Every CVE Search/ Get API key

CVE-2026-27978

Next.js: null origin can bypass Server Actions CSRF checks

5.3 MediumPublic exploitFix available

Next.js is a React framework for building full-stack web applications. Starting in version 16.0.1 and prior to version 16.1.7, origin: null was treated as a "missing" origin during Server Action CSRF validation. As a result, requests from opaque contexts (such as sandboxed iframes) could bypass origin verification instead of being validated as cross-origin requests. An attacker could induce a victim browser to submit Server Actions from a sandboxed context, potentially executing state-changing actions with victim credentials (CSRF). This is fixed in version 16.1.7 by treating 'null' as an explicit origin value and enforcing host/origin checks unless 'null' is explicitly allowlisted in experimental.serverActions.allowedOrigins. If upgrading is not immediately possible, add CSRF tokens for sensitive Server Actions, prefer SameSite=Strict on sensitive auth cookies, and/or do not allow 'null' in serverActions.allowedOrigins unless intentionally required and additionally protected.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Passive

What an attacker can affect

Confidentiality
None
Integrity
Low
Availability
None

Exploit likelihood

0.21%Up 0.2 points since Mar 18, 2026
90%50%10%1%

What each source reports

CVE List Score used 5.3

Next.js: null origin can bypass Server Actions CSRF checks

Next.js is a React framework for building full-stack web applications. Starting in version 16.0.1 and prior to version 16.1.7, origin: null was treated as a "missing" origin during Server Action CSRF validation. As a result, requests from opaque contexts (such as sandboxed iframes) could bypass origin verification instead of being validated as cross-origin requests. An attacker could induce a victim browser to submit Server Actions from a sandboxed context, potentially executing state-changing actions with victim credentials (CSRF). This is fixed in version 16.1.7 by treating 'null' as an explicit origin value and enforcing host/origin checks unless 'null' is explicitly allowlisted in experimental.serverActions.allowedOrigins. If upgrading is not immediately possible, add CSRF tokens for sensitive Server Actions, prefer SameSite=Strict on sensitive auth cookies, and/or do not allow 'null' in serverActions.allowedOrigins unless intentionally required and additionally protected.

Record
CVE-2026-27978
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-352
Updated
2026-11-02
EUVDEUVD-2026-12684 5.3

Next.js is a React framework for building full-stack web applications. Starting in version 16.0.1 and prior to version 16.1.7, origin: null was treated as a "missing" origin during Server Action CSRF validation. As a result, requests from opaque contexts (such as sandboxed iframes) could bypass origin verification instead of being validated as cross-origin requests. An attacker could induce a victim browser to submit Server Actions from a sandboxed context, potentially executing state-changing actions with victim credentials (CSRF). This is fixed in version 16.1.7 by treating 'null' as an explicit origin value and enforcing host/origin checks unless 'null' is explicitly allowlisted in experimental.serverActions.allowedOrigins. If upgrading is not immediately possible, add CSRF tokens for sensitive Server Actions, prefer SameSite=Strict on sensitive auth cookies, and/or do not allow 'null' in serverActions.allowedOrigins unless intentionally required and additionally protected.

Record
EUVD-2026-12684
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-8h8q-6873-q5fj 7.5

Next.js Vulnerable to Denial of Service with Server Components

A vulnerability affects certain React Server Components packages for versions 19.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. The issue is tracked upstream as CVE-2026-23870.

A specially crafted HTTP request can be sent to any App Router Server Function endpoint that, when deserialized, may trigger excessive CPU usage. This can result in denial of service in unpatched environments.

Record
GHSA-8h8q-6873-q5fj
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-770
Updated
2026-11-02
GitHub AdvisoriesGHSA-h25m-26qc-wcjf 7.5

Next.js HTTP request deserialization can lead to DoS when using insecure React Server Components

A vulnerability affects certain React Server Components packages for versions 19.0.x, 19.1.x, and 19.2.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. The issue is tracked upstream as CVE-2026-23864.

A specially crafted HTTP request can be sent to any App Router Server Function endpoint that, when deserialized, may trigger excessive CPU usage, out-of-memory exceptions, or server crashes. This can result in denial of service in unpatched environments.

Record
GHSA-h25m-26qc-wcjf
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400, CWE-502
Updated
2026-11-02
GitHub AdvisoriesGHSA-mq59-m269-xvcx 5.3

Next.js: null origin can bypass Server Actions CSRF checks

Summary

origin: null was treated as a "missing" origin during Server Action CSRF validation. As a result, requests from opaque contexts (such as sandboxed iframes) could bypass origin verification instead of being validated as cross-origin requests.

Impact

An attacker could induce a victim browser to submit Server Actions from a sandboxed context, potentially executing state-changing actions with victim credentials (CSRF).

Patches

Fixed by treating 'null' as an explicit origin value and enforcing host/origin checks unless 'null' is explicitly allowlisted in experimental.serverActions.allowedOrigins.

Workarounds

If upgrade is not immediately possible:

  • Add CSRF tokens for sensitive Server Actions.
  • Prefer SameSite=Strict on sensitive auth cookies.
  • Do not allow 'null' in serverActions.allowedOrigins unless intentionally required and additionally protected.
Record
GHSA-mq59-m269-xvcx
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-352
Updated
2026-11-02
GitHub AdvisoriesGHSA-q4gf-8mx6-v5v3 7.5

Next.js has a Denial of Service with Server Components

A vulnerability affects certain React Server Components packages for versions 19.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. The issue is tracked upstream as CVE-2026-23869. You can read more about this advisory our this changelog.

