CVE-2026-44582
Next.js: Cache poisoning via collisions in React Server Component cache-busting
Next.js is a React framework for building full-stack web applications. From 13.4.6 to before 15.5.16 and 16.2.5, React Server Component responses can be vulnerable to cache poisoning in deployments that rely on shared caches with insufficient response partitioning. In affected conditions, collisions in the _rsc cache-busting value can allow an attacker to poison cache entries so users receive the wrong response variant for a given URL. This vulnerability is fixed in 15.5.16 and 16.2.5.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Next.js: Cache poisoning via collisions in React Server Component cache-busting
Next.js is a React framework for building full-stack web applications. From 13.4.6 to before 15.5.16 and 16.2.5, React Server Component responses can be vulnerable to cache poisoning in deployments that rely on shared caches with insufficient response partitioning. In affected conditions, collisions in the _rsc cache-busting value can allow an attacker to poison cache entries so users receive the wrong response variant for a given URL. This vulnerability is fixed in 15.5.16 and 16.2.5.
- Record
CVE-2026-44582- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-328
- Updated
- 2026-11-02
EUVDEUVD-2026-30084
Next.js is a React framework for building full-stack web applications. From 13.4.6 to before 15.5.16 and 16.2.5, React Server Component responses can be vulnerable to cache poisoning in deployments that rely on shared caches with insufficient response partitioning. In affected conditions, collisions in the _rsc cache-busting value can allow an attacker to poison cache entries so users receive the wrong response variant for a given URL. This vulnerability is fixed in 15.5.16 and 16.2.5.
- Record
EUVD-2026-30084- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-8h8q-6873-q5fj
Next.js Vulnerable to Denial of Service with Server Components
A vulnerability affects certain React Server Components packages for versions 19.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. The issue is tracked upstream as CVE-2026-23870.
A specially crafted HTTP request can be sent to any App Router Server Function endpoint that, when deserialized, may trigger excessive CPU usage. This can result in denial of service in unpatched environments.
- Record
GHSA-8h8q-6873-q5fj- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-02
GitHub AdvisoriesGHSA-h25m-26qc-wcjf
Next.js HTTP request deserialization can lead to DoS when using insecure React Server Components
A vulnerability affects certain React Server Components packages for versions 19.0.x, 19.1.x, and 19.2.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. The issue is tracked upstream as CVE-2026-23864.
A specially crafted HTTP request can be sent to any App Router Server Function endpoint that, when deserialized, may trigger excessive CPU usage, out-of-memory exceptions, or server crashes. This can result in denial of service in unpatched environments.
- Record
GHSA-h25m-26qc-wcjf- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400, CWE-502
- Updated
- 2026-11-02
GitHub AdvisoriesGHSA-mwv6-3258-q52c
Next Vulnerable to Denial of Service with Server Components
A vulnerability affects certain React packages for versions 19.0.0, 19.0.1, 19.1.0, 19.1.1, 19.1.2, 19.2.0, and 19.2.1 and frameworks that use the affected packages, including Next.js 15.x and 16.x using the App Router. The issue is tracked upstream as CVE-2025-55184.
A malicious HTTP request can be crafted and sent to any App Router endpoint that, when deserialized, can cause the server process to hang and consume CPU. This can result in denial of service in unpatched environments.
- Record
GHSA-mwv6-3258-q52c- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400, CWE-502, CWE-1395
- Updated
- 2026-11-02
GitHub AdvisoriesGHSA-q4gf-8mx6-v5v3
Next.js has a Denial of Service with Server Components
A vulnerability affects certain React Server Components packages for versions 19.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. The issue is tracked upstream as CVE-2026-23869. You can read more about this advisory our this changelog.
A specially crafted HTTP request can be sent to any App Router Server Function endpoint that, when deserialized, may trigger excessive CPU usage. This can result in denial of service in unpatched environments.
- Record
GHSA-q4gf-8mx6-v5v3- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-02
Show 53 moreShow less
GitHub AdvisoriesGHSA-vfv6-92ff-j949
Next.js vulnerable to cache poisoning via collisions in React Server Component cache-busting
Impact
React Server Component responses can be vulnerable to cache poisoning in deployments that rely on shared caches with insufficient response partitioning. In affected conditions, collisions in the _rsc cache-busting value can allow an attacker to poison cache entries so users receive the wrong response variant for a given URL.
Fix
We strengthened the _rsc cache-busting mechanism to make practical collisions significantly harder and to better separate response variants that should not share cache entries.
Workarounds
If you cannot upgrade immediately, ensure intermediary caches correctly honor Vary for RSC-related request headers, or disable shared caching for affected RSC responses until you can deploy a patched release.
- Record
GHSA-vfv6-92ff-j949- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-328
- Updated
- 2026-11-02
GitHub AdvisoriesGHSA-w37m-7fhw-fmv9
Next Server Actions Source Code Exposure
A vulnerability affects certain React packages for versions 19.0.0, 19.0.1, 19.1.0, 19.1.1, 19.1.2, 19.2.0, and 19.2.1 and frameworks that use the affected packages, including Next.js 15.x and 16.x using the App Router. The issue is tracked upstream as CVE-2025-55183.
A malicious HTTP request can be crafted and sent to any App Router endpoint that can return the compiled source code of Server Functions. This could reveal business logic, but would not expose secrets unless they were hardcoded directly into Server Function code.
- Record
GHSA-w37m-7fhw-fmv9- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-497, CWE-502, CWE-1395
- Updated
- 2026-11-02
NVD
Next.js is a React framework for building full-stack web applications. From 13.4.6 to before 15.5.16 and 16.2.5, React Server Component responses can be vulnerable to cache poisoning in deployments that rely on shared caches with insufficient response partitioning. In affected conditions, collisions in the _rsc cache-busting value can allow an attacker to poison cache entries so users receive the wrong response variant for a given URL. This vulnerability is fixed in 15.5.16 and 16.2.5.
- Record
CVE-2026-44582- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-328
- Updated
- 2026-11-02
OSV
Next.js: Cache poisoning via collisions in React Server Component cache-busting
Next.js is a React framework for building full-stack web applications. From 13.4.6 to before 15.5.16 and 16.2.5, React Server Component responses can be vulnerable to cache poisoning in deployments that rely on shared caches with insufficient response partitioning. In affected conditions, collisions in the _rsc cache-busting value can allow an attacker to poison cache entries so users receive the wrong response variant for a given URL. This vulnerability is fixed in 15.5.16 and 16.2.5.
- Record
CVE-2026-44582- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-328
- Updated
- 2026-11-02
OSVGHSA-8h8q-6873-q5fj
Next.js Vulnerable to Denial of Service with Server Components
A vulnerability affects certain React Server Components packages for versions 19.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. The issue is tracked upstream as CVE-2026-23870.
A specially crafted HTTP request can be sent to any App Router Server Function endpoint that, when deserialized, may trigger excessive CPU usage. This can result in denial of service in unpatched environments.
- Record
GHSA-8h8q-6873-q5fj- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-02
OSVGHSA-h25m-26qc-wcjf
Next.js HTTP request deserialization can lead to DoS when using insecure React Server Components
A vulnerability affects certain React Server Components packages for versions 19.0.x, 19.1.x, and 19.2.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. The issue is tracked upstream as CVE-2026-23864.
A specially crafted HTTP request can be sent to any App Router Server Function endpoint that, when deserialized, may trigger excessive CPU usage, out-of-memory exceptions, or server crashes. This can result in denial of service in unpatched environments.
