Vercel vulnerabilities
76 CVEs and advisories name Vercel as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-44581Next.js: Cross-site scripting in App Router applications using CSP nonces
- CVE-2026-44580Next.js: Cross-site scripting in beforeInteractive scripts with untrusted input
- CVE-2026-44579Next.js: Denial of Service via connection exhaustion in applications using Cache Components
- CVE-2026-44578Next.js: Server-side request forgery in applications using WebSocket upgrades
- CVE-2026-44577Next.js: Denial of Service in the Image Optimization API
- CVE-2026-44576Next.js: Cache poisoning in React Server Component responses
- CVE-2026-44574Next.js: Middleware / Proxy bypass through dynamic route parameter injection
- CVE-2026-44575Next.js: Middleware / Proxy bypass in App Router applications via segment-prefetch routes
- CVE-2026-44573Next.js: Middleware / Proxy bypass in Pages Router applications using i18n
- CVE-2026-44572Next.js: Middleware / Proxy redirects can be cache-poisoned
- CVE-2026-44479Vercel: Non-interactive mode includes CLI arguments in suggested command output
- CVE-2026-29057Next.js: HTTP request smuggling in rewrites
- CVE-2026-27980Next.js: Unbounded next/image disk cache growth can exhaust storage
- CVE-2026-27979Next.js: Unbounded postponed resume buffering can lead to DoS
- CVE-2026-27978Next.js: null origin can bypass Server Actions CSRF checks
- CVE-2026-27977Next.js: null origin can bypass dev HMR websocket CSRF checks
- CVE-2025-59472A denial of service vulnerability exists in Next.js versions with Partial Prerendering (PPR) enabled when running in minimal mode.
- CVE-2025-59471A denial of service vulnerability exists in self-hosted Next.js applications that have `remotePatterns` configured for the Image Optimizer.
- CVE-2025-48985A vulnerability in Vercel’s AI SDK has been fixed in versions 5.0.52, 5.1.0-beta.9, and 6.0.0-beta.
- CVE-2025-52662A vulnerability in Nuxt DevTools has been fixed in version **2.6.4***.
- CVE-2025-57752Next.js Affected by Cache Key Confusion for Image Optimization API Routes
- CVE-2025-55173Next.js Content Injection Vulnerability for Image Optimization
- CVE-2025-57822Next.js Improper Middleware Redirect Handling Leads to SSRF
- CVE-2025-7074vercel hyper rimraf-standalone.js ignoreMap redos
- CVE-2025-49826Next.js DoS vulnerability via cache poisoning
- CVE-2025-49005Next.js cache poisoning due to omission of Vary header
- CVE-2025-48068Information exposure in Next.js dev server due to lack of origin verification
- CVE-2025-32421Next.js Race Condition to Cache Poisoning
- CVE-2025-46332Information Disclosure via Flags override link
- CVE-2025-30218Next.js may leak x-middleware-subrequest-id to external hosts