A specially crafted HTTP request can be sent to any App Router Server Function endpoint that, when deserialized, may trigger excessive CPU usage. This can result in denial of service in unpatched environments.

Record
GHSA-q4gf-8mx6-v5v3
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-770
Updated
2026-11-02
Show 26 moreShow less
GitHub AdvisoriesGHSA-w37m-7fhw-fmv9 5.3

Next Server Actions Source Code Exposure

A vulnerability affects certain React packages for versions 19.0.0, 19.0.1, 19.1.0, 19.1.1, 19.1.2, 19.2.0, and 19.2.1 and frameworks that use the affected packages, including Next.js 15.x and 16.x using the App Router. The issue is tracked upstream as CVE-2025-55183.

A malicious HTTP request can be crafted and sent to any App Router endpoint that can return the compiled source code of Server Functions. This could reveal business logic, but would not expose secrets unless they were hardcoded directly into Server Function code.

Record
GHSA-w37m-7fhw-fmv9
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-497, CWE-502, CWE-1395
Updated
2026-11-02
NVD 5.3

Next.js is a React framework for building full-stack web applications. Starting in version 16.0.1 and prior to version 16.1.7, origin: null was treated as a "missing" origin during Server Action CSRF validation. As a result, requests from opaque contexts (such as sandboxed iframes) could bypass origin verification instead of being validated as cross-origin requests. An attacker could induce a victim browser to submit Server Actions from a sandboxed context, potentially executing state-changing actions with victim credentials (CSRF). This is fixed in version 16.1.7 by treating 'null' as an explicit origin value and enforcing host/origin checks unless 'null' is explicitly allowlisted in experimental.serverActions.allowedOrigins. If upgrading is not immediately possible, add CSRF tokens for sensitive Server Actions, prefer SameSite=Strict on sensitive auth cookies, and/or do not allow 'null' in serverActions.allowedOrigins unless intentionally required and additionally protected.

Record
CVE-2026-27978
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Weakness
CWE-352
Updated
2026-11-02
OSV 5.3

Next.js: null origin can bypass Server Actions CSRF checks

Next.js is a React framework for building full-stack web applications. Starting in version 16.0.1 and prior to version 16.1.7, origin: null was treated as a "missing" origin during Server Action CSRF validation. As a result, requests from opaque contexts (such as sandboxed iframes) could bypass origin verification instead of being validated as cross-origin requests. An attacker could induce a victim browser to submit Server Actions from a sandboxed context, potentially executing state-changing actions with victim credentials (CSRF). This is fixed in version 16.1.7 by treating 'null' as an explicit origin value and enforcing host/origin checks unless 'null' is explicitly allowlisted in experimental.serverActions.allowedOrigins. If upgrading is not immediately possible, add CSRF tokens for sensitive Server Actions, prefer SameSite=Strict on sensitive auth cookies, and/or do not allow 'null' in serverActions.allowedOrigins unless intentionally required and additionally protected.

Record
CVE-2026-27978
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-352
Updated
2026-11-02
OSVGHSA-8h8q-6873-q5fj 7.5

Next.js Vulnerable to Denial of Service with Server Components

A vulnerability affects certain React Server Components packages for versions 19.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. The issue is tracked upstream as CVE-2026-23870.

A specially crafted HTTP request can be sent to any App Router Server Function endpoint that, when deserialized, may trigger excessive CPU usage. This can result in denial of service in unpatched environments.

Record
GHSA-8h8q-6873-q5fj
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-770
Updated
2026-11-02
OSVGHSA-h25m-26qc-wcjf 7.5

Next.js HTTP request deserialization can lead to DoS when using insecure React Server Components

A vulnerability affects certain React Server Components packages for versions 19.0.x, 19.1.x, and 19.2.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. The issue is tracked upstream as CVE-2026-23864.

A specially crafted HTTP request can be sent to any App Router Server Function endpoint that, when deserialized, may trigger excessive CPU usage, out-of-memory exceptions, or server crashes. This can result in denial of service in unpatched environments.

Record
GHSA-h25m-26qc-wcjf
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400, CWE-502
Updated
2026-11-02
OSVGHSA-mq59-m269-xvcx 5.3

Next.js: null origin can bypass Server Actions CSRF checks

Summary

origin: null was treated as a "missing" origin during Server Action CSRF validation. As a result, requests from opaque contexts (such as sandboxed iframes) could bypass origin verification instead of being validated as cross-origin requests.

Impact

An attacker could induce a victim browser to submit Server Actions from a sandboxed context, potentially executing state-changing actions with victim credentials (CSRF).

Patches

Fixed by treating 'null' as an explicit origin value and enforcing host/origin checks unless 'null' is explicitly allowlisted in experimental.serverActions.allowedOrigins.

Workarounds

If upgrade is not immediately possible:

  • Add CSRF tokens for sensitive Server Actions.
  • Prefer SameSite=Strict on sensitive auth cookies.
  • Do not allow 'null' in serverActions.allowedOrigins unless intentionally required and additionally protected.
Record
GHSA-mq59-m269-xvcx
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-352
Updated
2026-11-02
OSVGHSA-q4gf-8mx6-v5v3 7.5

Next.js has a Denial of Service with Server Components

A vulnerability affects certain React Server Components packages for versions 19.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. The issue is tracked upstream as CVE-2026-23869. You can read more about this advisory our this changelog.

