CVE-2025-59472
Next.js has Unbounded Memory Consumption via PPR Resume Endpoint
A denial of service vulnerability exists in Next.js versions with Partial Prerendering (PPR) enabled when running in minimal mode. The PPR resume endpoint accepts unauthenticated POST requests with the Next-Resume: 1 header and processes attacker-controlled postponed state data. Two closely related vulnerabilities allow an attacker to crash the server process through memory exhaustion:
-
Unbounded request body buffering: The server buffers the entire POST request body into memory using
Buffer.concat()without enforcing any size limit, allowing arbitrarily large payloads to exhaust available memory. -
Unbounded decompression (zipbomb): The resume data cache is decompressed using
inflateSync()without limiting the decompressed output size. A small compressed payload can expand to hundreds of megabytes or gigabytes, causing memory exhaustion.
Both attack vectors result in a fatal V8 out-of-memory error (FATAL ERROR: Reached heap limit Allocation failed - JavaScript heap out of memory) causing the Node.js process to terminate. The zipbomb variant is particularly dangerous as it can bypass reverse proxy request size limits while still causing large memory allocation on the server.
To be affected you must have an application running with experimental.ppr: true or cacheComponents: true configured along with the NEXT_PRIVATE_MINIMAL_MODE=1 environment variable.
Strongly consider upgrading to 15.6.0-canary.61 or 16.1.5 to reduce risk and prevent availability issues in Next applications.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
A denial of service vulnerability exists in Next.js versions with Partial Prerendering (PPR) enabled when running in minimal mode. The PPR resume endpoint accepts unauthenticated POST requests with the Next-Resume: 1 header and processes attacker-controlled postponed state data. Two closely related vulnerabilities allow an attacker to crash the server process through memory exhaustion:
-
Unbounded request body buffering: The server buffers the entire POST request body into memory using
Buffer.concat()without enforcing any size limit, allowing arbitrarily large payloads to exhaust available memory. -
Unbounded decompression (zipbomb): The resume data cache is decompressed using
inflateSync()without limiting the decompressed output size. A small compressed payload can expand to hundreds of megabytes or gigabytes, causing memory exhaustion.
Both attack vectors result in a fatal V8 out-of-memory error (FATAL ERROR: Reached heap limit Allocation failed - JavaScript heap out of memory) causing the Node.js process to terminate. The zipbomb variant is particularly dangerous as it can bypass reverse proxy request size limits while still causing large memory allocation on the server.
To be affected you must have an application running with experimental.ppr: true or cacheComponents: true configured along with the NEXT_PRIVATE_MINIMAL_MODE=1 environment variable.
Strongly consider upgrading to 15.6.0-canary.61 or 16.1.5 to reduce risk and prevent availability issues in Next applications.
- Record
CVE-2025-59472- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
EUVDEUVD-2025-206333
A denial of service vulnerability exists in Next.js versions with Partial Prerendering (PPR) enabled when running in minimal mode. The PPR resume endpoint accepts unauthenticated POST requests with the Next-Resume: 1 header and processes attacker-controlled postponed state data. Two closely related vulnerabilities allow an attacker to crash the server process through memory exhaustion:
-
Unbounded request body buffering: The server buffers the entire POST request body into memory using
Buffer.concat()without enforcing any size limit, allowing arbitrarily large payloads to exhaust available memory. -
Unbounded decompression (zipbomb): The resume data cache is decompressed using
inflateSync()without limiting the decompressed output size. A small compressed payload can expand to hundreds of megabytes or gigabytes, causing memory exhaustion.
Both attack vectors result in a fatal V8 out-of-memory error (FATAL ERROR: Reached heap limit Allocation failed - JavaScript heap out of memory) causing the Node.js process to terminate. The zipbomb variant is particularly dangerous as it can bypass reverse proxy request size limits while still causing large memory allocation on the server.
To be affected you must have an application running with experimental.ppr: true or cacheComponents: true configured along with the NEXT_PRIVATE_MINIMAL_MODE=1 environment variable.
Strongly consider upgrading to 15.6.0-canary.61 or 16.1.5 to reduce risk and prevent availability issues in Next applications.
- Record
EUVD-2025-206333- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-5f7q-jpqc-wp7h
Next.js has Unbounded Memory Consumption via PPR Resume Endpoint
A denial of service vulnerability exists in Next.js versions with Partial Prerendering (PPR) enabled when running in minimal mode. The PPR resume endpoint accepts unauthenticated POST requests with the Next-Resume: 1 header and processes attacker-controlled postponed state data. Two closely related vulnerabilities allow an attacker to crash the server process through memory exhaustion:
-
Unbounded request body buffering: The server buffers the entire POST request body into memory using
Buffer.concat()without enforcing any size limit, allowing arbitrarily large payloads to exhaust available memory. -
Unbounded decompression (zipbomb): The resume data cache is decompressed using
inflateSync()without limiting the decompressed output size. A small compressed payload can expand to hundreds of megabytes or gigabytes, causing memory exhaustion.
Both attack vectors result in a fatal V8 out-of-memory error (FATAL ERROR: Reached heap limit Allocation failed - JavaScript heap out of memory) causing the Node.js process to terminate. The zipbomb variant is particularly dangerous as it can bypass reverse proxy request size limits while still causing large memory allocation on the server.
To be affected, an application must run with experimental.ppr: true or cacheComponents: true configured along with the NEXT_PRIVATE_MINIMAL_MODE=1 environment variable.
Strongly consider upgrading to 15.6.0-canary.61 or 16.1.5 to reduce risk and prevent availability issues in Next applications.
- Record
GHSA-5f7q-jpqc-wp7h- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400, CWE-409, CWE-770
- Updated
- 2026-11-02
GitHub AdvisoriesGHSA-8h8q-6873-q5fj
Next.js Vulnerable to Denial of Service with Server Components
A vulnerability affects certain React Server Components packages for versions 19.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. The issue is tracked upstream as CVE-2026-23870.
A specially crafted HTTP request can be sent to any App Router Server Function endpoint that, when deserialized, may trigger excessive CPU usage. This can result in denial of service in unpatched environments.
- Record
GHSA-8h8q-6873-q5fj- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-02
GitHub AdvisoriesGHSA-h25m-26qc-wcjf
Next.js HTTP request deserialization can lead to DoS when using insecure React Server Components
A vulnerability affects certain React Server Components packages for versions 19.0.x, 19.1.x, and 19.2.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. The issue is tracked upstream as CVE-2026-23864.
A specially crafted HTTP request can be sent to any App Router Server Function endpoint that, when deserialized, may trigger excessive CPU usage, out-of-memory exceptions, or server crashes. This can result in denial of service in unpatched environments.
- Record
GHSA-h25m-26qc-wcjf- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400, CWE-502
- Updated
- 2026-11-02
GitHub AdvisoriesGHSA-q4gf-8mx6-v5v3
Next.js has a Denial of Service with Server Components
A vulnerability affects certain React Server Components packages for versions 19.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. The issue is tracked upstream as CVE-2026-23869. You can read more about this advisory our this changelog.