- Record
GHSA-h25m-26qc-wcjf- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400, CWE-502
- Updated
- 2026-11-02
OSVGHSA-mwv6-3258-q52c
Next Vulnerable to Denial of Service with Server Components
A vulnerability affects certain React packages for versions 19.0.0, 19.0.1, 19.1.0, 19.1.1, 19.1.2, 19.2.0, and 19.2.1 and frameworks that use the affected packages, including Next.js 15.x and 16.x using the App Router. The issue is tracked upstream as CVE-2025-55184.
A malicious HTTP request can be crafted and sent to any App Router endpoint that, when deserialized, can cause the server process to hang and consume CPU. This can result in denial of service in unpatched environments.
- Record
GHSA-mwv6-3258-q52c- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-1395, CWE-400, CWE-502
- Updated
- 2026-11-02
OSVGHSA-q4gf-8mx6-v5v3
Next.js has a Denial of Service with Server Components
A vulnerability affects certain React Server Components packages for versions 19.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. The issue is tracked upstream as CVE-2026-23869. You can read more about this advisory our this changelog.
A specially crafted HTTP request can be sent to any App Router Server Function endpoint that, when deserialized, may trigger excessive CPU usage. This can result in denial of service in unpatched environments.
- Record
GHSA-q4gf-8mx6-v5v3- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-02
OSVGHSA-vfv6-92ff-j949
Next.js vulnerable to cache poisoning via collisions in React Server Component cache-busting
Impact
React Server Component responses can be vulnerable to cache poisoning in deployments that rely on shared caches with insufficient response partitioning. In affected conditions, collisions in the _rsc cache-busting value can allow an attacker to poison cache entries so users receive the wrong response variant for a given URL.
Fix
We strengthened the _rsc cache-busting mechanism to make practical collisions significantly harder and to better separate response variants that should not share cache entries.
Workarounds
If you cannot upgrade immediately, ensure intermediary caches correctly honor Vary for RSC-related request headers, or disable shared caching for affected RSC responses until you can deploy a patched release.
- Record
GHSA-vfv6-92ff-j949- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-328
- Updated
- 2026-11-02
OSVGHSA-w37m-7fhw-fmv9
Next Server Actions Source Code Exposure
A vulnerability affects certain React packages for versions 19.0.0, 19.0.1, 19.1.0, 19.1.1, 19.1.2, 19.2.0, and 19.2.1 and frameworks that use the affected packages, including Next.js 15.x and 16.x using the App Router. The issue is tracked upstream as CVE-2025-55183.
A malicious HTTP request can be crafted and sent to any App Router endpoint that can return the compiled source code of Server Functions. This could reveal business logic, but would not expose secrets unless they were hardcoded directly into Server Function code.
- Record
GHSA-w37m-7fhw-fmv9- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-1395, CWE-497, CWE-502
- Updated
- 2026-11-02
OSVCLSA-2026-1786360051 No score
TuxCare security update for 13 packages (13 CVEs)
TuxCare rebuilt 13 packages to address 13 CVEs. Fixed in 13.5.11-tuxcare.14.
- Record
CLSA-2026-1786360051- Updated
- 2026-11-02
OSVCLSA-2026-1786531569 No score
TuxCare security update for 13 packages (9 CVEs)
TuxCare rebuilt 13 packages to address 9 CVEs. Fixed in 14.2.35-tuxcare.5.
- Record
CLSA-2026-1786531569- Updated
- 2026-11-02
OSVCLSA-2026-1786995617 No score
TuxCare security update for 22 packages (9 CVEs)
TuxCare rebuilt 22 packages to address 9 CVEs. Fixed in 16.0.6-tuxcare.7.
- Record
CLSA-2026-1786995617- Updated
- 2026-11-02
OSVCLSA-2026-1791901908 No score
TuxCare security update for 9 packages (10 CVEs)
TuxCare rebuilt 9 packages to address 10 CVEs. Fixed in 15.1.2-tuxcare.3.
- Record
CLSA-2026-1791901908- Updated
- 2026-11-02
OSVCLSA-2026-1792195727 No score
TuxCare security update for create-next-app (13 CVEs)
TuxCare rebuilt create-next-app to address 13 CVEs. Fixed in 13.5.11-tuxcare.14.
- Record
CLSA-2026-1792195727- Updated
- 2026-11-02
OSVCLSA-2026-1792195746 No score
TuxCare security update for create-next-app (9 CVEs)
TuxCare rebuilt create-next-app to address 9 CVEs. Fixed in 14.2.35-tuxcare.5.
- Record
CLSA-2026-1792195746- Updated
- 2026-11-02
OSVCLSA-2026-1792195750 No score
TuxCare security update for create-next-app (9 CVEs)
TuxCare rebuilt create-next-app to address 9 CVEs. Fixed in 16.0.6-tuxcare.7.
- Record
CLSA-2026-1792195750- Updated
- 2026-11-02
OSVCLSA-2026-1792196726 No score
TuxCare security update for @next/eslint-plugin-next (13 CVEs)
TuxCare rebuilt @next/eslint-plugin-next to address 13 CVEs. Fixed in 13.5.11-tuxcare.14.
- Record
CLSA-2026-1792196726- Updated
- 2026-11-02
OSVCLSA-2026-1792196727 No score
TuxCare security update for @next/eslint-plugin-next (9 CVEs)
TuxCare rebuilt @next/eslint-plugin-next to address 9 CVEs. Fixed in 14.2.35-tuxcare.5.
- Record
CLSA-2026-1792196727- Updated
- 2026-11-02
OSVCLSA-2026-1792196728 No score
TuxCare security update for @next/eslint-plugin-next (9 CVEs)
TuxCare rebuilt @next/eslint-plugin-next to address 9 CVEs. Fixed in 16.0.6-tuxcare.7.
- Record
CLSA-2026-1792196728- Updated
- 2026-11-02
OSVCLSA-2026-1792206290 No score
TuxCare security update for @next/bundle-analyzer (13 CVEs)
TuxCare rebuilt @next/bundle-analyzer to address 13 CVEs. Fixed in 13.5.11-tuxcare.14.
- Record
CLSA-2026-1792206290- Updated
- 2026-11-02
OSVCLSA-2026-1792206302 No score
TuxCare security update for @next/bundle-analyzer (9 CVEs)
TuxCare rebuilt @next/bundle-analyzer to address 9 CVEs. Fixed in 14.2.35-tuxcare.5.
- Record
CLSA-2026-1792206302- Updated
- 2026-11-02
OSVCLSA-2026-1792206304 No score
TuxCare security update for @next/bundle-analyzer (9 CVEs)
TuxCare rebuilt @next/bundle-analyzer to address 9 CVEs. Fixed in 16.0.6-tuxcare.7.
- Record
CLSA-2026-1792206304- Updated
- 2026-11-02
OSVCLSA-2026-1792256964 No score
TuxCare security update for next-rspack (9 CVEs)
TuxCare rebuilt next-rspack to address 9 CVEs. Fixed in 16.0.6-tuxcare.7.
- Record
CLSA-2026-1792256964- Updated
- 2026-11-02
OSVCLSA-2026-1792272230 No score
TuxCare security update for @next/plugin-storybook (13 CVEs)
TuxCare rebuilt @next/plugin-storybook to address 13 CVEs. Fixed in 13.5.11-tuxcare.14.