A specially crafted HTTP request can be sent to any App Router Server Function endpoint that, when deserialized, may trigger excessive CPU usage. This can result in denial of service in unpatched environments.

Record
GHSA-q4gf-8mx6-v5v3
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-770
Updated
2026-11-02
OSVGHSA-w37m-7fhw-fmv9 5.3

Next Server Actions Source Code Exposure

A vulnerability affects certain React packages for versions 19.0.0, 19.0.1, 19.1.0, 19.1.1, 19.1.2, 19.2.0, and 19.2.1 and frameworks that use the affected packages, including Next.js 15.x and 16.x using the App Router. The issue is tracked upstream as CVE-2025-55183.

A malicious HTTP request can be crafted and sent to any App Router endpoint that can return the compiled source code of Server Functions. This could reveal business logic, but would not expose secrets unless they were hardcoded directly into Server Function code.

Record
GHSA-w37m-7fhw-fmv9
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-1395, CWE-497, CWE-502
Updated
2026-11-02
OSVCLSA-2026-1786710099 No score

TuxCare security update for 22 packages (9 CVEs)

TuxCare rebuilt 22 packages to address 9 CVEs. Fixed in 16.0.6-tuxcare.6.

Record
CLSA-2026-1786710099
Updated
2026-11-02
OSVCLSA-2026-1792195747 No score

TuxCare security update for create-next-app (9 CVEs)

TuxCare rebuilt create-next-app to address 9 CVEs. Fixed in 16.0.6-tuxcare.6.

Record
CLSA-2026-1792195747
Updated
2026-11-02
OSVCLSA-2026-1792196876 No score

TuxCare security update for @next/eslint-plugin-next (9 CVEs)

TuxCare rebuilt @next/eslint-plugin-next to address 9 CVEs. Fixed in 16.0.6-tuxcare.6.

Record
CLSA-2026-1792196876
Updated
2026-11-02
OSVCLSA-2026-1792206291 No score

TuxCare security update for @next/bundle-analyzer (9 CVEs)

TuxCare rebuilt @next/bundle-analyzer to address 9 CVEs. Fixed in 16.0.6-tuxcare.6.

Record
CLSA-2026-1792206291
Updated
2026-11-02
OSVCLSA-2026-1792256965 No score

TuxCare security update for next-rspack (9 CVEs)

TuxCare rebuilt next-rspack to address 9 CVEs. Fixed in 16.0.6-tuxcare.6.

Record
CLSA-2026-1792256965
Updated
2026-11-02
OSVCLSA-2026-1792272245 No score

TuxCare security update for @next/plugin-storybook (9 CVEs)

TuxCare rebuilt @next/plugin-storybook to address 9 CVEs. Fixed in 16.0.6-tuxcare.6.

Record
CLSA-2026-1792272245
Updated
2026-11-02
OSVCLSA-2026-1792293015 No score

TuxCare security update for @next/polyfill-module (9 CVEs)

TuxCare rebuilt @next/polyfill-module to address 9 CVEs. Fixed in 16.0.6-tuxcare.6.

Record
CLSA-2026-1792293015
Updated
2026-11-02
OSVCLSA-2026-1792304740 No score

TuxCare security update for @next/polyfill-nomodule (9 CVEs)

TuxCare rebuilt @next/polyfill-nomodule to address 9 CVEs. Fixed in 16.0.6-tuxcare.6.

Record
CLSA-2026-1792304740
Updated
2026-11-02
OSVCLSA-2026-1792326308 No score

TuxCare security update for @next/react-refresh-utils (9 CVEs)

TuxCare rebuilt @next/react-refresh-utils to address 9 CVEs. Fixed in 16.0.6-tuxcare.6.

Record
CLSA-2026-1792326308
Updated
2026-11-02
OSVCLSA-2026-1792338234 No score

TuxCare security update for @next/third-parties (9 CVEs)

TuxCare rebuilt @next/third-parties to address 9 CVEs. Fixed in 16.0.6-tuxcare.6.

Record
CLSA-2026-1792338234
Updated
2026-11-02
OSVCLSA-2026-1792346469 No score

TuxCare security update for @next/swc-linux-x64-gnu (9 CVEs)

TuxCare rebuilt @next/swc-linux-x64-gnu to address 9 CVEs. Fixed in 16.0.6-tuxcare.6.

Record
CLSA-2026-1792346469
Updated
2026-11-02
OSVCLSA-2026-1792358598 No score

TuxCare security update for @next/codemod (9 CVEs)

TuxCare rebuilt @next/codemod to address 9 CVEs. Fixed in 16.0.6-tuxcare.6.

Record
CLSA-2026-1792358598
Updated
2026-11-02
OSVCLSA-2026-1792364005 No score

TuxCare security update for @next/mdx (9 CVEs)

TuxCare rebuilt @next/mdx to address 9 CVEs. Fixed in 16.0.6-tuxcare.6.

Record
CLSA-2026-1792364005
Updated
2026-11-02
OSVCLSA-2026-1792367390 No score

TuxCare security update for @next/swc-linux-arm64-gnu (9 CVEs)

TuxCare rebuilt @next/swc-linux-arm64-gnu to address 9 CVEs. Fixed in 16.0.6-tuxcare.6.

Record
CLSA-2026-1792367390
Updated
2026-11-02
OSVROOT-APP-NPM-CVE-2026-27978 No score

CVE-2026-27978 in next - Patched by Root

Root has patched CVE-2026-27978 in the next package for Root:npm. Multiple fixed versions available.