A specially crafted HTTP request can be sent to any App Router Server Function endpoint that, when deserialized, may trigger excessive CPU usage. This can result in denial of service in unpatched environments.
- Record
GHSA-q4gf-8mx6-v5v3- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-02
Show 36 moreShow less
GitHub AdvisoriesGHSA-w37m-7fhw-fmv9
Next Server Actions Source Code Exposure
A vulnerability affects certain React packages for versions 19.0.0, 19.0.1, 19.1.0, 19.1.1, 19.1.2, 19.2.0, and 19.2.1 and frameworks that use the affected packages, including Next.js 15.x and 16.x using the App Router. The issue is tracked upstream as CVE-2025-55183.
A malicious HTTP request can be crafted and sent to any App Router endpoint that can return the compiled source code of Server Functions. This could reveal business logic, but would not expose secrets unless they were hardcoded directly into Server Function code.
- Record
GHSA-w37m-7fhw-fmv9- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-497, CWE-502, CWE-1395
- Updated
- 2026-11-02
NVD
A denial of service vulnerability exists in Next.js versions with Partial Prerendering (PPR) enabled when running in minimal mode. The PPR resume endpoint accepts unauthenticated POST requests with the Next-Resume: 1 header and processes attacker-controlled postponed state data. Two closely related vulnerabilities allow an attacker to crash the server process through memory exhaustion:
-
Unbounded request body buffering: The server buffers the entire POST request body into memory using
Buffer.concat()without enforcing any size limit, allowing arbitrarily large payloads to exhaust available memory. -
Unbounded decompression (zipbomb): The resume data cache is decompressed using
inflateSync()without limiting the decompressed output size. A small compressed payload can expand to hundreds of megabytes or gigabytes, causing memory exhaustion.
Both attack vectors result in a fatal V8 out-of-memory error (FATAL ERROR: Reached heap limit Allocation failed - JavaScript heap out of memory) causing the Node.js process to terminate. The zipbomb variant is particularly dangerous as it can bypass reverse proxy request size limits while still causing large memory allocation on the server.
To be affected you must have an application running with experimental.ppr: true or cacheComponents: true configured along with the NEXT_PRIVATE_MINIMAL_MODE=1 environment variable.
Strongly consider upgrading to 15.6.0-canary.61 or 16.1.5 to reduce risk and prevent availability issues in Next applications.
- Record
CVE-2025-59472- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
OSV
A denial of service vulnerability exists in Next.js versions with Partial Prerendering (PPR) enabled when running in minimal mode. The PPR resume endpoint accepts unauthenticated POST requests with the Next-Resume: 1 header and processes attacker-controlled postponed state data. Two closely related vulnerabilities allow an attacker to crash the server process through memory exhaustion:
-
Unbounded request body buffering: The server buffers the entire POST request body into memory using
Buffer.concat()without enforcing any size limit, allowing arbitrarily large payloads to exhaust available memory. -
Unbounded decompression (zipbomb): The resume data cache is decompressed using
inflateSync()without limiting the decompressed output size. A small compressed payload can expand to hundreds of megabytes or gigabytes, causing memory exhaustion.
Both attack vectors result in a fatal V8 out-of-memory error (FATAL ERROR: Reached heap limit Allocation failed - JavaScript heap out of memory) causing the Node.js process to terminate. The zipbomb variant is particularly dangerous as it can bypass reverse proxy request size limits while still causing large memory allocation on the server.
To be affected you must have an application running with experimental.ppr: true or cacheComponents: true configured along with the NEXT_PRIVATE_MINIMAL_MODE=1 environment variable.
Strongly consider upgrading to 15.6.0-canary.61 or 16.1.5 to reduce risk and prevent availability issues in Next applications.
- Record
CVE-2025-59472- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVGHSA-5f7q-jpqc-wp7h
Next.js has Unbounded Memory Consumption via PPR Resume Endpoint
A denial of service vulnerability exists in Next.js versions with Partial Prerendering (PPR) enabled when running in minimal mode. The PPR resume endpoint accepts unauthenticated POST requests with the Next-Resume: 1 header and processes attacker-controlled postponed state data. Two closely related vulnerabilities allow an attacker to crash the server process through memory exhaustion:
-
Unbounded request body buffering: The server buffers the entire POST request body into memory using
Buffer.concat()without enforcing any size limit, allowing arbitrarily large payloads to exhaust available memory. -
Unbounded decompression (zipbomb): The resume data cache is decompressed using
inflateSync()without limiting the decompressed output size. A small compressed payload can expand to hundreds of megabytes or gigabytes, causing memory exhaustion.
Both attack vectors result in a fatal V8 out-of-memory error (FATAL ERROR: Reached heap limit Allocation failed - JavaScript heap out of memory) causing the Node.js process to terminate. The zipbomb variant is particularly dangerous as it can bypass reverse proxy request size limits while still causing large memory allocation on the server.
To be affected, an application must run with experimental.ppr: true or cacheComponents: true configured along with the NEXT_PRIVATE_MINIMAL_MODE=1 environment variable.
Strongly consider upgrading to 15.6.0-canary.61 or 16.1.5 to reduce risk and prevent availability issues in Next applications.
- Record
GHSA-5f7q-jpqc-wp7h- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400, CWE-409, CWE-770
- Updated
- 2026-11-02
OSVGHSA-8h8q-6873-q5fj
Next.js Vulnerable to Denial of Service with Server Components
A vulnerability affects certain React Server Components packages for versions 19.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. The issue is tracked upstream as CVE-2026-23870.
A specially crafted HTTP request can be sent to any App Router Server Function endpoint that, when deserialized, may trigger excessive CPU usage. This can result in denial of service in unpatched environments.
- Record
GHSA-8h8q-6873-q5fj- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-02
OSVGHSA-h25m-26qc-wcjf
Next.js HTTP request deserialization can lead to DoS when using insecure React Server Components
A vulnerability affects certain React Server Components packages for versions 19.0.x, 19.1.x, and 19.2.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. The issue is tracked upstream as CVE-2026-23864.
A specially crafted HTTP request can be sent to any App Router Server Function endpoint that, when deserialized, may trigger excessive CPU usage, out-of-memory exceptions, or server crashes. This can result in denial of service in unpatched environments.
- Record
GHSA-h25m-26qc-wcjf- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400, CWE-502
- Updated
- 2026-11-02
OSVGHSA-q4gf-8mx6-v5v3
Next.js has a Denial of Service with Server Components
A vulnerability affects certain React Server Components packages for versions 19.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. The issue is tracked upstream as CVE-2026-23869. You can read more about this advisory our this changelog.
A specially crafted HTTP request can be sent to any App Router Server Function endpoint that, when deserialized, may trigger excessive CPU usage. This can result in denial of service in unpatched environments.