- Record
CLSA-2026-1792272230- Updated
- 2026-11-02
OSVCLSA-2026-1792272244 No score
TuxCare security update for @next/plugin-storybook (9 CVEs)
TuxCare rebuilt @next/plugin-storybook to address 9 CVEs. Fixed in 14.2.35-tuxcare.5.
- Record
CLSA-2026-1792272244- Updated
- 2026-11-02
OSVCLSA-2026-1792272246 No score
TuxCare security update for @next/plugin-storybook (9 CVEs)
TuxCare rebuilt @next/plugin-storybook to address 9 CVEs. Fixed in 16.0.6-tuxcare.7.
- Record
CLSA-2026-1792272246- Updated
- 2026-11-02
OSVCLSA-2026-1792293000 No score
TuxCare security update for @next/polyfill-module (13 CVEs)
TuxCare rebuilt @next/polyfill-module to address 13 CVEs. Fixed in 13.5.11-tuxcare.14.
- Record
CLSA-2026-1792293000- Updated
- 2026-11-02
OSVCLSA-2026-1792293013 No score
TuxCare security update for @next/polyfill-module (9 CVEs)
TuxCare rebuilt @next/polyfill-module to address 9 CVEs. Fixed in 14.2.35-tuxcare.5.
- Record
CLSA-2026-1792293013- Updated
- 2026-11-02
OSVCLSA-2026-1792293016 No score
TuxCare security update for @next/polyfill-module (9 CVEs)
TuxCare rebuilt @next/polyfill-module to address 9 CVEs. Fixed in 16.0.6-tuxcare.7.
- Record
CLSA-2026-1792293016- Updated
- 2026-11-02
OSVCLSA-2026-1792304720 No score
TuxCare security update for @next/polyfill-nomodule (13 CVEs)
TuxCare rebuilt @next/polyfill-nomodule to address 13 CVEs. Fixed in 13.5.11-tuxcare.14.
- Record
CLSA-2026-1792304720- Updated
- 2026-11-02
OSVCLSA-2026-1792304739 No score
TuxCare security update for @next/polyfill-nomodule (9 CVEs)
TuxCare rebuilt @next/polyfill-nomodule to address 9 CVEs. Fixed in 14.2.35-tuxcare.5.
- Record
CLSA-2026-1792304739- Updated
- 2026-11-02
OSVCLSA-2026-1792304741 No score
TuxCare security update for @next/polyfill-nomodule (9 CVEs)
TuxCare rebuilt @next/polyfill-nomodule to address 9 CVEs. Fixed in 16.0.6-tuxcare.7.
- Record
CLSA-2026-1792304741- Updated
- 2026-11-02
OSVCLSA-2026-1792326302 No score
TuxCare security update for @next/react-refresh-utils (13 CVEs)
TuxCare rebuilt @next/react-refresh-utils to address 13 CVEs. Fixed in 13.5.11-tuxcare.14.
- Record
CLSA-2026-1792326302- Updated
- 2026-11-02
OSVCLSA-2026-1792326303 No score
TuxCare security update for @next/react-refresh-utils (9 CVEs)
TuxCare rebuilt @next/react-refresh-utils to address 9 CVEs. Fixed in 14.2.35-tuxcare.5.
- Record
CLSA-2026-1792326303- Updated
- 2026-11-02
OSVCLSA-2026-1792326304 No score
TuxCare security update for @next/react-refresh-utils (9 CVEs)
TuxCare rebuilt @next/react-refresh-utils to address 9 CVEs. Fixed in 16.0.6-tuxcare.7.
- Record
CLSA-2026-1792326304- Updated
- 2026-11-02
OSVCLSA-2026-1792338232 No score
TuxCare security update for @next/third-parties (13 CVEs)
TuxCare rebuilt @next/third-parties to address 13 CVEs. Fixed in 13.5.11-tuxcare.14.
- Record
CLSA-2026-1792338232- Updated
- 2026-11-02
OSVCLSA-2026-1792338235 No score
TuxCare security update for @next/third-parties (9 CVEs)
TuxCare rebuilt @next/third-parties to address 9 CVEs. Fixed in 16.0.6-tuxcare.7.
- Record
CLSA-2026-1792338235- Updated
- 2026-11-02
OSVCLSA-2026-1792346470 No score
TuxCare security update for @next/swc-linux-x64-gnu (9 CVEs)
TuxCare rebuilt @next/swc-linux-x64-gnu to address 9 CVEs. Fixed in 16.0.6-tuxcare.7.
- Record
CLSA-2026-1792346470- Updated
- 2026-11-02
OSVCLSA-2026-1792346492 No score
TuxCare security update for @next/swc-linux-x64-gnu (10 CVEs)
TuxCare rebuilt @next/swc-linux-x64-gnu to address 10 CVEs. Fixed in 15.1.2-tuxcare.3.
- Record
CLSA-2026-1792346492- Updated
- 2026-11-02
OSVCLSA-2026-1792358588 No score
TuxCare security update for @next/codemod (9 CVEs)
TuxCare rebuilt @next/codemod to address 9 CVEs. Fixed in 14.2.35-tuxcare.5.
- Record
CLSA-2026-1792358588- Updated
- 2026-11-02
OSVCLSA-2026-1792358596 No score
TuxCare security update for @next/codemod (13 CVEs)
TuxCare rebuilt @next/codemod to address 13 CVEs. Fixed in 13.5.11-tuxcare.14.
- Record
CLSA-2026-1792358596- Updated
- 2026-11-02
OSVCLSA-2026-1792358599 No score
TuxCare security update for @next/codemod (9 CVEs)
TuxCare rebuilt @next/codemod to address 9 CVEs. Fixed in 16.0.6-tuxcare.7.
- Record
CLSA-2026-1792358599- Updated
- 2026-11-02
OSVCLSA-2026-1792363988 No score
TuxCare security update for @next/mdx (9 CVEs)
TuxCare rebuilt @next/mdx to address 9 CVEs. Fixed in 14.2.35-tuxcare.5.
- Record
CLSA-2026-1792363988- Updated
- 2026-11-02
OSVCLSA-2026-1792364002 No score
TuxCare security update for @next/mdx (13 CVEs)
TuxCare rebuilt @next/mdx to address 13 CVEs. Fixed in 13.5.11-tuxcare.14.
- Record
CLSA-2026-1792364002- Updated
- 2026-11-02
OSVCLSA-2026-1792364004 No score
TuxCare security update for @next/mdx (9 CVEs)
TuxCare rebuilt @next/mdx to address 9 CVEs. Fixed in 16.0.6-tuxcare.7.
- Record
CLSA-2026-1792364004- Updated
- 2026-11-02
OSVCLSA-2026-1792367391 No score
TuxCare security update for @next/swc-linux-arm64-gnu (9 CVEs)
TuxCare rebuilt @next/swc-linux-arm64-gnu to address 9 CVEs. Fixed in 16.0.6-tuxcare.7.
- Record
CLSA-2026-1792367391- Updated
- 2026-11-02
OSVCLSA-2026-1792367395 No score
TuxCare security update for @next/swc-linux-arm64-gnu (10 CVEs)
TuxCare rebuilt @next/swc-linux-arm64-gnu to address 10 CVEs. Fixed in 15.1.2-tuxcare.3.