Record
ROOT-APP-NPM-CVE-2026-27978
Updated
2026-11-02
OSVROOT-APP-NPM-GHSA-8h8q-6873-q5fj No score

GHSA-8h8q-6873-q5fj in next - Patched by Root

Root has patched GHSA-8h8q-6873-q5fj in the next package for Root:npm. Multiple fixed versions available.

Record
ROOT-APP-NPM-GHSA-8h8q-6873-q5fj
Updated
2026-11-02
OSVROOT-APP-NPM-GHSA-h25m-26qc-wcjf No score

GHSA-h25m-26qc-wcjf in next - Patched by Root

Root has patched GHSA-h25m-26qc-wcjf in the next package for Root:npm. Multiple fixed versions available.

Record
ROOT-APP-NPM-GHSA-h25m-26qc-wcjf
Updated
2026-11-02
OSVROOT-APP-NPM-GHSA-q4gf-8mx6-v5v3 No score

GHSA-q4gf-8mx6-v5v3 in next - Patched by Root

Root has patched GHSA-q4gf-8mx6-v5v3 in the next package for Root:npm. Multiple fixed versions available.

Record
ROOT-APP-NPM-GHSA-q4gf-8mx6-v5v3
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
next
npm
 13.0.0 up to 15.5.16
15.5.16
next
npm
 16.0.0 up to 16.2.5
16.2.5
next
npm
 13.0.0 up to 15.0.8
15.0.8
next
npm
 15.1.1-canary.0 up to 15.1.12
15.1.12
next
npm
 15.2.0-canary.0 up to 15.2.9
15.2.9
next
npm
 15.3.0-canary.0 up to 15.3.9
15.3.9
next
npm
 15.4.0-canary.0 up to 15.4.11
15.4.11
next
npm
 15.5.1-canary.0 up to 15.5.10
15.5.10
next
npm
 15.6.0-canary.0 up to 15.6.0-canary.61
15.6.0-canary.61
next
npm
 16.0.0-beta.0 up to 16.0.11
16.0.11
Show 32 moreShow less
Affected packages
PackageAffectedFixed
next
npm
 16.1.0-canary.0 up to 16.1.5
16.1.5
next
npm
 16.0.1 up to 16.1.7
16.1.7
next
npm
 13.0.0 up to 15.5.15
15.5.15
next
npm
 16.0.0-beta.0 up to 16.2.3
16.2.3
next
npm
 15.0.0-canary.0 up to 15.0.6
15.0.6
next
npm
 15.1.1-canary.0 up to 15.1.10
15.1.10
next
npm
 15.2.0-canary.0 up to 15.2.7
15.2.7
next
npm
 15.3.0-canary.0 up to 15.3.7
15.3.7
next
npm
 15.4.0-canary.0 up to 15.4.9
15.4.9
next
npm
 15.5.1-canary.0 up to 15.5.8
15.5.8
next
npm
 15.6.0-canary.0 up to 15.6.0-canary.59
15.6.0-canary.59
next
npm
 16.0.0-beta.0 up to 16.0.9
16.0.9
next
npm
 16.1.0-canary.0 up to 16.1.0-canary.17
16.1.0-canary.17
create-next-app
TuxCare:npm
From an advisory covering 5 CVEs
 16.0.6-tuxcare.0 up to 16.0.6-tuxcare.6, plus listed versions
16.0.616.0.6-tuxcare.316.0.6-tuxcare.416.0.6-tuxcare.5
16.0.6-tuxcare.6
@next/eslint-plugin-next
TuxCare:npm
From an advisory covering 5 CVEs
 16.0.6-tuxcare.0 up to 16.0.6-tuxcare.6, plus listed versions
16.0.616.0.6-tuxcare.316.0.6-tuxcare.416.0.6-tuxcare.5
16.0.6-tuxcare.6
@next/bundle-analyzer
TuxCare:npm
From an advisory covering 5 CVEs
 16.0.6-tuxcare.0 up to 16.0.6-tuxcare.6, plus listed versions
16.0.616.0.6-tuxcare.316.0.6-tuxcare.416.0.6-tuxcare.5
16.0.6-tuxcare.6
next-rspack
TuxCare:npm
From an advisory covering 5 CVEs
 16.0.6-tuxcare.0 up to 16.0.6-tuxcare.6, plus listed versions
16.0.616.0.6-tuxcare.316.0.6-tuxcare.416.0.6-tuxcare.5
16.0.6-tuxcare.6
@next/plugin-storybook
TuxCare:npm
From an advisory covering 5 CVEs
 16.0.6-tuxcare.0 up to 16.0.6-tuxcare.6, plus listed versions
16.0.616.0.6-tuxcare.316.0.6-tuxcare.416.0.6-tuxcare.5
16.0.6-tuxcare.6
@next/polyfill-module
TuxCare:npm
From an advisory covering 5 CVEs
 16.0.6-tuxcare.0 up to 16.0.6-tuxcare.6, plus listed versions
16.0.616.0.6-tuxcare.316.0.6-tuxcare.416.0.6-tuxcare.5
16.0.6-tuxcare.6
@next/polyfill-nomodule
TuxCare:npm
From an advisory covering 5 CVEs
 16.0.6-tuxcare.0 up to 16.0.6-tuxcare.6, plus listed versions
16.0.616.0.6-tuxcare.316.0.6-tuxcare.416.0.6-tuxcare.5
16.0.6-tuxcare.6
@next/react-refresh-utils
TuxCare:npm
From an advisory covering 5 CVEs
 16.0.6-tuxcare.0 up to 16.0.6-tuxcare.6, plus listed versions