- Record
GHSA-q4gf-8mx6-v5v3- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-02
OSVGHSA-w37m-7fhw-fmv9
Next Server Actions Source Code Exposure
A vulnerability affects certain React packages for versions 19.0.0, 19.0.1, 19.1.0, 19.1.1, 19.1.2, 19.2.0, and 19.2.1 and frameworks that use the affected packages, including Next.js 15.x and 16.x using the App Router. The issue is tracked upstream as CVE-2025-55183.
A malicious HTTP request can be crafted and sent to any App Router endpoint that can return the compiled source code of Server Functions. This could reveal business logic, but would not expose secrets unless they were hardcoded directly into Server Function code.
- Record
GHSA-w37m-7fhw-fmv9- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-1395, CWE-497, CWE-502
- Updated
- 2026-11-02
OSVCLSA-2026-1786710099 No score
TuxCare security update for 22 packages (9 CVEs)
TuxCare rebuilt 22 packages to address 9 CVEs. Fixed in 16.0.6-tuxcare.6.
- Record
CLSA-2026-1786710099- Updated
- 2026-11-02
OSVCLSA-2026-1790894608 No score
TuxCare security update for 13 packages (1 CVE)
TuxCare rebuilt 13 packages to address 1 CVE. Fixed in 14.2.35-tuxcare.11.
- Record
CLSA-2026-1790894608- Updated
- 2026-11-02
OSVCLSA-2026-1792195720 No score
TuxCare security update for create-next-app (1 CVE)
TuxCare rebuilt create-next-app to address 1 CVE. Fixed in 14.2.35-tuxcare.11.
- Record
CLSA-2026-1792195720- Updated
- 2026-11-02
OSVCLSA-2026-1792195747 No score
TuxCare security update for create-next-app (9 CVEs)
TuxCare rebuilt create-next-app to address 9 CVEs. Fixed in 16.0.6-tuxcare.6.
- Record
CLSA-2026-1792195747- Updated
- 2026-11-02
OSVCLSA-2026-1792196709 No score
TuxCare security update for @next/eslint-plugin-next (1 CVE)
TuxCare rebuilt @next/eslint-plugin-next to address 1 CVE. Fixed in 14.2.35-tuxcare.11.
- Record
CLSA-2026-1792196709- Updated
- 2026-11-02
OSVCLSA-2026-1792196876 No score
TuxCare security update for @next/eslint-plugin-next (9 CVEs)
TuxCare rebuilt @next/eslint-plugin-next to address 9 CVEs. Fixed in 16.0.6-tuxcare.6.
- Record
CLSA-2026-1792196876- Updated
- 2026-11-02
OSVCLSA-2026-1792206280 No score
TuxCare security update for @next/bundle-analyzer (1 CVE)
TuxCare rebuilt @next/bundle-analyzer to address 1 CVE. Fixed in 14.2.35-tuxcare.11.
- Record
CLSA-2026-1792206280- Updated
- 2026-11-02
OSVCLSA-2026-1792206291 No score
TuxCare security update for @next/bundle-analyzer (9 CVEs)
TuxCare rebuilt @next/bundle-analyzer to address 9 CVEs. Fixed in 16.0.6-tuxcare.6.
- Record
CLSA-2026-1792206291- Updated
- 2026-11-02
OSVCLSA-2026-1792256965 No score
TuxCare security update for next-rspack (9 CVEs)
TuxCare rebuilt next-rspack to address 9 CVEs. Fixed in 16.0.6-tuxcare.6.
- Record
CLSA-2026-1792256965- Updated
- 2026-11-02
OSVCLSA-2026-1792272215 No score
TuxCare security update for @next/plugin-storybook (1 CVE)
TuxCare rebuilt @next/plugin-storybook to address 1 CVE. Fixed in 14.2.35-tuxcare.11.
- Record
CLSA-2026-1792272215- Updated
- 2026-11-02
OSVCLSA-2026-1792272245 No score
TuxCare security update for @next/plugin-storybook (9 CVEs)
TuxCare rebuilt @next/plugin-storybook to address 9 CVEs. Fixed in 16.0.6-tuxcare.6.
- Record
CLSA-2026-1792272245- Updated
- 2026-11-02
OSVCLSA-2026-1792292989 No score
TuxCare security update for @next/polyfill-module (1 CVE)
TuxCare rebuilt @next/polyfill-module to address 1 CVE. Fixed in 14.2.35-tuxcare.11.
- Record
CLSA-2026-1792292989- Updated
- 2026-11-02
OSVCLSA-2026-1792293015 No score
TuxCare security update for @next/polyfill-module (9 CVEs)
TuxCare rebuilt @next/polyfill-module to address 9 CVEs. Fixed in 16.0.6-tuxcare.6.
- Record
CLSA-2026-1792293015- Updated
- 2026-11-02
OSVCLSA-2026-1792304703 No score
TuxCare security update for @next/polyfill-nomodule (1 CVE)
TuxCare rebuilt @next/polyfill-nomodule to address 1 CVE. Fixed in 14.2.35-tuxcare.11.
- Record
CLSA-2026-1792304703- Updated
- 2026-11-02
OSVCLSA-2026-1792304740 No score
TuxCare security update for @next/polyfill-nomodule (9 CVEs)
TuxCare rebuilt @next/polyfill-nomodule to address 9 CVEs. Fixed in 16.0.6-tuxcare.6.
- Record
CLSA-2026-1792304740- Updated
- 2026-11-02
OSVCLSA-2026-1792326285 No score
TuxCare security update for @next/react-refresh-utils (1 CVE)
TuxCare rebuilt @next/react-refresh-utils to address 1 CVE. Fixed in 14.2.35-tuxcare.11.
- Record
CLSA-2026-1792326285- Updated
- 2026-11-02
OSVCLSA-2026-1792326308 No score
TuxCare security update for @next/react-refresh-utils (9 CVEs)
TuxCare rebuilt @next/react-refresh-utils to address 9 CVEs. Fixed in 16.0.6-tuxcare.6.
- Record
CLSA-2026-1792326308- Updated
- 2026-11-02
OSVCLSA-2026-1792338225 No score
TuxCare security update for @next/third-parties (1 CVE)
TuxCare rebuilt @next/third-parties to address 1 CVE. Fixed in 14.2.35-tuxcare.11.
- Record
CLSA-2026-1792338225- Updated
- 2026-11-02
OSVCLSA-2026-1792338234 No score
TuxCare security update for @next/third-parties (9 CVEs)
TuxCare rebuilt @next/third-parties to address 9 CVEs. Fixed in 16.0.6-tuxcare.6.
- Record
CLSA-2026-1792338234- Updated
- 2026-11-02
OSVCLSA-2026-1792346469 No score
TuxCare security update for @next/swc-linux-x64-gnu (9 CVEs)
TuxCare rebuilt @next/swc-linux-x64-gnu to address 9 CVEs. Fixed in 16.0.6-tuxcare.6.