- Record
CLSA-2026-1792367395- Updated
- 2026-11-02
OSVROOT-APP-NPM-CVE-2026-44582 No score
CVE-2026-44582 in next - Patched by Root
Root has patched CVE-2026-44582 in the next package for Root:npm. Multiple fixed versions available.
- Record
ROOT-APP-NPM-CVE-2026-44582- Updated
- 2026-11-02
OSVROOT-APP-NPM-GHSA-8h8q-6873-q5fj No score
GHSA-8h8q-6873-q5fj in next - Patched by Root
Root has patched GHSA-8h8q-6873-q5fj in the next package for Root:npm. Multiple fixed versions available.
- Record
ROOT-APP-NPM-GHSA-8h8q-6873-q5fj- Updated
- 2026-11-02
OSVROOT-APP-NPM-GHSA-h25m-26qc-wcjf No score
GHSA-h25m-26qc-wcjf in next - Patched by Root
Root has patched GHSA-h25m-26qc-wcjf in the next package for Root:npm. Multiple fixed versions available.
- Record
ROOT-APP-NPM-GHSA-h25m-26qc-wcjf- Updated
- 2026-11-02
OSVROOT-APP-NPM-GHSA-mwv6-3258-q52c No score
GHSA-mwv6-3258-q52c in next - Patched by Root
Root has patched GHSA-mwv6-3258-q52c in the next package for Root:npm. Multiple fixed versions available.
- Record
ROOT-APP-NPM-GHSA-mwv6-3258-q52c- Updated
- 2026-11-02
OSVROOT-APP-NPM-GHSA-q4gf-8mx6-v5v3 No score
GHSA-q4gf-8mx6-v5v3 in next - Patched by Root
Root has patched GHSA-q4gf-8mx6-v5v3 in the next package for Root:npm. Multiple fixed versions available.
- Record
ROOT-APP-NPM-GHSA-q4gf-8mx6-v5v3- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
nextnpm |
13.0.0 up to 15.5.16 | 15.5.16 |
nextnpm |
16.0.0 up to 16.2.5 | 16.2.5 |
nextnpm |
13.0.0 up to 15.0.8 | 15.0.8 |
nextnpm |
15.1.1-canary.0 up to 15.1.12 | 15.1.12 |
nextnpm |
15.2.0-canary.0 up to 15.2.9 | 15.2.9 |
nextnpm |
15.3.0-canary.0 up to 15.3.9 | 15.3.9 |
nextnpm |
15.4.0-canary.0 up to 15.4.11 | 15.4.11 |
nextnpm |
15.5.1-canary.0 up to 15.5.10 | 15.5.10 |
nextnpm |
15.6.0-canary.0 up to 15.6.0-canary.61 | 15.6.0-canary.61 |
nextnpm |
16.0.0-beta.0 up to 16.0.11 | 16.0.11 |
Show 56 moreShow less
| Package | Affected | Fixed |
|---|---|---|
nextnpm |
16.1.0-canary.0 up to 16.1.5 | 16.1.5 |
nextnpm |
13.3.0 up to 14.2.34 | 14.2.34 |
nextnpm |
15.0.0-canary.0 up to 15.0.6 | 15.0.6 |
nextnpm |
15.1.1-canary.0 up to 15.1.10 | 15.1.10 |
nextnpm |
15.2.0-canary.0 up to 15.2.7 | 15.2.7 |
nextnpm |
15.3.0-canary.0 up to 15.3.7 | 15.3.7 |
nextnpm |
15.4.0-canary.0 up to 15.4.9 | 15.4.9 |
nextnpm |
15.5.1-canary.0 up to 15.5.8 | 15.5.8 |
nextnpm |
15.6.0-canary.0 up to 15.6.0-canary.59 | 15.6.0-canary.59 |
nextnpm |
16.0.0-beta.0 up to 16.0.9 | 16.0.9 |
nextnpm |
16.1.0-canary.0 up to 16.1.0-canary.17 | 16.1.0-canary.17 |
nextnpm |
13.0.0 up to 15.5.15 | 15.5.15 |
nextnpm |
16.0.0-beta.0 up to 16.2.3 | 16.2.3 |
nextnpm |
13.4.6 up to 15.5.16 | 15.5.16 |
create-next-appTuxCare:npm From an advisory covering 11 CVEs |
13.5.11-tuxcare.0 up to 13.5.11-tuxcare.14, plus listed versions 13.5.1113.5.11-tuxcare.13 |
13.5.11-tuxcare.14 |
create-next-appTuxCare:npm From an advisory covering 8 CVEs |
14.2.35-tuxcare.0 up to 14.2.35-tuxcare.5, plus listed versions 14.2.3514.2.35-tuxcare.4 |
14.2.35-tuxcare.5 |
create-next-appTuxCare:npm From an advisory covering 9 CVEs |
16.0.6-tuxcare.0 up to 16.0.6-tuxcare.7, plus listed versions 16.0.616.0.6-tuxcare.316.0.6-tuxcare.416.0.6-tuxcare.516.0.6-tuxcare.6 |
16.0.6-tuxcare.7 |
@next/eslint-plugin-nextTuxCare:npm From an advisory covering 11 CVEs |
13.5.11-tuxcare.0 up to 13.5.11-tuxcare.14, plus listed versions 13.5.1113.5.11-tuxcare.13 |
13.5.11-tuxcare.14 |
@next/eslint-plugin-nextTuxCare:npm From an advisory covering 8 CVEs |
14.2.35-tuxcare.0 up to 14.2.35-tuxcare.5, plus listed versions 14.2.3514.2.35-tuxcare.4 |
14.2.35-tuxcare.5 |
@next/eslint-plugin-nextTuxCare:npm From an advisory covering 9 CVEs |
16.0.6-tuxcare.0 up to 16.0.6-tuxcare.7, plus listed versions 16.0.616.0.6-tuxcare.316.0.6-tuxcare.416.0.6-tuxcare.516.0.6-tuxcare.6 |
16.0.6-tuxcare.7 |
@next/bundle-analyzerTuxCare:npm From an advisory covering 11 CVEs |
13.5.11-tuxcare.0 up to 13.5.11-tuxcare.14, plus listed versions 13.5.1113.5.11-tuxcare.13 |
13.5.11-tuxcare.14 |
@next/bundle-analyzerTuxCare:npm From an advisory covering 8 CVEs |
14.2.35-tuxcare.0 up to 14.2.35-tuxcare.5, plus listed versions 14.2.3514.2.35-tuxcare.4 |
14.2.35-tuxcare.5 |
@next/bundle-analyzerTuxCare:npm From an advisory covering 9 CVEs |
16.0.6-tuxcare.0 up to 16.0.6-tuxcare.7, plus listed versions 16.0.616.0.6-tuxcare.316.0.6-tuxcare.416.0.6-tuxcare.516.0.6-tuxcare.6 |
16.0.6-tuxcare.7 |
next-rspackTuxCare:npm From an advisory covering 9 CVEs |
16.0.6-tuxcare.0 up to 16.0.6-tuxcare.7, plus listed versions 16.0.616.0.6-tuxcare.316.0.6-tuxcare.416.0.6-tuxcare.516.0.6-tuxcare.6 |
16.0.6-tuxcare.7 |
@next/plugin-storybookTuxCare:npm From an advisory covering 11 CVEs |
13.5.11-tuxcare.0 up to 13.5.11-tuxcare.14, plus listed versions 13.5.1113.5.11-tuxcare.13 |