16.0.616.0.6-tuxcare.316.0.6-tuxcare.416.0.6-tuxcare.5
16.0.6-tuxcare.6
@next/third-parties
TuxCare:npm
From an advisory covering 5 CVEs
 16.0.6-tuxcare.0 up to 16.0.6-tuxcare.6, plus listed versions
16.0.616.0.6-tuxcare.316.0.6-tuxcare.416.0.6-tuxcare.5
16.0.6-tuxcare.6
@next/swc-linux-x64-gnu
TuxCare:npm
From an advisory covering 5 CVEs
 16.0.6-tuxcare.0 up to 16.0.6-tuxcare.6, plus listed versions
16.0.616.0.6-tuxcare.316.0.6-tuxcare.416.0.6-tuxcare.5
16.0.6-tuxcare.6
@next/codemod
TuxCare:npm
From an advisory covering 5 CVEs
 16.0.6-tuxcare.0 up to 16.0.6-tuxcare.6, plus listed versions
16.0.616.0.6-tuxcare.316.0.6-tuxcare.416.0.6-tuxcare.5
16.0.6-tuxcare.6
@next/mdx
TuxCare:npm
From an advisory covering 5 CVEs
 16.0.6-tuxcare.0 up to 16.0.6-tuxcare.6, plus listed versions
16.0.616.0.6-tuxcare.316.0.6-tuxcare.416.0.6-tuxcare.5
16.0.6-tuxcare.6
@next/swc-linux-arm64-gnu
TuxCare:npm
From an advisory covering 5 CVEs
 16.0.6-tuxcare.0 up to 16.0.6-tuxcare.6, plus listed versions
16.0.616.0.6-tuxcare.316.0.6-tuxcare.416.0.6-tuxcare.5
16.0.6-tuxcare.6
next
Root:npm
 before 16.1.6-aikido.5
16.1.6-aikido.516.1.6-aikido.616.1.6-aikido.716.1.6-aikido.816.1.7-aikido.116.1.7-aikido.216.1.7-aikido.3
@rootio/next
Root:npm
 before 16.1.6-root.io.5
16.1.6-root.io.516.1.6-root.io.616.1.6-root.io.716.1.6-root.io.816.1.7-root.io.116.1.7-root.io.216.1.7-root.io.3
next
Root:npm
 before 14.2.5-aikido.5
14.2.5-aikido.514.2.5-aikido.814.2.35-aikido.914.2.30-aikido.714.2.26-aikido.614.2.26-aikido.414.2.30-aikido.1013.4.19-aikido.613.4.19-aikido.714.2.10-aikido.314.2.13-aikido.314.0.4-aikido.614.2.3-aikido.114.0.4-aikido.914.2.24-aikido.214.2.25-aikido.214.1.0-aikido.414.2.18-aikido.213.3.0-aikido.514.0.4-aikido.514.0.4-aikido.714.0.4-aikido.214.1.0-aikido.714.1.0-aikido.814.0.4-aikido.314.2.13-aikido.114.2.3-aikido.514.2.0-aikido.214.0.3-aikido.314.2.5-aikido.914.2.5-aikido.1014.2.2-aikido.714.2.10-aikido.114.2.29-aikido.514.2.31-aikido.214.2.18-aikido.114.0.0-aikido.714.2.10-aikido.414.2.13-aikido.414.2.10-aikido.214.2.18-aikido.614.2.21-aikido.614.2.16-aikido.614.1.4-aikido.514.2.25-aikido.113.2.4-aikido.314.2.0-aikido.614.0.4-aikido.414.2.31-aikido.514.2.0-aikido.514.2.2-aikido.914.2.30-aikido.813.1.6-aikido.113.2.4-aikido.414.0.3-aikido.614.0.0-aikido.514.2.5-aikido.214.2.5-aikido.314.2.3-aikido.313.5.11-aikido.713.5.4-aikido.514.2.5-aikido.413.3.0-aikido.614.2.30-aikido.314.0.3-aikido.414.2.13-aikido.214.2.5-aikido.614.2.21-aikido.414.0.0-aikido.314.1.4-aikido.714.2.21-aikido.214.2.16-aikido.214.2.16-aikido.413.5.4-aikido.214.2.30-aikido.413.2.4-aikido.513.3.0-aikido.714.2.26-aikido.314.0.3-aikido.514.2.30-aikido.915.5.10-aikido.414.1.4-aikido.813.5.4-aikido.614.2.16-aikido.514.0.0-aikido.614.2.21-aikido.514.2.5-aikido.714.2.3-aikido.414.2.2-aikido.813.4.19-aikido.414.2.15-aikido.514.2.30-aikido.514.2.3-aikido.215.5.10-aikido.514.2.28-aikido.514.1.4-aikido.913.2.4-aikido.216.1.6-aikido.416.1.7-aikido.113.5.6-aikido.514.2.15-aikido.616.1.6-aikido.515.5.15-aikido.214.1.3-aikido.813.2.4-aikido.714.2.32-aikido.814.2.29-aikido.414.2.33-aikido.513.5.6-aikido.613.5.11-aikido.814.2.26-aikido.515.5.10-aikido.614.2.26-aikido.214.0.4-aikido.814.2.28-aikido.314.2.31-aikido.314.1.4-aikido.614.2.18-aikido.313.3.0-aikido.414.1.0-aikido.516.1.7-aikido.214.2.16-aikido.314.0.0-aikido.414.1.0-aikido.313.5.11-aikido.614.2.18-aikido.413.5.4-aikido.314.2.31-aikido.114.1.4-aikido.314.2.0-aikido.313.4.19-aikido.515.5.15-aikido.316.1.6-aikido.614.2.31-aikido.414.1.4-aikido.413.5.4-aikido.415.5.15-aikido.416.1.6-aikido.716.1.7-aikido.313.3.0-aikido.813.1.6-aikido.214.2.21-aikido.313.2.4-aikido.613.5.11-aikido.914.2.0-aikido.414.2.30-aikido.614.2.28-aikido.414.2.33-aikido.614.1.0-aikido.615.5.10-aikido.316.1.6-aikido.814.2.18-aikido.513.5.6-aikido.714.2.35-aikido.1014.2.35-aikido.1116.2.5-aikido.116.2.5-aikido.316.2.5-aikido.214.2.33-aikido.214.2.32-aikido.414.2.15-aikido.414.1.3-aikido.214.2.15-aikido.314.2.32-aikido.114.2.33-aikido.114.1.3-aikido.514.2.29-aikido.114.2.32-aikido.514.2.33-aikido.314.2.2-aikido.514.2.2-aikido.614.2.30-aikido.114.2.30-aikido.214.1.3-aikido.614.2.35-aikido.514.2.33-aikido.414.2.35-aikido.314.2.32-aikido.614.2.35-aikido.614.1.3-aikido.714.2.32-aikido.214.2.32-aikido.714.2.28-aikido.114.2.35-aikido.214.2.28-aikido.214.2.35-aikido.714.0.0-aikido.214.2.29-aikido.214.2.21-aikido.114.2.16-aikido.114.1.3-aikido.314.2.32-aikido.314.2.29-aikido.314.1.3-aikido.414.2.35-aikido.814.2.35-aikido.414.2.35-aikido.1
@rootio/next
Root:npm
 before 14.2.5-root.io.5
14.2.5-root.io.514.2.5-root.io.814.2.35-root.io.914.2.30-root.io.714.2.26-root.io.614.2.26-root.io.414.2.30-root.io.1013.4.19-root.io.613.4.19-root.io.714.2.10-root.io.314.2.13-root.io.314.0.4-root.io.614.2.3-root.io.114.0.4-root.io.914.2.25-root.io.214.2.24-root.io.214.1.0-root.io.414.2.18-root.io.213.3.0-root.io.514.0.4-root.io.514.0.4-root.io.714.0.4-root.io.214.1.0-root.io.714.1.0-root.io.814.0.4-root.io.314.2.13-root.io.114.2.3-root.io.514.2.0-root.io.214.0.3-root.io.314.2.5-root.io.914.2.5-root.io.1014.2.2-root.io.714.2.10-root.io.114.2.29-root.io.514.2.31-root.io.214.2.18-root.io.114.0.0-root.io.714.2.10-root.io.414.2.13-root.io.414.2.10-root.io.214.2.18-root.io.614.2.21-root.io.614.2.16-root.io.614.1.4-root.io.514.2.25-root.io.113.2.4-root.io.314.2.0-root.io.614.0.4-root.io.414.2.31-root.io.514.2.0-root.io.514.2.2-root.io.914.2.30-root.io.813.1.6-root.io.113.2.4-root.io.414.0.3-root.io.614.0.0-root.io.514.2.5-root.io.214.2.5-root.io.315.5.15-root.io.116.1.6-root.io.314.2.3-root.io.313.5.4-root.io.513.5.11-root.io.714.2.5-root.io.413.3.0-root.io.614.2.30-root.io.314.0.3-root.io.414.2.13-root.io.214.2.5-root.io.614.2.21-root.io.414.0.0-root.io.314.1.4-root.io.714.2.21-root.io.214.2.16-root.io.214.2.16-root.io.413.5.4-root.io.214.2.30-root.io.413.2.4-root.io.513.3.0-root.io.714.2.26-root.io.314.0.3-root.io.514.2.30-root.io.915.5.10-root.io.414.1.4-root.io.813.5.4-root.io.614.2.16-root.io.514.0.0-root.io.614.2.21-root.io.514.2.5-root.io.714.2.3-root.io.414.2.2-root.io.813.4.19-root.io.414.2.15-root.io.514.2.30-root.io.514.2.3-root.io.215.5.10-root.io.514.2.28-root.io.514.1.4-root.io.913.2.4-root.io.216.1.6-root.io.416.1.7-root.io.113.5.6-root.io.514.2.15-root.io.616.1.6-root.io.513.2.4-root.io.715.5.15-root.io.214.1.3-root.io.814.2.32-root.io.814.2.29-root.io.414.2.33-root.io.513.5.6-root.io.613.5.11-root.io.814.2.26-root.io.515.5.10-root.io.614.2.26-root.io.214.0.4-root.io.814.2.28-root.io.314.2.31-root.io.314.1.4-root.io.614.2.18-root.io.313.3.0-root.io.414.1.0-root.io.516.1.7-root.io.214.2.16-root.io.314.0.0-root.io.414.1.0-root.io.313.5.11-root.io.614.2.18-root.io.413.5.4-root.io.314.2.31-root.io.114.1.4-root.io.314.2.0-root.io.313.4.19-root.io.514.2.31-root.io.415.5.15-root.io.316.1.6-root.io.614.1.4-root.io.413.5.4-root.io.415.5.15-root.io.416.1.6-root.io.716.1.7-root.io.313.3.0-root.io.813.1.6-root.io.214.2.21-root.io.313.2.4-root.io.613.5.11-root.io.914.2.0-root.io.414.2.30-root.io.614.2.33-root.io.614.2.28-root.io.414.1.0-root.io.615.5.10-root.io.313.5.6-root.io.716.1.6-root.io.814.2.18-root.io.514.2.35-root.io.1014.2.35-root.io