# cve.now: Next.js

The newest entries affecting Next.js (up to 200). Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-94482](https://cve.now/CVE-2026-94482.md): Next.js: Denial of Service in App Router using Server Actions (CVSS 8.2, vercel next.js · next)
- [CVE-2026-109375](https://cve.now/CVE-2026-109375.md): Vercel deepsec before 1.1.17 Arbitrary File Write via Symlink in Sandbox Tarball Extraction (CVSS 4.9, Vercel deepsec)
- [CVE-2026-94484](https://cve.now/CVE-2026-94484.md): Next.js: Cache poisoning in Next.js SSG/ISR rendering leads to cross-user content substitution and persistent denial of service (CVSS 6.3, vercel next.js · next)
- [CVE-2026-94485](https://cve.now/CVE-2026-94485.md): Next.js: Information disclosure in Next.js App Router metadata image routes via dynamicParams bypass (CVSS 6.3, vercel next.js · next)
- [CVE-2026-94483](https://cve.now/CVE-2026-94483.md): Next.js: Server-Side Request Forgery in Image Optimization (CVSS 8.3, vercel next.js · next)
- [CVE-2026-94543](https://cve.now/CVE-2026-94543.md): Next.js: Cache poisoning of SSG and ISR pages in self-hosted Next.js applications (CVSS 6.3, vercel next.js · next)
- [CVE-2026-94544](https://cve.now/CVE-2026-94544.md): Next.js: Pending \`use cache\` fill can leak Draft Mode content into regular responses and persisted pages (CVSS 6.3, vercel next.js · next)
- [CVE-2026-94486](https://cve.now/CVE-2026-94486.md): Next.js: Information disclosure in the Next.js development server's Model Context Protocol endpoint (CVSS 2.3, vercel next.js · next)
- [CVE-2026-103004](https://cve.now/CVE-2026-103004.md): next.js cache leak on warm \`use cache\` handlers accessing root param (CVSS 6.3, vercel next.js · next)
- [CVE-2026-94545](https://cve.now/CVE-2026-94545.md): Satori-generated SVG has improper escaping (CVSS 5.3, vercel satori · vercel next +1)
- [CVE-2026-75604](https://cve.now/CVE-2026-75604.md): Next.js: Unauthenticated Remote Code Execution on windows-hosted servers (CVSS 9.0, vercel next.js · next)
- [CVE-2026-64649](https://cve.now/CVE-2026-64649.md): Next.js: Server-Side Request Forgery in Server Actions on Custom Servers (CVSS 8.3, vercel next.js · next)
- [CVE-2026-64648](https://cve.now/CVE-2026-64648.md): Next.js: Response Body Cache Confusion for Requests Containing Bodies (CVSS 6.0, vercel next.js · next)
- [CVE-2026-64647](https://cve.now/CVE-2026-64647.md): Next.js: Response Body Cache Confusion with Invalid UTF-8 Request Bodies (CVSS 6.3, vercel next.js · next)
- [CVE-2026-64646](https://cve.now/CVE-2026-64646.md): Next.js: Unbounded Server Action payload in Edge runtime (CVSS 6.3, vercel next.js · next)
- [CVE-2026-64644](https://cve.now/CVE-2026-64644.md): Next.js: Denial of Service in the Image Optimization API using SVGs (CVSS 6.3, vercel next.js · next)
- [CVE-2026-64643](https://cve.now/CVE-2026-64643.md): Next.js: Unauthenticated Disclosure of Internal Server Function endpoints (CVSS 6.3, vercel next.js · next)
- [CVE-2026-64642](https://cve.now/CVE-2026-64642.md): Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale (CVSS 8.3, vercel next.js · next)
- [CVE-2026-64641](https://cve.now/CVE-2026-64641.md): Next.js: Denial of Service in App Router using Server Actions (CVSS 8.2, vercel next.js · next)