13.5.11-tuxcare.14 |
@next/plugin-storybookTuxCare:npm From an advisory covering 8 CVEs |
14.2.35-tuxcare.0 up to 14.2.35-tuxcare.5, plus listed versions 14.2.3514.2.35-tuxcare.4 |
14.2.35-tuxcare.5 |
@next/plugin-storybookTuxCare:npm From an advisory covering 9 CVEs |
16.0.6-tuxcare.0 up to 16.0.6-tuxcare.7, plus listed versions 16.0.616.0.6-tuxcare.316.0.6-tuxcare.416.0.6-tuxcare.516.0.6-tuxcare.6 |
16.0.6-tuxcare.7 |
@next/polyfill-moduleTuxCare:npm From an advisory covering 11 CVEs |
13.5.11-tuxcare.0 up to 13.5.11-tuxcare.14, plus listed versions 13.5.1113.5.11-tuxcare.13 |
13.5.11-tuxcare.14 |
@next/polyfill-moduleTuxCare:npm From an advisory covering 8 CVEs |
14.2.35-tuxcare.0 up to 14.2.35-tuxcare.5, plus listed versions 14.2.3514.2.35-tuxcare.4 |
14.2.35-tuxcare.5 |
@next/polyfill-moduleTuxCare:npm From an advisory covering 9 CVEs |
16.0.6-tuxcare.0 up to 16.0.6-tuxcare.7, plus listed versions 16.0.616.0.6-tuxcare.316.0.6-tuxcare.416.0.6-tuxcare.516.0.6-tuxcare.6 |
16.0.6-tuxcare.7 |
@next/polyfill-nomoduleTuxCare:npm From an advisory covering 11 CVEs |
13.5.11-tuxcare.0 up to 13.5.11-tuxcare.14, plus listed versions 13.5.1113.5.11-tuxcare.13 |
13.5.11-tuxcare.14 |
@next/polyfill-nomoduleTuxCare:npm From an advisory covering 8 CVEs |
14.2.35-tuxcare.0 up to 14.2.35-tuxcare.5, plus listed versions 14.2.3514.2.35-tuxcare.4 |
14.2.35-tuxcare.5 |
@next/polyfill-nomoduleTuxCare:npm From an advisory covering 9 CVEs |
16.0.6-tuxcare.0 up to 16.0.6-tuxcare.7, plus listed versions 16.0.616.0.6-tuxcare.316.0.6-tuxcare.416.0.6-tuxcare.516.0.6-tuxcare.6 |
16.0.6-tuxcare.7 |
@next/react-refresh-utilsTuxCare:npm From an advisory covering 11 CVEs |
13.5.11-tuxcare.0 up to 13.5.11-tuxcare.14, plus listed versions 13.5.1113.5.11-tuxcare.13 |
13.5.11-tuxcare.14 |
@next/react-refresh-utilsTuxCare:npm From an advisory covering 8 CVEs |
14.2.35-tuxcare.0 up to 14.2.35-tuxcare.5, plus listed versions 14.2.3514.2.35-tuxcare.4 |
14.2.35-tuxcare.5 |
@next/react-refresh-utilsTuxCare:npm From an advisory covering 9 CVEs |
16.0.6-tuxcare.0 up to 16.0.6-tuxcare.7, plus listed versions 16.0.616.0.6-tuxcare.316.0.6-tuxcare.416.0.6-tuxcare.516.0.6-tuxcare.6 |
16.0.6-tuxcare.7 |
@next/third-partiesTuxCare:npm From an advisory covering 11 CVEs |
13.5.11-tuxcare.0 up to 13.5.11-tuxcare.14, plus listed versions 13.5.1113.5.11-tuxcare.13 |
13.5.11-tuxcare.14 |
@next/third-partiesTuxCare:npm From an advisory covering 9 CVEs |
16.0.6-tuxcare.0 up to 16.0.6-tuxcare.7, plus listed versions 16.0.616.0.6-tuxcare.316.0.6-tuxcare.416.0.6-tuxcare.516.0.6-tuxcare.6 |
16.0.6-tuxcare.7 |
@next/swc-linux-x64-gnuTuxCare:npm From an advisory covering 9 CVEs |
16.0.6-tuxcare.0 up to 16.0.6-tuxcare.7, plus listed versions 16.0.616.0.6-tuxcare.316.0.6-tuxcare.416.0.6-tuxcare.516.0.6-tuxcare.6 |
16.0.6-tuxcare.7 |
@next/swc-linux-x64-gnuTuxCare:npm From an advisory covering 7 CVEs |
15.1.2-tuxcare.0 up to 15.1.2-tuxcare.3, plus listed versions 15.1.215.1.2-tuxcare.115.1.2-tuxcare.2 |
15.1.2-tuxcare.3 |
@next/codemodTuxCare:npm From an advisory covering 8 CVEs |
14.2.35-tuxcare.0 up to 14.2.35-tuxcare.5, plus listed versions 14.2.3514.2.35-tuxcare.4 |
14.2.35-tuxcare.5 |
@next/codemodTuxCare:npm From an advisory covering 11 CVEs |
13.5.11-tuxcare.0 up to 13.5.11-tuxcare.14, plus listed versions 13.5.1113.5.11-tuxcare.13 |
13.5.11-tuxcare.14 |
@next/codemodTuxCare:npm From an advisory covering 9 CVEs |
16.0.6-tuxcare.0 up to 16.0.6-tuxcare.7, plus listed versions 16.0.616.0.6-tuxcare.316.0.6-tuxcare.416.0.6-tuxcare.516.0.6-tuxcare.6 |
16.0.6-tuxcare.7 |
@next/mdxTuxCare:npm From an advisory covering 8 CVEs |
14.2.35-tuxcare.0 up to 14.2.35-tuxcare.5, plus listed versions 14.2.3514.2.35-tuxcare.4 |
14.2.35-tuxcare.5 |
@next/mdxTuxCare:npm From an advisory covering 11 CVEs |
13.5.11-tuxcare.0 up to 13.5.11-tuxcare.14, plus listed versions 13.5.1113.5.11-tuxcare.13 |
13.5.11-tuxcare.14 |
@next/mdxTuxCare:npm From an advisory covering 9 CVEs |
16.0.6-tuxcare.0 up to 16.0.6-tuxcare.7, plus listed versions 16.0.616.0.6-tuxcare.316.0.6-tuxcare.416.0.6-tuxcare.516.0.6-tuxcare.6 |
16.0.6-tuxcare.7 |
@next/swc-linux-arm64-gnuTuxCare:npm From an advisory covering 9 CVEs |
16.0.6-tuxcare.0 up to 16.0.6-tuxcare.7, plus listed versions 16.0.616.0.6-tuxcare.316.0.6-tuxcare.416.0.6-tuxcare.516.0.6-tuxcare.6 |
16.0.6-tuxcare.7 |
@next/swc-linux-arm64-gnuTuxCare:npm From an advisory covering 7 CVEs |
15.1.2-tuxcare.0 up to 15.1.2-tuxcare.3, plus listed versions 15.1.215.1.2-tuxcare.115.1.2-tuxcare.2 |
15.1.2-tuxcare.3 |
nextRoot:npm |
before 16.2.5-aikido.1 | 16.2.5-aikido.116.2.5-aikido.316.2.5-aikido.2 |
@rootio/nextRoot:npm |
before 16.2.5-root.io.1 | 16.2.5-root.io.116.2.5-root.io.316.2.5-root.io.2 |