- Record
CLSA-2026-1792346469- Updated
- 2026-11-02
OSVCLSA-2026-1792358578 No score
TuxCare security update for @next/codemod (1 CVE)
TuxCare rebuilt @next/codemod to address 1 CVE. Fixed in 14.2.35-tuxcare.11.
- Record
CLSA-2026-1792358578- Updated
- 2026-11-02
OSVCLSA-2026-1792358598 No score
TuxCare security update for @next/codemod (9 CVEs)
TuxCare rebuilt @next/codemod to address 9 CVEs. Fixed in 16.0.6-tuxcare.6.
- Record
CLSA-2026-1792358598- Updated
- 2026-11-02
OSVCLSA-2026-1792363970 No score
TuxCare security update for @next/mdx (1 CVE)
TuxCare rebuilt @next/mdx to address 1 CVE. Fixed in 14.2.35-tuxcare.11.
- Record
CLSA-2026-1792363970- Updated
- 2026-11-02
OSVCLSA-2026-1792364005 No score
TuxCare security update for @next/mdx (9 CVEs)
TuxCare rebuilt @next/mdx to address 9 CVEs. Fixed in 16.0.6-tuxcare.6.
- Record
CLSA-2026-1792364005- Updated
- 2026-11-02
OSVCLSA-2026-1792367390 No score
TuxCare security update for @next/swc-linux-arm64-gnu (9 CVEs)
TuxCare rebuilt @next/swc-linux-arm64-gnu to address 9 CVEs. Fixed in 16.0.6-tuxcare.6.
- Record
CLSA-2026-1792367390- Updated
- 2026-11-02
OSVROOT-APP-NPM-GHSA-8h8q-6873-q5fj No score
GHSA-8h8q-6873-q5fj in next - Patched by Root
Root has patched GHSA-8h8q-6873-q5fj in the next package for Root:npm. Multiple fixed versions available.
- Record
ROOT-APP-NPM-GHSA-8h8q-6873-q5fj- Updated
- 2026-11-02
OSVROOT-APP-NPM-GHSA-h25m-26qc-wcjf No score
GHSA-h25m-26qc-wcjf in next - Patched by Root
Root has patched GHSA-h25m-26qc-wcjf in the next package for Root:npm. Multiple fixed versions available.
- Record
ROOT-APP-NPM-GHSA-h25m-26qc-wcjf- Updated
- 2026-11-02
OSVROOT-APP-NPM-GHSA-q4gf-8mx6-v5v3 No score
GHSA-q4gf-8mx6-v5v3 in next - Patched by Root
Root has patched GHSA-q4gf-8mx6-v5v3 in the next package for Root:npm. Multiple fixed versions available.
- Record
ROOT-APP-NPM-GHSA-q4gf-8mx6-v5v3- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
nextnpm |
16.0.0-beta.0 up to 16.1.5 | 16.1.5 |
nextnpm |
15.6.0-canary.0 up to 15.6.0-canary.61 | 15.6.0-canary.61 |
nextnpm |
15.0.0-canary.0 to 15.0.0-canary.205 | None known |
nextnpm |
15.0.1-canary.0 to 15.0.1-canary.3 | None known |
nextnpm |
15.0.2-canary.0 to 15.0.2-canary.11 | None known |
nextnpm |
15.0.3-canary.0 to 15.0.3-canary.9 | None known |
nextnpm |
15.0.4-canary.0 to 15.0.4-canary.52 | None known |
nextnpm |
15.1.1-canary.0 to 15.1.1-canary.27 | None known |
nextnpm |
15.2.0-canary.0 to 15.2.0-canary.77 | None known |
nextnpm |
15.2.1-canary.0 to 15.2.1-canary.6 | None known |
Show 54 moreShow less
| Package | Affected | Fixed |
|---|---|---|
nextnpm |
15.2.2-canary.0 to 15.2.2-canary.7 | None known |
nextnpm |
15.3.0-canary.0 to 15.3.0-canary.46 | None known |
nextnpm |
15.3.1-canary.0 to 15.3.1-canary.15 | None known |
nextnpm |
15.4.0-canary.0 to 15.4.0-canary.130 | None known |
nextnpm |
15.4.2-canary.0 to 15.4.2-canary.56 | None known |
nextnpm |
15.5.1-canary.0 to 15.5.1-canary.39 | None known |
nextnpm |
13.0.0 up to 15.5.16 | 15.5.16 |
nextnpm |
16.0.0 up to 16.2.5 | 16.2.5 |
nextnpm |
13.0.0 up to 15.0.8 | 15.0.8 |
nextnpm |
15.1.1-canary.0 up to 15.1.12 | 15.1.12 |
nextnpm |
15.2.0-canary.0 up to 15.2.9 | 15.2.9 |
nextnpm |
15.3.0-canary.0 up to 15.3.9 | 15.3.9 |
nextnpm |
15.4.0-canary.0 up to 15.4.11 | 15.4.11 |
nextnpm |
15.5.1-canary.0 up to 15.5.10 | 15.5.10 |
nextnpm |
16.0.0-beta.0 up to 16.0.11 | 16.0.11 |
nextnpm |
16.1.0-canary.0 up to 16.1.5 | 16.1.5 |
nextnpm |
13.0.0 up to 15.5.15 | 15.5.15 |
nextnpm |
16.0.0-beta.0 up to 16.2.3 | 16.2.3 |
nextnpm |
15.0.0-canary.0 up to 15.0.6 | 15.0.6 |
nextnpm |
15.1.1-canary.0 up to 15.1.10 | 15.1.10 |
nextnpm |
15.2.0-canary.0 up to 15.2.7 | 15.2.7 |
nextnpm |
15.3.0-canary.0 up to 15.3.7 | 15.3.7 |
nextnpm |
15.4.0-canary.0 up to 15.4.9 | 15.4.9 |
nextnpm |
15.5.1-canary.0 up to 15.5.8 | 15.5.8 |
nextnpm |
15.6.0-canary.0 up to 15.6.0-canary.59 | 15.6.0-canary.59 |
nextnpm |
16.0.0-beta.0 up to 16.0.9 | 16.0.9 |
nextnpm |
16.1.0-canary.0 up to 16.1.0-canary.17 | 16.1.0-canary.17 |
create-next-appTuxCare:npm |
14.2.35-tuxcare.0 up to 14.2.35-tuxcare.11, plus listed versions 14.2.3514.2.35-tuxcare.1014.2.35-tuxcare.414.2.35-tuxcare.514.2.35-tuxcare.614.2.35-tuxcare.714.2.35-tuxcare.814.2.35-tuxcare.9 |
14.2.35-tuxcare.11 |
create-next-appTuxCare:npm From an advisory covering 5 CVEs |
16.0.6-tuxcare.0 up to 16.0.6-tuxcare.6, plus listed versions 16.0.616.0.6-tuxcare.316.0.6-tuxcare.416.0.6-tuxcare.5 |