- [CVE-2026-64645](https://cve.now/CVE-2026-64645.md): Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname (CVSS 8.3, vercel next.js · next)
- [CVE-2026-64650](https://cve.now/CVE-2026-64650.md): AI SDK Codex Harness Tool Relay Authorization Bypass (CVSS 6.3, vercel @ai-sdk/harness-codex)
- [CVE-2026-64651](https://cve.now/CVE-2026-64651.md): AI SDK OpenCode Harness Tool Relay Authorization Bypass (CVSS 6.3, vercel @ai-sdk/harness-opencode)
- [CVE-2026-8769](https://cve.now/CVE-2026-8769.md): vercel ai provider-utils response-handler.ts createJsonErrorResponseHandler resource consumption (CVSS 5.3, vercel ai · @ai-sdk/provider-utils)
- [CVE-2026-8768](https://cve.now/CVE-2026-8768.md): vercel ai provider-utils download-blob.ts validateDownloadUrl server-side request forgery (CVSS 6.9, vercel ai)
- [CVE-2026-8767](https://cve.now/CVE-2026-8767.md): vercel ai PR Branch Name Interpolation prettier-on-automerge.yml run os command injection (CVSS 2.3, vercel ai)
- [CVE-2026-45773](https://cve.now/CVE-2026-45773.md): Turborepo: Login callback CSRF/session fixation (CVSS 5.1, vercel turborepo · turbo)
- [CVE-2026-46508](https://cve.now/CVE-2026-46508.md): Turborepo: VSCode Extension command injection (CVSS 8.4, vercel turborepo)
- [CVE-2026-45772](https://cve.now/CVE-2026-45772.md): Turborepo: Unexpected local code execution during Yarn Berry detection (CVSS 0.0, vercel turborepo · @turbo codemod +4)
- [CVE-2026-45109](https://cve.now/CVE-2026-45109.md): Next.js: Middleware / Proxy bypass in App Router applications via segment-prefetch routes (CVSS 7.5, vercel next.js · next)
- [CVE-2026-44582](https://cve.now/CVE-2026-44582.md): Next.js: Cache poisoning via collisions in React Server Component cache-busting (CVSS 3.7, vercel next.js · next)
- [CVE-2026-44581](https://cve.now/CVE-2026-44581.md): Next.js: Cross-site scripting in App Router applications using CSP nonces (CVSS 4.7, vercel next.js · next)
- [CVE-2026-44580](https://cve.now/CVE-2026-44580.md): Next.js: Cross-site scripting in beforeInteractive scripts with untrusted input (CVSS 6.1, vercel next.js · next)
- [CVE-2026-44579](https://cve.now/CVE-2026-44579.md): Next.js: Denial of Service via connection exhaustion in applications using Cache Components (CVSS 7.5, vercel next.js · next)
- [CVE-2026-44578](https://cve.now/CVE-2026-44578.md): Next.js: Server-side request forgery in applications using WebSocket upgrades (CVSS 8.6, vercel next.js · next)
- [CVE-2026-44577](https://cve.now/CVE-2026-44577.md): Next.js: Denial of Service in the Image Optimization API (CVSS 5.9, vercel next.js · next)
- [CVE-2026-44576](https://cve.now/CVE-2026-44576.md): Next.js: Cache poisoning in React Server Component responses (CVSS 5.4, vercel next.js · next)
- [CVE-2026-44574](https://cve.now/CVE-2026-44574.md): Next.js: Middleware / Proxy bypass through dynamic route parameter injection (CVSS 8.1, vercel next.js · next)
- [CVE-2026-44575](https://cve.now/CVE-2026-44575.md): Next.js: Middleware / Proxy bypass in App Router applications via segment-prefetch routes (CVSS 7.5, vercel next.js · next)
- [CVE-2026-44573](https://cve.now/CVE-2026-44573.md): Next.js: Middleware / Proxy bypass in Pages Router applications using i18n (CVSS 7.5, vercel next.js · next)