nextRoot:npm |
before 14.2.5-aikido.5 | 14.2.5-aikido.514.2.5-aikido.814.2.35-aikido.914.2.30-aikido.714.2.26-aikido.614.2.26-aikido.414.2.30-aikido.1013.4.19-aikido.613.4.19-aikido.714.2.10-aikido.314.2.13-aikido.314.0.4-aikido.614.2.3-aikido.114.0.4-aikido.914.2.24-aikido.214.2.25-aikido.214.1.0-aikido.414.2.18-aikido.213.3.0-aikido.514.0.4-aikido.514.0.4-aikido.714.0.4-aikido.214.1.0-aikido.714.1.0-aikido.814.0.4-aikido.314.2.13-aikido.114.2.3-aikido.514.2.0-aikido.214.0.3-aikido.314.2.5-aikido.914.2.5-aikido.1014.2.2-aikido.714.2.10-aikido.114.2.29-aikido.514.2.31-aikido.214.2.18-aikido.114.0.0-aikido.714.2.10-aikido.414.2.13-aikido.414.2.10-aikido.214.2.18-aikido.614.2.21-aikido.614.2.16-aikido.614.1.4-aikido.514.2.25-aikido.113.2.4-aikido.314.2.0-aikido.614.0.4-aikido.414.2.31-aikido.514.2.0-aikido.514.2.2-aikido.914.2.30-aikido.813.1.6-aikido.113.2.4-aikido.414.0.3-aikido.614.0.0-aikido.514.2.5-aikido.214.2.5-aikido.314.2.3-aikido.313.5.11-aikido.713.5.4-aikido.514.2.5-aikido.413.3.0-aikido.614.2.30-aikido.314.0.3-aikido.414.2.13-aikido.214.2.5-aikido.614.2.21-aikido.414.0.0-aikido.314.1.4-aikido.714.2.21-aikido.214.2.16-aikido.214.2.16-aikido.413.5.4-aikido.214.2.30-aikido.413.2.4-aikido.513.3.0-aikido.714.2.26-aikido.314.0.3-aikido.514.2.30-aikido.915.5.10-aikido.414.1.4-aikido.813.5.4-aikido.614.2.16-aikido.514.0.0-aikido.614.2.21-aikido.514.2.5-aikido.714.2.3-aikido.414.2.2-aikido.813.4.19-aikido.414.2.15-aikido.514.2.30-aikido.514.2.3-aikido.215.5.10-aikido.514.2.28-aikido.514.1.4-aikido.913.2.4-aikido.216.1.6-aikido.416.1.7-aikido.113.5.6-aikido.514.2.15-aikido.616.1.6-aikido.515.5.15-aikido.214.1.3-aikido.813.2.4-aikido.714.2.32-aikido.814.2.29-aikido.414.2.33-aikido.513.5.6-aikido.613.5.11-aikido.814.2.26-aikido.515.5.10-aikido.614.2.26-aikido.214.0.4-aikido.814.2.28-aikido.314.2.31-aikido.314.1.4-aikido.614.2.18-aikido.313.3.0-aikido.414.1.0-aikido.516.1.7-aikido.214.2.16-aikido.314.0.0-aikido.414.1.0-aikido.313.5.11-aikido.614.2.18-aikido.413.5.4-aikido.314.2.31-aikido.114.1.4-aikido.314.2.0-aikido.313.4.19-aikido.515.5.15-aikido.316.1.6-aikido.614.2.31-aikido.414.1.4-aikido.413.5.4-aikido.415.5.15-aikido.416.1.6-aikido.716.1.7-aikido.313.3.0-aikido.813.1.6-aikido.214.2.21-aikido.313.2.4-aikido.613.5.11-aikido.914.2.0-aikido.414.2.30-aikido.614.2.28-aikido.414.2.33-aikido.614.1.0-aikido.615.5.10-aikido.316.1.6-aikido.814.2.18-aikido.513.5.6-aikido.714.2.35-aikido.1014.2.35-aikido.1116.2.5-aikido.116.2.5-aikido.316.2.5-aikido.214.2.33-aikido.214.2.32-aikido.414.2.15-aikido.414.1.3-aikido.214.2.15-aikido.314.2.32-aikido.114.2.33-aikido.114.1.3-aikido.514.2.29-aikido.114.2.32-aikido.514.2.33-aikido.314.2.2-aikido.514.2.2-aikido.614.2.30-aikido.114.2.30-aikido.214.1.3-aikido.614.2.35-aikido.514.2.33-aikido.414.2.35-aikido.314.2.32-aikido.614.2.35-aikido.614.1.3-aikido.714.2.32-aikido.214.2.32-aikido.714.2.28-aikido.114.2.35-aikido.214.2.28-aikido.214.2.35-aikido.714.0.0-aikido.214.2.29-aikido.214.2.21-aikido.114.2.16-aikido.114.1.3-aikido.314.2.32-aikido.314.2.29-aikido.314.1.3-aikido.414.2.35-aikido.814.2.35-aikido.414.2.35-aikido.1 |
@rootio/nextRoot:npm |
before 14.2.5-root.io.5 | 14.2.5-root.io.514.2.5-root.io.814.2.35-root.io.914.2.30-root.io.714.2.26-root.io.614.2.26-root.io.414.2.30-root.io.1013.4.19-root.io.613.4.19-root.io.714.2.10-root.io.314.2.13-root.io.314.0.4-root.io.614.2.3-root.io.114.0.4-root.io.914.2.25-root.io.214.2.24-root.io.214.1.0-root.io.414.2.18-root.io.213.3.0-root.io.514.0.4-root.io.514.0.4-root.io.714.0.4-root.io.214.1.0-root.io.714.1.0-root.io.814.0.4-root.io.314.2.13-root.io.114.2.3-root.io.514.2.0-root.io.214.0.3-root.io.314.2.5-root.io.914.2.5-root.io.1014.2.2-root.io.714.2.10-root.io.114.2.29-root.io.514.2.31-root.io.214.2.18-root.io.114.0.0-root.io.714.2.10-root.io.414.2.13-root.io.414.2.10-root.io.214.2.18-root.io.614.2.21-root.io.614.2.16-root.io.614.1.4-root.io.514.2.25-root.io.113.2.4-root.io.314.2.0-root.io.614.0.4-root.io.414.2.31-root.io.514.2.0-root.io.514.2.2-root.io.914.2.30-root.io.813.1.6-root.io.113.2.4-root.io.414.0.3-root.io.614.0.0-root.io.514.2.5-root.io.214.2.5-root.io.315.5.15-root.io.116.1.6-root.io.314.2.3-root.io.313.5.4-root.io.513.5.11-root.io.714.2.5-root.io.413.3.0-root.io.614.2.30-root.io.314.0.3-root.io.414.2.13-root.io.214.2.5-root.io.614.2.21-root.io.414.0.0-root.io.314.1.4-root.io.714.2.21-root.io.214.2.16-root.io.214.2.16-root.io.413.5.4-root.io.214.2.30-root.io.413.2.4-root.io.513.3.0-root.io.714.2.26-root.io.314.0.3-root.io.514.2.30-root.io.915.5.10-root.io.414.1.4-root.io.813.5.4-root.io.614.2.16-root.io.514.0.0-root.io.614.2.21-root.io.514.2.5-root.io.714.2.3-root.io.414.2.2-root.io.813.4.19-root.io.414.2.15-root.io.514.2.30-root.io.514.2.3-root.io.215.5.10-root