CDN, causing a next
- CVE-2017-20162vercel ms index.js parse redosvercel ms · ms
- CVE-2022-36046Unexpected server crash in Next.js version 12.2.3vercel next.js · next +1
- CVE-2022-23646Improper CSP in Image Optimization API for Next.jsvercel next.js · next
- CVE-2022-21721DOS Vulnerability in next.jsnext
- CVE-2021-43803Unexpected server crash in Next.jsvercel next.js · next
- CVE-2021-39178XSS in Image Optimization API for Next.js versions between 10.0.0 and 11.1.0vercel next.js · next
- CVE-2021-37699Open Redirect in Next.js versions below 11.1.0vercel next.js · next
- CVE-2020-15242Open Redirect in Next.jsvercel next.js · next
- CVE-2020-5284Directory Traversal in Next.js versions below 9.3.2zeit next.js · next
- CVE-2018-18282Next.js 7.0.0 and 7.0.1 has XSS via the 404 or 500 /_error page.next
- CVE-2018-6184ZEIT Next.js 4 before 4.2.3 has Directory Traversal under the /_next request namespace.next
- CVE-2017-16877ZEIT Next.js before 2.4.1 has directory traversal under the /_next and /static request namespace, allowing attackers to obtain sensitive infnext