16.0.6-tuxcare.6 |
@next/eslint-plugin-nextTuxCare:npm |
14.2.35-tuxcare.0 up to 14.2.35-tuxcare.11, plus listed versions 14.2.3514.2.35-tuxcare.1014.2.35-tuxcare.414.2.35-tuxcare.514.2.35-tuxcare.614.2.35-tuxcare.714.2.35-tuxcare.814.2.35-tuxcare.9 |
14.2.35-tuxcare.11 |
@next/eslint-plugin-nextTuxCare:npm From an advisory covering 5 CVEs |
16.0.6-tuxcare.0 up to 16.0.6-tuxcare.6, plus listed versions 16.0.616.0.6-tuxcare.316.0.6-tuxcare.416.0.6-tuxcare.5 |
16.0.6-tuxcare.6 |
@next/bundle-analyzerTuxCare:npm |
14.2.35-tuxcare.0 up to 14.2.35-tuxcare.11, plus listed versions 14.2.3514.2.35-tuxcare.1014.2.35-tuxcare.414.2.35-tuxcare.514.2.35-tuxcare.614.2.35-tuxcare.714.2.35-tuxcare.814.2.35-tuxcare.9 |
14.2.35-tuxcare.11 |
@next/bundle-analyzerTuxCare:npm From an advisory covering 5 CVEs |
16.0.6-tuxcare.0 up to 16.0.6-tuxcare.6, plus listed versions 16.0.616.0.6-tuxcare.316.0.6-tuxcare.416.0.6-tuxcare.5 |
16.0.6-tuxcare.6 |
next-rspackTuxCare:npm From an advisory covering 5 CVEs |
16.0.6-tuxcare.0 up to 16.0.6-tuxcare.6, plus listed versions 16.0.616.0.6-tuxcare.316.0.6-tuxcare.416.0.6-tuxcare.5 |
16.0.6-tuxcare.6 |
@next/plugin-storybookTuxCare:npm |
14.2.35-tuxcare.0 up to 14.2.35-tuxcare.11, plus listed versions 14.2.3514.2.35-tuxcare.1014.2.35-tuxcare.414.2.35-tuxcare.514.2.35-tuxcare.614.2.35-tuxcare.714.2.35-tuxcare.814.2.35-tuxcare.9 |
14.2.35-tuxcare.11 |
@next/plugin-storybookTuxCare:npm From an advisory covering 5 CVEs |
16.0.6-tuxcare.0 up to 16.0.6-tuxcare.6, plus listed versions 16.0.616.0.6-tuxcare.316.0.6-tuxcare.416.0.6-tuxcare.5 |
16.0.6-tuxcare.6 |
@next/polyfill-moduleTuxCare:npm |
14.2.35-tuxcare.0 up to 14.2.35-tuxcare.11, plus listed versions 14.2.3514.2.35-tuxcare.1014.2.35-tuxcare.414.2.35-tuxcare.514.2.35-tuxcare.614.2.35-tuxcare.714.2.35-tuxcare.814.2.35-tuxcare.9 |
14.2.35-tuxcare.11 |
@next/polyfill-moduleTuxCare:npm From an advisory covering 5 CVEs |
16.0.6-tuxcare.0 up to 16.0.6-tuxcare.6, plus listed versions 16.0.616.0.6-tuxcare.316.0.6-tuxcare.416.0.6-tuxcare.5 |
16.0.6-tuxcare.6 |
@next/polyfill-nomoduleTuxCare:npm |
14.2.35-tuxcare.0 up to 14.2.35-tuxcare.11, plus listed versions 14.2.3514.2.35-tuxcare.1014.2.35-tuxcare.414.2.35-tuxcare.514.2.35-tuxcare.614.2.35-tuxcare.714.2.35-tuxcare.814.2.35-tuxcare.9 |
14.2.35-tuxcare.11 |
@next/polyfill-nomoduleTuxCare:npm From an advisory covering 5 CVEs |
16.0.6-tuxcare.0 up to 16.0.6-tuxcare.6, plus listed versions 16.0.616.0.6-tuxcare.316.0.6-tuxcare.416.0.6-tuxcare.5 |
16.0.6-tuxcare.6 |
@next/react-refresh-utilsTuxCare:npm |
14.2.35-tuxcare.0 up to 14.2.35-tuxcare.11, plus listed versions 14.2.3514.2.35-tuxcare.1014.2.35-tuxcare.414.2.35-tuxcare.514.2.35-tuxcare.614.2.35-tuxcare.714.2.35-tuxcare.814.2.35-tuxcare.9 |
14.2.35-tuxcare.11 |
@next/react-refresh-utilsTuxCare:npm From an advisory covering 5 CVEs |
16.0.6-tuxcare.0 up to 16.0.6-tuxcare.6, plus listed versions 16.0.616.0.6-tuxcare.316.0.6-tuxcare.416.0.6-tuxcare.5 |
16.0.6-tuxcare.6 |
@next/third-partiesTuxCare:npm |
14.2.35-tuxcare.0 up to 14.2.35-tuxcare.11, plus listed versions 14.2.3514.2.35-tuxcare.1014.2.35-tuxcare.414.2.35-tuxcare.514.2.35-tuxcare.614.2.35-tuxcare.714.2.35-tuxcare.814.2.35-tuxcare.9 |
14.2.35-tuxcare.11 |
@next/third-partiesTuxCare:npm From an advisory covering 5 CVEs |
16.0.6-tuxcare.0 up to 16.0.6-tuxcare.6, plus listed versions 16.0.616.0.6-tuxcare.316.0.6-tuxcare.416.0.6-tuxcare.5 |
16.0.6-tuxcare.6 |
@next/swc-linux-x64-gnuTuxCare:npm From an advisory covering 5 CVEs |
16.0.6-tuxcare.0 up to 16.0.6-tuxcare.6, plus listed versions 16.0.616.0.6-tuxcare.316.0.6-tuxcare.416.0.6-tuxcare.5 |
16.0.6-tuxcare.6 |
@next/codemodTuxCare:npm |
14.2.35-tuxcare.0 up to 14.2.35-tuxcare.11, plus listed versions 14.2.3514.2.35-tuxcare.1014.2.35-tuxcare.414.2.35-tuxcare.514.2.35-tuxcare.614.2.35-tuxcare.714.2.35-tuxcare.814.2.35-tuxcare.9 |
14.2.35-tuxcare.11 |
@next/codemodTuxCare:npm From an advisory covering 5 CVEs |
16.0.6-tuxcare.0 up to 16.0.6-tuxcare.6, plus listed versions 16.0.616.0.6-tuxcare.316.0.6-tuxcare.416.0.6-tuxcare.5 |
16.0.6-tuxcare.6 |
@next/mdxTuxCare:npm |
14.2.35-tuxcare.0 up to 14.2.35-tuxcare.11, plus listed versions 14.2.3514.2.35-tuxcare.1014.2.35-tuxcare.414.2.35-tuxcare.514.2.35-tuxcare.614.2.35-tuxcare.714.2.35-tuxcare.814.2.35-tuxcare.9 |
14.2.35-tuxcare.11 |
@next/mdxTuxCare:npm From an advisory covering 5 CVEs |