.io.514.2.28-root.io.514.1.4-root.io.913.2.4-root.io.216.1.6-root.io.416.1.7-root.io.113.5.6-root.io.514.2.15-root.io.616.1.6-root.io.513.2.4-root.io.715.5.15-root.io.214.1.3-root.io.814.2.32-root.io.814.2.29-root.io.414.2.33-root.io.513.5.6-root.io.613.5.11-root.io.814.2.26-root.io.515.5.10-root.io.614.2.26-root.io.214.0.4-root.io.814.2.28-root.io.314.2.31-root.io.314.1.4-root.io.614.2.18-root.io.313.3.0-root.io.414.1.0-root.io.516.1.7-root.io.214.2.16-root.io.314.0.0-root.io.414.1.0-root.io.313.5.11-root.io.614.2.18-root.io.413.5.4-root.io.314.2.31-root.io.114.1.4-root.io.314.2.0-root.io.313.4.19-root.io.514.2.31-root.io.415.5.15-root.io.316.1.6-root.io.614.1.4-root.io.413.5.4-root.io.415.5.15-root.io.416.1.6-root.io.716.1.7-root.io.313.3.0-root.io.813.1.6-root.io.214.2.21-root.io.313.2.4-root.io.613.5.11-root.io.914.2.0-root.io.414.2.30-root.io.614.2.33-root.io.614.2.28-root.io.414.1.0-root.io.615.5.10-root.io.313.5.6-root.io.716.1.6-root.io.814.2.18-root.io.514.2.35-root.io.1014.2.35-root.io.1116.2.5-root.io.116.2.5-root.io.316.2.5-root.io.214.2.33-root.io.214.2.32-root.io.414.2.15-root.io.414.1.3-root.io.214.2.15-root.io.314.2.32-root.io.114.2.33-root.io.114.1.3-root.io.514.2.29-root.io.114.2.32-root.io.514.2.33-root.io.314.2.2-root.io.514.2.2-root.io.614.2.30-root.io.114.2.30-root.io.214.1.3-root.io.614.2.35-root.io.514.2.33-root.io.414.2.35-root.io.314.2.32-root.io.614.2.35-root.io.614.1.3-root.io.714.2.32-root.io.214.2.32-root.io.714.2.28-root.io.114.2.35-root.io.214.2.28-root.io.214.2.35-root.io.714.0.0-root.io.214.2.29-root.io.214.2.21-root.io.114.1.3-root.io.314.2.16-root.io.114.2.32-root.io.314.2.29-root.io.314.1.3-root.io.414.2.35-root.io.814.2.35-root.io.414.2.35-root.io.1 |
nextRoot:npm |
before 14.2.33-aikido.2 | 14.2.33-aikido.214.2.32-aikido.414.2.30-aikido.714.2.26-aikido.614.2.26-aikido.414.2.30-aikido.1013.4.19-aikido.613.4.19-aikido.714.2.10-aikido.314.2.13-aikido.314.2.3-aikido.114.2.15-aikido.414.0.4-aikido.914.1.3-aikido.214.2.25-aikido.214.1.0-aikido.414.2.18-aikido.213.3.0-aikido.514.2.15-aikido.313.4.19-aikido.314.1.0-aikido.714.1.0-aikido.814.2.13-aikido.114.2.3-aikido.514.2.0-aikido.214.0.3-aikido.314.2.5-aikido.914.2.5-aikido.1014.2.2-aikido.714.2.33-aikido.114.1.3-aikido.514.2.29-aikido.114.2.29-aikido.514.2.31-aikido.214.2.18-aikido.114.0.0-aikido.714.2.10-aikido.414.2.13-aikido.414.2.10-aikido.214.2.18-aikido.614.2.21-aikido.614.2.16-aikido.614.2.25-aikido.114.2.0-aikido.614.2.31-aikido.514.2.0-aikido.514.2.2-aikido.914.2.30-aikido.814.2.24-aikido.714.0.3-aikido.614.2.32-aikido.514.2.33-aikido.314.0.0-aikido.514.2.3-aikido.313.5.4-aikido.514.1.3-aikido.613.3.0-aikido.614.0.3-aikido.414.2.13-aikido.214.2.21-aikido.414.0.0-aikido.314.1.4-aikido.714.2.21-aikido.213.3.0-aikido.214.2.16-aikido.214.2.16-aikido.413.5.4-aikido.213.3.0-aikido.714.2.33-aikido.414.2.26-aikido.314.0.3-aikido.514.2.30-aikido.914.1.4-aikido.814.2.32-aikido.613.5.4-aikido.614.1.3-aikido.714.2.16-aikido.514.0.0-aikido.614.2.21-aikido.514.2.3-aikido.414.2.2-aikido.813.4.19-aikido.414.2.15-aikido.514.2.3-aikido.213.5.6-aikido.414.2.28-aikido.514.2.32-aikido.214.1.4-aikido.914.1.3-aikido.113.3.0-aikido.314.2.32-aikido.713.5.6-aikido.514.2.15-aikido.614.1.3-aikido.814.2.32-aikido.814.2.29-aikido.414.2.28-aikido.114.2.33-aikido.513.5.6-aikido.614.2.26-aikido.514.2.28-aikido.214.2.26-aikido.214.0.4-aikido.814.2.28-aikido.314.1.0-aikido.214.2.31-aikido.314.2.24-aikido.614.1.4-aikido.614.2.18-aikido.313.3.0-aikido.414.1.0-aikido.514.2.16-aikido.314.0.0-aikido.414.1.0-aikido.314.2.18-aikido.413.5.4-aikido.314.2.31-aikido.114.2.0-aikido.313.4.19-aikido.514.2.31-aikido.414.2.29-aikido.214.2.0-aikido.113.5.4-aikido.414.2.21-aikido.114.2.16-aikido.114.1.3-aikido.313.3.0-aikido.814.2.21-aikido.314.2.32-aikido.314.2.29-aikido.313.5.11-aikido.914.1.3-aikido.414.2.0-aikido.414.2.30-aikido.614.2.28-aikido.414.2.33-aikido.614.1.0-aikido.614.2.18-aikido.513.5.6-aikido.7 |
@rootio/nextRoot:npm |
before 14.2.33-root.io.2 | 14.2.33-root.io.214.2.32-root.io.414.2.30-root.io.714.2.26-root.io.614.2.26-root.io.414.2.30-root.io.1013.4.19-root.io.613.4.19-root.io.714.2.10-root.io.314.2.13-root.io.314.2.3-root.io.114.2.15-root.io.414.0.4-root.io.914.1.3-root.io.214.2.25-root.io.214.1.0-root.io.414.2.18-root.io.213.3.0-root.io.514.2.15-root.io.313.4.19-root.io.314.1.0-root.io.714.1.0-root.io.814.2.13-root.io.114.2.3-root.io.514.2.0-root.io.214.0.3-root.io.314.2.5-root.io.914.2.5-root.io.1014.2.2-root.io.714.2.33-root.io.114.1.3-root.io.514.2.29-root.io.114.2.29-root.io.514.2.31-root.io.214.2.18-root.io.114.0.0-root.io.714.2.10-root.io.414.2.13-root.io.414.2.10-root.io.214.2.18-root.io.614.2.21-root.io.614.2.16-root.io.614.2.25-root.io.114.2.0-root.io.614.2.31-root.io.514.2.0-root.io