- [CVE-2026-44572](https://cve.now/CVE-2026-44572.md): Next.js: Middleware / Proxy redirects can be cache-poisoned (CVSS 3.7, vercel next.js · next)
- [CVE-2026-44479](https://cve.now/CVE-2026-44479.md): Vercel: Non-interactive mode includes CLI arguments in suggested command output (CVSS 5.5, vercel)
- [CVE-2026-29057](https://cve.now/CVE-2026-29057.md): Next.js: HTTP request smuggling in rewrites (CVSS 6.3, vercel next.js · next)
- [CVE-2026-27980](https://cve.now/CVE-2026-27980.md): Next.js: Unbounded next/image disk cache growth can exhaust storage (CVSS 6.9, vercel next.js · next)
- [CVE-2026-27979](https://cve.now/CVE-2026-27979.md): Next.js: Unbounded postponed resume buffering can lead to DoS (CVSS 6.9, vercel next.js · next)
- [CVE-2026-27978](https://cve.now/CVE-2026-27978.md): Next.js: null origin can bypass Server Actions CSRF checks (CVSS 5.3, vercel next.js · next)
- [CVE-2026-27977](https://cve.now/CVE-2026-27977.md): Next.js: null origin can bypass dev HMR websocket CSRF checks (CVSS 2.3, vercel next.js · next)
- [CVE-2025-59472](https://cve.now/CVE-2025-59472.md): A denial of service vulnerability exists in Next.js versions with Partial Prerendering (PPR) enabled when running in minimal mode. (CVSS 5.9, vercel next · next)
- [CVE-2025-59471](https://cve.now/CVE-2025-59471.md): A denial of service vulnerability exists in self-hosted Next.js applications that have \`remotePatterns\` configured for the Image Optimizer. (CVSS 5.9, vercel next · next)
- [CVE-2025-48985](https://cve.now/CVE-2025-48985.md): A vulnerability in Vercel’s AI SDK has been fixed in versions 5.0.52, 5.1.0-beta.9, and 6.0.0-beta. (CVSS 3.7, Vercel AI SDK · ai)
- [CVE-2025-52662](https://cve.now/CVE-2025-52662.md): A vulnerability in Nuxt DevTools has been fixed in version \*\*2.6.4\*\*\*. (CVSS 6.9, Vercel Nuxt Devtools · @nuxt/devtools)
- [CVE-2025-57752](https://cve.now/CVE-2025-57752.md): Next.js Affected by Cache Key Confusion for Image Optimization API Routes (CVSS 6.2, vercel next.js · next)
- [CVE-2025-55173](https://cve.now/CVE-2025-55173.md): Next.js Content Injection Vulnerability for Image Optimization (CVSS 4.3, vercel next.js · next)
- [CVE-2025-57822](https://cve.now/CVE-2025-57822.md): Next.js Improper Middleware Redirect Handling Leads to SSRF (CVSS 6.5, vercel next.js · next)
- [CVE-2025-7074](https://cve.now/CVE-2025-7074.md): vercel hyper rimraf-standalone.js ignoreMap redos (CVSS 5.3, vercel hyper)
- [CVE-2025-49826](https://cve.now/CVE-2025-49826.md): Next.js DoS vulnerability via cache poisoning (CVSS 7.5, vercel next.js · next)
- [CVE-2025-49005](https://cve.now/CVE-2025-49005.md): Next.js cache poisoning due to omission of Vary header (CVSS 3.7, vercel next.js · next)
- [CVE-2025-48068](https://cve.now/CVE-2025-48068.md): Information exposure in Next.js dev server due to lack of origin verification (CVSS 2.3, vercel next.js · next)
- [CVE-2025-32421](https://cve.now/CVE-2025-32421.md): Next.js Race Condition to Cache Poisoning (CVSS 3.7, vercel next.js · next)
- [CVE-2025-46332](https://cve.now/CVE-2025-46332.md): Information Disclosure via Flags override link (CVSS 6.5, vercel flags · flags +1)
- [CVE-2025-30218](https://cve.now/CVE-2025-30218.md): Next.js may leak x-middleware-subrequest-id to external hosts (CVSS 1.7, vercel next.js · next)