16.0.6-tuxcare.0 up to 16.0.6-tuxcare.6, plus listed versions 16.0.616.0.6-tuxcare.316.0.6-tuxcare.416.0.6-tuxcare.5 |
16.0.6-tuxcare.6 |
@next/swc-linux-arm64-gnuTuxCare:npm From an advisory covering 5 CVEs |
16.0.6-tuxcare.0 up to 16.0.6-tuxcare.6, plus listed versions 16.0.616.0.6-tuxcare.316.0.6-tuxcare.416.0.6-tuxcare.5 |
16.0.6-tuxcare.6 |
nextRoot:npm |
before 14.2.5-aikido.5 | 14.2.5-aikido.514.2.5-aikido.814.2.35-aikido.914.2.30-aikido.714.2.26-aikido.614.2.26-aikido.414.2.30-aikido.1013.4.19-aikido.613.4.19-aikido.714.2.10-aikido.314.2.13-aikido.314.0.4-aikido.614.2.3-aikido.114.0.4-aikido.914.2.24-aikido.214.2.25-aikido.214.1.0-aikido.414.2.18-aikido.213.3.0-aikido.514.0.4-aikido.514.0.4-aikido.714.0.4-aikido.214.1.0-aikido.714.1.0-aikido.814.0.4-aikido.314.2.13-aikido.114.2.3-aikido.514.2.0-aikido.214.0.3-aikido.314.2.5-aikido.914.2.5-aikido.1014.2.2-aikido.714.2.10-aikido.114.2.29-aikido.514.2.31-aikido.214.2.18-aikido.114.0.0-aikido.714.2.10-aikido.414.2.13-aikido.414.2.10-aikido.214.2.18-aikido.614.2.21-aikido.614.2.16-aikido.614.1.4-aikido.514.2.25-aikido.113.2.4-aikido.314.2.0-aikido.614.0.4-aikido.414.2.31-aikido.514.2.0-aikido.514.2.2-aikido.914.2.30-aikido.813.1.6-aikido.113.2.4-aikido.414.0.3-aikido.614.0.0-aikido.514.2.5-aikido.214.2.5-aikido.314.2.3-aikido.313.5.11-aikido.713.5.4-aikido.514.2.5-aikido.413.3.0-aikido.614.2.30-aikido.314.0.3-aikido.414.2.13-aikido.214.2.5-aikido.614.2.21-aikido.414.0.0-aikido.314.1.4-aikido.714.2.21-aikido.214.2.16-aikido.214.2.16-aikido.413.5.4-aikido.214.2.30-aikido.413.2.4-aikido.513.3.0-aikido.714.2.26-aikido.314.0.3-aikido.514.2.30-aikido.915.5.10-aikido.414.1.4-aikido.813.5.4-aikido.614.2.16-aikido.514.0.0-aikido.614.2.21-aikido.514.2.5-aikido.714.2.3-aikido.414.2.2-aikido.813.4.19-aikido.414.2.15-aikido.514.2.30-aikido.514.2.3-aikido.215.5.10-aikido.514.2.28-aikido.514.1.4-aikido.913.2.4-aikido.216.1.6-aikido.416.1.7-aikido.113.5.6-aikido.514.2.15-aikido.616.1.6-aikido.515.5.15-aikido.214.1.3-aikido.813.2.4-aikido.714.2.32-aikido.814.2.29-aikido.414.2.33-aikido.513.5.6-aikido.613.5.11-aikido.814.2.26-aikido.515.5.10-aikido.614.2.26-aikido.214.0.4-aikido.814.2.28-aikido.314.2.31-aikido.314.1.4-aikido.614.2.18-aikido.313.3.0-aikido.414.1.0-aikido.516.1.7-aikido.214.2.16-aikido.314.0.0-aikido.414.1.0-aikido.313.5.11-aikido.614.2.18-aikido.413.5.4-aikido.314.2.31-aikido.114.1.4-aikido.314.2.0-aikido.313.4.19-aikido.515.5.15-aikido.316.1.6-aikido.614.2.31-aikido.414.1.4-aikido.413.5.4-aikido.415.5.15-aikido.416.1.6-aikido.716.1.7-aikido.313.3.0-aikido.813.1.6-aikido.214.2.21-aikido.313.2.4-aikido.613.5.11-aikido.914.2.0-aikido.414.2.30-aikido.614.2.28-aikido.414.2.33-aikido.614.1.0-aikido.615.5.10-aikido.316.1.6-aikido.814.2.18-aikido.513.5.6-aikido.714.2.35-aikido.1014.2.35-aikido.1116.2.5-aikido.116.2.5-aikido.316.2.5-aikido.214.2.33-aikido.214.2.32-aikido.414.2.15-aikido.414.1.3-aikido.214.2.15-aikido.314.2.32-aikido.114.2.33-aikido.114.1.3-aikido.514.2.29-aikido.114.2.32-aikido.514.2.33-aikido.314.2.2-aikido.514.2.2-aikido.614.2.30-aikido.114.2.30-aikido.214.1.3-aikido.614.2.35-aikido.514.2.33-aikido.414.2.35-aikido.314.2.32-aikido.614.2.35-aikido.614.1.3-aikido.714.2.32-aikido.214.2.32-aikido.714.2.28-aikido.114.2.35-aikido.214.2.28-aikido.214.2.35-aikido.714.0.0-aikido.214.2.29-aikido.214.2.21-aikido.114.2.16-aikido.114.1.3-aikido.314.2.32-aikido.314.2.29-aikido.314.1.3-aikido.414.2.35-aikido.814.2.35-aikido.414.2.35-aikido.1 |
@rootio/nextRoot:npm |
before 14.2.5-root.io.5 | 14.2.5-root.io.514.2.5-root.io.814.2.35-root.io.914.2.30-root.io.714.2.26-root.io.614.2.26-root.io.414.2.30-root.io.1013.4.19-root.io.613.4.19-root.io.714.2.10-root.io.314.2.13-root.io.314.0.4-root.io.614.2.3-root.io.114.0.4-root.io.914.2.25-root.io.214.2.24-root.io.214.1.0-root.io.414.2.18-root.io.213.3.0-root.io.514.0.4-root.io.514.0.4-root.io.714.0.4-root.io.214.1.0-root.io.714.1.0-root.io.814.0.4-root.io.314.2.13-root.io.114.2.3-root.io.514.2.0-root.io.214.0.3-root.io.314.2.5-root.io.914.2.5-root.io.1014.2.2-root.io.714.2.10-root.io.114.2.29-root.io.514.2.31-root.io.214.2.18-root.io.114.0.0-root.io.714.2.10-root.io.414.2.13-root.io.414.2.10-root.io.214.2.18-root.io.614.2.21-root.io.614.2.16-root.io.614.1.4-root.io.514.2.25-root.io.113.2.4-root.io.314.2.0-root.io.614.0.4-root.io.414.2.31-root.io.514.2.0-root.io.514.2.2-root.io.914.2.30-root.io.813.1.6-root.io.113.2.4-root.io.414.0.3-root