.1116.2.5-root.io.116.2.5-root.io.316.2.5-root.io.214.2.33-root.io.214.2.32-root.io.414.2.15-root.io.414.1.3-root.io.214.2.15-root.io.314.2.32-root.io.114.2.33-root.io.114.1.3-root.io.514.2.29-root.io.114.2.32-root.io.514.2.33-root.io.314.2.2-root.io.514.2.2-root.io.614.2.30-root.io.114.2.30-root.io.214.1.3-root.io.614.2.35-root.io.514.2.33-root.io.414.2.35-root.io.314.2.32-root.io.614.2.35-root.io.614.1.3-root.io.714.2.32-root.io.214.2.32-root.io.714.2.28-root.io.114.2.35-root.io.214.2.28-root.io.214.2.35-root.io.714.0.0-root.io.214.2.29-root.io.214.2.21-root.io.114.1.3-root.io.314.2.16-root.io.114.2.32-root.io.314.2.29-root.io.314.1.3-root.io.414.2.35-root.io.814.2.35-root.io.414.2.35-root.io.1
next
Root:npm
 before 14.2.5-aikido.8
14.2.5-aikido.814.2.33-aikido.214.2.32-aikido.414.2.35-aikido.914.2.30-aikido.714.2.26-aikido.614.2.26-aikido.414.2.30-aikido.1013.4.19-aikido.613.4.19-aikido.714.2.10-aikido.314.2.13-aikido.314.0.4-aikido.614.0.4-aikido.913.4.19-aikido.214.1.3-aikido.214.2.24-aikido.214.2.25-aikido.214.1.0-aikido.413.3.0-aikido.513.4.19-aikido.314.0.4-aikido.514.0.4-aikido.714.1.0-aikido.714.1.0-aikido.814.2.32-aikido.114.2.3-aikido.514.0.3-aikido.314.2.5-aikido.914.2.5-aikido.1014.2.2-aikido.714.2.33-aikido.114.1.3-aikido.514.2.29-aikido.114.2.29-aikido.514.2.31-aikido.214.0.0-aikido.714.2.10-aikido.414.2.13-aikido.414.2.18-aikido.614.2.21-aikido.614.2.16-aikido.614.2.25-aikido.114.2.0-aikido.614.2.31-aikido.514.2.2-aikido.914.2.30-aikido.813.1.6-aikido.114.2.24-aikido.714.2.24-aikido.414.0.3-aikido.614.2.32-aikido.514.2.33-aikido.314.0.0-aikido.514.2.3-aikido.314.2.2-aikido.414.2.2-aikido.513.5.11-aikido.714.2.2-aikido.613.5.4-aikido.514.0.0-aikido.114.1.3-aikido.613.3.0-aikido.113.3.0-aikido.613.4.19-aikido.114.0.3-aikido.413.5.11-aikido.414.0.3-aikido.114.2.21-aikido.413.5.6-aikido.114.0.0-aikido.314.1.4-aikido.713.5.4-aikido.114.2.21-aikido.213.3.0-aikido.214.2.16-aikido.214.2.16-aikido.413.5.4-aikido.214.2.35-aikido.513.5.6-aikido.214.2.30-aikido.413.3.0-aikido.714.2.33-aikido.414.2.26-aikido.314.0.3-aikido.514.2.30-aikido.915.5.10-aikido.414.1.4-aikido.814.2.35-aikido.314.2.32-aikido.614.2.35-aikido.613.5.4-aikido.614.2.24-aikido.514.1.3-aikido.714.2.16-aikido.514.0.0-aikido.614.2.21-aikido.514.2.3-aikido.414.2.2-aikido.813.4.19-aikido.414.2.15-aikido.514.2.30-aikido.514.2.3-aikido.213.5.6-aikido.313.5.6-aikido.415.5.10-aikido.514.2.28-aikido.514.2.24-aikido.114.2.32-aikido.214.1.4-aikido.916.1.6-aikido.414.1.3-aikido.116.1.7-aikido.113.3.0-aikido.314.2.32-aikido.713.5.6-aikido.514.2.15-aikido.616.1.6-aikido.514.1.3-aikido.813.2.4-aikido.714.2.32-aikido.814.2.29-aikido.414.2.35-aikido.214.2.33-aikido.513.5.6-aikido.613.5.11-aikido.814.2.26-aikido.515.5.10-aikido.614.0.4-aikido.814.2.28-aikido.314.2.31-aikido.314.2.24-aikido.614.1.4-aikido.614.2.35-aikido.714.2.18-aikido.313.3.0-aikido.414.1.0-aikido.516.1.7-aikido.214.2.16-aikido.314.0.0-aikido.413.5.11-aikido.514.1.0-aikido.313.5.11-aikido.614.2.18-aikido.413.5.4-aikido.313.4.19-aikido.514.0.0-aikido.216.1.6-aikido.614.2.31-aikido.414.2.29-aikido.213.5.4-aikido.414.2.21-aikido.116.1.6-aikido.716.1.7-aikido.314.1.3-aikido.313.3.0-aikido.814.2.24-aikido.313.1.6-aikido.214.2.21-aikido.314.2.32-aikido.314.2.29-aikido.313.5.11-aikido.914.0.3-aikido.214.1.3-aikido.414.2.30-aikido.614.2.28-aikido.414.2.33-aikido.614.1.0-aikido.614.2.35-aikido.814.2.35-aikido.415.5.10-aikido.316.1.6-aikido.814.2.18-aikido.513.5.6-aikido.714.2.35-aikido.1014.2.35-aikido.1115.5.15-aikido.215.5.15-aikido.315.5.15-aikido.4
@rootio/next
Root:npm