- [CVE-2025-29927](https://cve.now/CVE-2025-29927.md): Authorization Bypass in Next.js Middleware (CVSS 9.1, vercel next.js · next)
- [CVE-2024-56332](https://cve.now/CVE-2024-56332.md): Next.js Vulnerable to Denial of Service (DoS) with Server Actions (CVSS 5.3, vercel next.js · next)
- [CVE-2024-51479](https://cve.now/CVE-2024-51479.md): Authorization bypass in Next.js (CVSS 7.5, vercel next.js · next)
- [CVE-2024-47831](https://cve.now/CVE-2024-47831.md): Next.js image optimization has Denial of Service condition (CVSS 5.9, vercel next.js · next)
- [CVE-2024-46982](https://cve.now/CVE-2024-46982.md): Cache Poisoning in next.js (CVSS 7.5, vercel next.js · next)
- [CVE-2024-39693](https://cve.now/CVE-2024-39693.md): Next.js Denial of Service (DoS) condition (CVSS 7.5, vercel next.js · next)
- [CVE-2024-34351](https://cve.now/CVE-2024-34351.md): Next.js Server-Side Request Forgery in Server Actions (CVSS 7.5, vercel next.js · next)
- [CVE-2024-34350](https://cve.now/CVE-2024-34350.md): Next.js Vulnerable to HTTP Request Smuggling (CVSS 7.5, vercel next.js · next)
- [CVE-2024-24828](https://cve.now/CVE-2024-24828.md): Local Privilege Escalation in execuatables bundled by pkg (CVSS 6.6, vercel pkg · pkg)
- [CVE-2023-46298](https://cve.now/CVE-2023-46298.md): Next.js before 13.4.20-canary.13 lacks a cache-control header and thus empty prefetch responses may sometimes be cached by a CDN, causing a (no CVSS, next)
- [CVE-2017-20162](https://cve.now/CVE-2017-20162.md): vercel ms index.js parse redos (CVSS 4.3, vercel ms · ms)
- [CVE-2022-36046](https://cve.now/CVE-2022-36046.md): Unexpected server crash in Next.js version 12.2.3 (CVSS 5.3, vercel next.js · next +1)
- [CVE-2022-23646](https://cve.now/CVE-2022-23646.md): Improper CSP in Image Optimization API for Next.js (CVSS 5.9, vercel next.js · next)
- [CVE-2022-21721](https://cve.now/CVE-2022-21721.md): DOS Vulnerability in next.js (CVSS 5.9, next)
- [CVE-2021-43803](https://cve.now/CVE-2021-43803.md): Unexpected server crash in Next.js (CVSS 7.5, vercel next.js · next)
- [CVE-2021-39178](https://cve.now/CVE-2021-39178.md): XSS in Image Optimization API for Next.js versions between 10.0.0 and 11.1.0 (CVSS 7.5, vercel next.js · next)
- [CVE-2021-37699](https://cve.now/CVE-2021-37699.md): Open Redirect in Next.js versions below 11.1.0 (CVSS 6.9, vercel next.js · next)
- [CVE-2020-15242](https://cve.now/CVE-2020-15242.md): Open Redirect in Next.js (CVSS 4.7, vercel next.js · next)
- [CVE-2020-5284](https://cve.now/CVE-2020-5284.md): Directory Traversal in Next.js versions below 9.3.2 (CVSS 4.4, zeit next.js · next)
- [CVE-2018-18282](https://cve.now/CVE-2018-18282.md): Next.js 7.0.0 and 7.0.1 has XSS via the 404 or 500 /\_error page. (no CVSS, next)
- [CVE-2018-6184](https://cve.now/CVE-2018-6184.md): ZEIT Next.js 4 before 4.2.3 has Directory Traversal under the /\_next request namespace. (no CVSS, next)
- [CVE-2017-16877](https://cve.now/CVE-2017-16877.md): ZEIT Next.js before 2.4.1 has directory traversal under the /\_next and /static request namespace, allowing attackers to obtain sensitive inf (no CVSS, next)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/tech/nextjs
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.