.io.614.0.0-root.io.514.2.5-root.io.214.2.5-root.io.315.5.15-root.io.116.1.6-root.io.314.2.3-root.io.313.5.4-root.io.513.5.11-root.io.714.2.5-root.io.413.3.0-root.io.614.2.30-root.io.314.0.3-root.io.414.2.13-root.io.214.2.5-root.io.614.2.21-root.io.414.0.0-root.io.314.1.4-root.io.714.2.21-root.io.214.2.16-root.io.214.2.16-root.io.413.5.4-root.io.214.2.30-root.io.413.2.4-root.io.513.3.0-root.io.714.2.26-root.io.314.0.3-root.io.514.2.30-root.io.915.5.10-root.io.414.1.4-root.io.813.5.4-root.io.614.2.16-root.io.514.0.0-root.io.614.2.21-root.io.514.2.5-root.io.714.2.3-root.io.414.2.2-root.io.813.4.19-root.io.414.2.15-root.io.514.2.30-root.io.514.2.3-root.io.215.5.10-root.io.514.2.28-root.io.514.1.4-root.io.913.2.4-root.io.216.1.6-root.io.416.1.7-root.io.113.5.6-root.io.514.2.15-root.io.616.1.6-root.io.513.2.4-root.io.715.5.15-root.io.214.1.3-root.io.814.2.32-root.io.814.2.29-root.io.414.2.33-root.io.513.5.6-root.io.613.5.11-root.io.814.2.26-root.io.515.5.10-root.io.614.2.26-root.io.214.0.4-root.io.814.2.28-root.io.314.2.31-root.io.314.1.4-root.io.614.2.18-root.io.313.3.0-root.io.414.1.0-root.io.516.1.7-root.io.214.2.16-root.io.314.0.0-root.io.414.1.0-root.io.313.5.11-root.io.614.2.18-root.io.413.5.4-root.io.314.2.31-root.io.114.1.4-root.io.314.2.0-root.io.313.4.19-root.io.514.2.31-root.io.415.5.15-root.io.316.1.6-root.io.614.1.4-root.io.413.5.4-root.io.415.5.15-root.io.416.1.6-root.io.716.1.7-root.io.313.3.0-root.io.813.1.6-root.io.214.2.21-root.io.313.2.4-root.io.613.5.11-root.io.914.2.0-root.io.414.2.30-root.io.614.2.33-root.io.614.2.28-root.io.414.1.0-root.io.615.5.10-root.io.313.5.6-root.io.716.1.6-root.io.814.2.18-root.io.514.2.35-root.io.1014.2.35-root.io.1116.2.5-root.io.116.2.5-root.io.316.2.5-root.io.214.2.33-root.io.214.2.32-root.io.414.2.15-root.io.414.1.3-root.io.214.2.15-root.io.314.2.32-root.io.114.2.33-root.io.114.1.3-root.io.514.2.29-root.io.114.2.32-root.io.514.2.33-root.io.314.2.2-root.io.514.2.2-root.io.614.2.30-root.io.114.2.30-root.io.214.1.3-root.io.614.2.35-root.io.514.2.33-root.io.414.2.35-root.io.314.2.32-root.io.614.2.35-root.io.614.1.3-root.io.714.2.32-root.io.214.2.32-root.io.714.2.28-root.io.114.2.35-root.io.214.2.28-root.io.214.2.35-root.io.714.0.0-root.io.214.2.29-root.io.214.2.21-root.io.114.1.3-root.io.314.2.16-root.io.114.2.32-root.io.314.2.29-root.io.314.1.3-root.io.414.2.35-root.io.814.2.35-root.io.414.2.35-root.io.1 |
nextRoot:npm |
before 14.2.5-aikido.8 | 14.2.5-aikido.814.2.33-aikido.214.2.32-aikido.414.2.35-aikido.914.2.30-aikido.714.2.26-aikido.614.2.26-aikido.414.2.30-aikido.1013.4.19-aikido.613.4.19-aikido.714.2.10-aikido.314.2.13-aikido.314.0.4-aikido.614.0.4-aikido.913.4.19-aikido.214.1.3-aikido.214.2.24-aikido.214.2.25-aikido.214.1.0-aikido.413.3.0-aikido.513.4.19-aikido.314.0.4-aikido.514.0.4-aikido.714.1.0-aikido.714.1.0-aikido.814.2.32-aikido.114.2.3-aikido.514.0.3-aikido.314.2.5-aikido.914.2.5-aikido.1014.2.2-aikido.714.2.33-aikido.114.1.3-aikido.514.2.29-aikido.114.2.29-aikido.514.2.31-aikido.214.0.0-aikido.714.2.10-aikido.414.2.13-aikido.414.2.18-aikido.614.2.21-aikido.614.2.16-aikido.614.2.25-aikido.114.2.0-aikido.614.2.31-aikido.514.2.2-aikido.914.2.30-aikido.813.1.6-aikido.114.2.24-aikido.714.2.24-aikido.414.0.3-aikido.614.2.32-aikido.514.2.33-aikido.314.0.0-aikido.514.2.3-aikido.314.2.2-aikido.414.2.2-aikido.513.5.11-aikido.714.2.2-aikido.613.5.4-aikido.514.0.0-aikido.114.1.3-aikido.613.3.0-aikido.113.3.0-aikido.613.4.19-aikido.114.0.3-aikido.413.5.11-aikido.414.0.3-aikido.114.2.21-aikido.413.5.6-aikido.114.0.0-aikido.314.1.4-aikido.713.5.4-aikido.114.2.21-aikido.213.3.0-aikido.214.2.16-aikido.214.2.16-aikido.413.5.4-aikido.214.2.35-aikido.513.5.6-aikido.214.2.30-aikido.413.3.0-aikido.714.2.33-aikido.414.2.26-aikido.314.0.3-aikido.514.2.30-aikido.915.5.10-aikido.414.1.4-aikido.814.2.35-aikido.314.2.32-aikido.614.2.35-aikido.613.5.4-aikido.614.2.24-aikido.514.1.3-aikido.714.2.16-aikido.514.0.0-aikido.614.2.21-aikido.514.2.3-aikido.414.2.2-aikido.813.4.19-aikido.414.2.15-aikido.514.2.30-aikido.514.2.3-aikido.213.5.6-aikido.313.5.6-aikido.415.5.10-aikido.514.2.28-aikido.514.2.24-aikido.114.2.32-aikido.214.1.4-aikido.916.1.6-aikido.414.1.3-aikido.116.1.7-aikido.113.3.0-aikido.314.2.32-aikido.713.5.6-aikido.514.2.15-aikido.616.1.6-aikido.514.1.3-aikido.813.2.4-aikido.714.2.32-aikido.814.2.29-aikido.414.2.35-aikido.214.2.33-aikido.513.5.6-aikido.613.5.11-aikido.814.2.26-aikido.515.5.10