 before 14.2.5-root.io.8
14.2.5-root.io.814.2.33-root.io.214.2.32-root.io.414.2.35-root.io.914.2.30-root.io.714.2.26-root.io.614.2.26-root.io.414.2.30-root.io.1013.4.19-root.io.613.4.19-root.io.714.2.10-root.io.314.2.13-root.io.314.0.4-root.io.614.0.4-root.io.913.4.19-root.io.214.1.3-root.io.214.2.25-root.io.214.2.24-root.io.214.1.0-root.io.413.3.0-root.io.514.0.4-root.io.513.4.19-root.io.314.0.4-root.io.714.1.0-root.io.714.1.0-root.io.814.2.32-root.io.114.2.3-root.io.514.0.3-root.io.314.2.5-root.io.914.2.5-root.io.1014.2.2-root.io.714.2.33-root.io.114.1.3-root.io.514.2.29-root.io.114.2.29-root.io.514.2.31-root.io.214.0.0-root.io.714.2.10-root.io.414.2.13-root.io.414.2.18-root.io.614.2.21-root.io.614.2.16-root.io.614.2.25-root.io.114.2.0-root.io.614.2.31-root.io.514.2.2-root.io.914.2.30-root.io.813.1.6-root.io.114.2.24-root.io.714.2.24-root.io.414.0.3-root.io.614.2.32-root.io.514.2.33-root.io.314.0.0-root.io.516.1.6-root.io.116.1.6-root.io.216.1.6-root.io.314.2.3-root.io.314.2.2-root.io.413.5.4-root.io.514.2.2-root.io.513.5.11-root.io.714.2.2-root.io.614.0.0-root.io.114.1.3-root.io.613.3.0-root.io.113.3.0-root.io.613.4.19-root.io.114.0.3-root.io.413.5.11-root.io.414.0.3-root.io.114.2.21-root.io.413.5.6-root.io.114.0.0-root.io.314.1.4-root.io.713.5.4-root.io.114.2.21-root.io.213.3.0-root.io.214.2.16-root.io.214.2.16-root.io.413.5.4-root.io.214.2.35-root.io.513.5.6-root.io.214.2.30-root.io.413.3.0-root.io.714.2.33-root.io.414.2.26-root.io.314.0.3-root.io.514.2.30-root.io.915.5.10-root.io.414.1.4-root.io.814.2.35-root.io.314.2.32-root.io.614.2.35-root.io.613.5.4-root.io.614.2.24-root.io.514.1.3-root.io.714.2.16-root.io.514.0.0-root.io.614.2.21-root.io.514.2.3-root.io.414.2.2-root.io.813.4.19-root.io.414.2.15-root.io.514.2.30-root.io.514.2.3-root.io.213.5.6-root.io.313.5.6-root.io.415.5.10-root.io.514.2.28-root.io.514.2.24-root.io.114.2.32-root.io.214.1.4-root.io.916.1.6-root.io.414.1.3-root.io.116.1.7-root.io.113.3.0-root.io.314.2.32-root.io.713.5.6-root.io.514.2.15-root.io.616.1.6-root.io.513.2.4-root.io.714.1.3-root.io.814.2.32-root.io.814.2.29-root.io.414.2.33-root.io.514.2.35-root.io.213.5.6-root.io.613.5.11-root.io.814.2.26-root.io.515.5.10-root.io.614.0.4-root.io.814.2.28-root.io.314.2.24-root.io.614.2.31-root.io.314.2.35-root.io.714.1.4-root.io.614.2.18-root.io.313.3.0-root.io.414.1.0-root.io.516.1.7-root.io.214.2.16-root.io.314.0.0-root.io.413.5.11-root.io.514.1.0-root.io.313.5.11-root.io.614.2.18-root.io.413.5.4-root.io.313.4.19-root.io.514.0.0-root.io.214.2.31-root.io.416.1.6-root.io.614.2.29-root.io.213.5.4-root.io.414.2.21-root.io.114.1.3-root.io.316.1.6-root.io.716.1.7-root.io.313.3.0-root.io.814.2.24-root.io.313.1.6-root.io.214.2.21-root.io.314.2.32-root.io.314.2.29-root.io.313.5.11-root.io.914.0.3-root.io.214.1.3-root.io.414.2.30-root.io.614.2.33-root.io.614.2.28-root.io.414.1.0-root.io.614.2.35-root.io.814.2.35-root.io.415.5.10-root.io.313.5.6-root.io.716.1.6-root.io.814.2.18-root.io.514.2.35-root.io.1014.2.35-root.io.1115.5.15-root.io.115.5.15-root.io.215.5.15-root.io.315.5.15-root.io.4

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubNayekah/Next.js-Proof-of-Concept2026-04-25

History

History
RecordedChangedSources
affected, facts
affected
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-27978 is a medium vulnerability (CVSS 5.3) in Vercel Next.js, published December 11, 2025. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.21%, the 11th percentile. Fixed in next 15.5.16.

References

Show 18 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open