-aikido.614.0.4-aikido.814.2.28-aikido.314.2.31-aikido.314.2.24-aikido.614.1.4-aikido.614.2.35-aikido.714.2.18-aikido.313.3.0-aikido.414.1.0-aikido.516.1.7-aikido.214.2.16-aikido.314.0.0-aikido.413.5.11-aikido.514.1.0-aikido.313.5.11-aikido.614.2.18-aikido.413.5.4-aikido.313.4.19-aikido.514.0.0-aikido.216.1.6-aikido.614.2.31-aikido.414.2.29-aikido.213.5.4-aikido.414.2.21-aikido.116.1.6-aikido.716.1.7-aikido.314.1.3-aikido.313.3.0-aikido.814.2.24-aikido.313.1.6-aikido.214.2.21-aikido.314.2.32-aikido.314.2.29-aikido.313.5.11-aikido.914.0.3-aikido.214.1.3-aikido.414.2.30-aikido.614.2.28-aikido.414.2.33-aikido.614.1.0-aikido.614.2.35-aikido.814.2.35-aikido.415.5.10-aikido.316.1.6-aikido.814.2.18-aikido.513.5.6-aikido.714.2.35-aikido.1014.2.35-aikido.1115.5.15-aikido.215.5.15-aikido.315.5.15-aikido.4 |
@rootio/nextRoot:npm |
before 14.2.5-root.io.8 | 14.2.5-root.io.814.2.33-root.io.214.2.32-root.io.414.2.35-root.io.914.2.30-root.io.714.2.26-root.io.614.2.26-root.io.414.2.30-root.io.1013.4.19-root.io.613.4.19-root.io.714.2.10-root.io.314.2.13-root.io.314.0.4-root.io.614.0.4-root.io.913.4.19-root.io.214.1.3-root.io.214.2.25-root.io.214.2.24-root.io.214.1.0-root.io.413.3.0-root.io.514.0.4-root.io.513.4.19-root.io.314.0.4-root.io.714.1.0-root.io.714.1.0-root.io.814.2.32-root.io.114.2.3-root.io.514.0.3-root.io.314.2.5-root.io.914.2.5-root.io.1014.2.2-root.io.714.2.33-root.io.114.1.3-root.io.514.2.29-root.io.114.2.29-root.io.514.2.31-root.io.214.0.0-root.io.714.2.10-root.io.414.2.13-root.io.414.2.18-root.io.614.2.21-root.io.614.2.16-root.io.614.2.25-root.io.114.2.0-root.io.614.2.31-root.io.514.2.2-root.io.914.2.30-root.io.813.1.6-root.io.114.2.24-root.io.714.2.24-root.io.414.0.3-root.io.614.2.32-root.io.514.2.33-root.io.314.0.0-root.io.516.1.6-root.io.116.1.6-root.io.216.1.6-root.io.314.2.3-root.io.314.2.2-root.io.413.5.4-root.io.514.2.2-root.io.513.5.11-root.io.714.2.2-root.io.614.0.0-root.io.114.1.3-root.io.613.3.0-root.io.113.3.0-root.io.613.4.19-root.io.114.0.3-root.io.413.5.11-root.io.414.0.3-root.io.114.2.21-root.io.413.5.6-root.io.114.0.0-root.io.314.1.4-root.io.713.5.4-root.io.114.2.21-root.io.213.3.0-root.io.214.2.16-root.io.214.2.16-root.io.413.5.4-root.io.214.2.35-root.io.513.5.6-root.io.214.2.30-root.io.413.3.0-root.io.714.2.33-root.io.414.2.26-root.io.314.0.3-root.io.514.2.30-root.io.915.5.10-root.io.414.1.4-root.io.814.2.35-root.io.314.2.32-root.io.614.2.35-root.io.613.5.4-root.io.614.2.24-root.io.514.1.3-root.io.714.2.16-root.io.514.0.0-root.io.614.2.21-root.io.514.2.3-root.io.414.2.2-root.io.813.4.19-root.io.414.2.15-root.io.514.2.30-root.io.514.2.3-root.io.213.5.6-root.io.313.5.6-root.io.415.5.10-root.io.514.2.28-root.io.514.2.24-root.io.114.2.32-root.io.214.1.4-root.io.916.1.6-root.io.414.1.3-root.io.116.1.7-root.io.113.3.0-root.io.314.2.32-root.io.713.5.6-root.io.514.2.15-root.io.616.1.6-root.io.513.2.4-root.io.714.1.3-root.io.814.2.32-root.io.814.2.29-root.io.414.2.33-root.io.514.2.35-root.io.213.5.6-root.io.613.5.11-root.io.814.2.26-root.io.515.5.10-root.io.614.0.4-root.io.814.2.28-root.io.314.2.24-root.io.614.2.31-root.io.314.2.35-root.io.714.1.4-root.io.614.2.18-root.io.313.3.0-root.io.414.1.0-root.io.516.1.7-root.io.214.2.16-root.io.314.0.0-root.io.413.5.11-root.io.514.1.0-root.io.313.5.11-root.io.614.2.18-root.io.413.5.4-root.io.313.4.19-root.io.514.0.0-root.io.214.2.31-root.io.416.1.6-root.io.614.2.29-root.io.213.5.4-root.io.414.2.21-root.io.114.1.3-root.io.316.1.6-root.io.716.1.7-root.io.313.3.0-root.io.814.2.24-root.io.313.1.6-root.io.214.2.21-root.io.314.2.32-root.io.314.2.29-root.io.313.5.11-root.io.914.0.3-root.io.214.1.3-root.io.414.2.30-root.io.614.2.33-root.io.614.2.28-root.io.414.1.0-root.io.614.2.35-root.io.814.2.35-root.io.415.5.10-root.io.313.5.6-root.io.716.1.6-root.io.814.2.18-root.io.514.2.35-root.io.1014.2.35-root.io.1115.5.15-root.io.115.5.15-root.io.215.5.15-root.io.315.5.15-root.io.4 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-59472 is a medium vulnerability (CVSS 5.9) in Vercel Next, published December 11, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.43%, the 37th percentile. Fixed in next 16.1.5.
References
github.com/vercel/next.js/security/advisories/GHSA-5f7q-jpqc-wp7h
nvd.nist.gov/vuln/detail/CVE-2025-59472
vercel.com/changelog/summaries-of-cve-2025-59471-and-cve-2025-59472
Show 17 moreShow less
nextjs.org/blog/security-update-2025-12-11
cve.org/CVERecord?id=CVE-2025-55183