.514.2.2-root.io.914.2.30-root.io.814.2.24-root.io.714.0.3-root.io.614.2.32-root.io.514.2.33-root.io.314.0.0-root.io.514.2.3-root.io.313.5.4-root.io.514.1.3-root.io.613.3.0-root.io.614.0.3-root.io.414.2.13-root.io.214.2.21-root.io.414.0.0-root.io.314.1.4-root.io.714.2.21-root.io.213.3.0-root.io.214.2.16-root.io.214.2.16-root.io.413.5.4-root.io.213.3.0-root.io.714.2.33-root.io.414.2.26-root.io.314.0.3-root.io.514.2.30-root.io.914.1.4-root.io.814.2.32-root.io.613.5.4-root.io.614.1.3-root.io.714.2.16-root.io.514.0.0-root.io.614.2.21-root.io.514.2.3-root.io.414.2.2-root.io.813.4.19-root.io.414.2.15-root.io.514.2.3-root.io.213.5.6-root.io.414.2.28-root.io.514.2.32-root.io.214.1.4-root.io.914.1.3-root.io.113.3.0-root.io.314.2.32-root.io.713.5.6-root.io.514.2.15-root.io.614.1.3-root.io.814.2.32-root.io.814.2.29-root.io.414.2.28-root.io.114.2.33-root.io.513.5.6-root.io.614.2.26-root.io.514.2.28-root.io.214.2.26-root.io.214.0.4-root.io.814.2.28-root.io.314.2.24-root.io.614.1.0-root.io.214.2.31-root.io.314.1.4-root.io.614.2.18-root.io.313.3.0-root.io.414.1.0-root.io.514.2.16-root.io.314.0.0-root.io.414.1.0-root.io.314.2.18-root.io.413.5.4-root.io.314.2.31-root.io.114.2.0-root.io.313.4.19-root.io.514.2.31-root.io.414.2.29-root.io.214.2.0-root.io.113.5.4-root.io.414.2.21-root.io.114.1.3-root.io.314.2.16-root.io.113.3.0-root.io.814.2.21-root.io.314.2.32-root.io.314.2.29-root.io.313.5.11-root.io.914.1.3-root.io.414.2.0-root.io.414.2.30-root.io.614.2.33-root.io.614.2.28-root.io.414.1.0-root.io.613.5.6-root.io.714.2.18-root.io.5 |
nextRoot:npm |
before 14.2.5-aikido.8 | 14.2.5-aikido.814.2.33-aikido.214.2.32-aikido.414.2.35-aikido.914.2.30-aikido.714.2.26-aikido.614.2.26-aikido.414.2.30-aikido.1013.4.19-aikido.613.4.19-aikido.714.2.10-aikido.314.2.13-aikido.314.0.4-aikido.614.0.4-aikido.913.4.19-aikido.214.1.3-aikido.214.2.24-aikido.214.2.25-aikido.214.1.0-aikido.413.3.0-aikido.513.4.19-aikido.314.0.4-aikido.514.0.4-aikido.714.1.0-aikido.714.1.0-aikido.814.2.32-aikido.114.2.3-aikido.514.0.3-aikido.314.2.5-aikido.914.2.5-aikido.1014.2.2-aikido.714.2.33-aikido.114.1.3-aikido.514.2.29-aikido.114.2.29-aikido.514.2.31-aikido.214.0.0-aikido.714.2.10-aikido.414.2.13-aikido.414.2.18-aikido.614.2.21-aikido.614.2.16-aikido.614.2.25-aikido.114.2.0-aikido.614.2.31-aikido.514.2.2-aikido.914.2.30-aikido.813.1.6-aikido.114.2.24-aikido.714.2.24-aikido.414.0.3-aikido.614.2.32-aikido.514.2.33-aikido.314.0.0-aikido.514.2.3-aikido.314.2.2-aikido.414.2.2-aikido.513.5.11-aikido.714.2.2-aikido.613.5.4-aikido.514.0.0-aikido.114.1.3-aikido.613.3.0-aikido.113.3.0-aikido.613.4.19-aikido.114.0.3-aikido.413.5.11-aikido.414.0.3-aikido.114.2.21-aikido.413.5.6-aikido.114.0.0-aikido.314.1.4-aikido.713.5.4-aikido.114.2.21-aikido.213.3.0-aikido.214.2.16-aikido.214.2.16-aikido.413.5.4-aikido.214.2.35-aikido.513.5.6-aikido.214.2.30-aikido.413.3.0-aikido.714.2.33-aikido.414.2.26-aikido.314.0.3-aikido.514.2.30-aikido.915.5.10-aikido.414.1.4-aikido.814.2.35-aikido.314.2.32-aikido.614.2.35-aikido.613.5.4-aikido.614.2.24-aikido.514.1.3-aikido.714.2.16-aikido.514.0.0-aikido.614.2.21-aikido.514.2.3-aikido.414.2.2-aikido.813.4.19-aikido.414.2.15-aikido.514.2.30-aikido.514.2.3-aikido.213.5.6-aikido.313.5.6-aikido.415.5.10-aikido.514.2.28-aikido.514.2.24-aikido.114.2.32-aikido.214.1.4-aikido.916.1.6-aikido.414.1.3-aikido.116.1.7-aikido.113.3.0-aikido.314.2.32-aikido.713.5.6-aikido.514.2.15-aikido.616.1.6-aikido.514.1.3-aikido.813.2.4-aikido.714.2.32-aikido.814.2.29-aikido.414.2.35-aikido.214.2.33-aikido.513.5.6-aikido.613.5.11-aikido.814.2.26-aikido.515.5.10-aikido.614.0.4-aikido.814.2.28-aikido.314.2.31-aikido.314.2.24-aikido.614.1.4-aikido.614.2.35-aikido.714.2.18-aikido.313.3.0-aikido.414.1.0-aikido.516.1.7-aikido.214.2.16-aikido.314.0.0-aikido.413.5.11-aikido.514.1.0-aikido.313.5.11-aikido.614.2.18-aikido.413.5.4-aikido.313.4.19-aikido.514.0.0-aikido.216.1.6-aikido.614.2.31-aikido.414.2.29-aikido.213.5.4-aikido.414.2.21-aikido.116.1.6-aikido.716.1.7-aikido.314.1.3-aikido.313.3.0-aikido.814.2.24-aikido.313.1.6-aikido.214.2.21-aikido.314.2.32-aikido.314.2.29-aikido.313.5.11-aikido.914.0.3-aikido.214.1.3-aikido.414.2.30-aikido.614.2.28-aikido.414.2.33-aikido.614.1.0-aikido.614.2.35-aikido.814.2.35-aikido.415.5.10-aikido.316.1.6-aikido.814.2.18-aikido.513.5.6-aikido.714.2.35-aikido.1014.2.35-aikido.1115.5.15-aikido.215.5.15-aikido.315.5.15-aikido.4 |
@rootio/nextRoot:npm |
before 14.2.5-root.io.8 | 14.2.5-root.io.814.2.33-root.io.214.2.32-root.io.414.2.35-root.io.914.2.30-root.io.714.2.26-root.io.614.2.26-root.io.414.2.30-root.io.1013.4.19-root.io.613.4.19-root.io.714.2.10-root.io.314.2.13-root.io.314.0.4-root.io.614.0.4-root.io.913.4.19-root.io.214.1.3-root.io.214.2.25-root.io.214.2.24-root.io.214.1.0-root.io.413.3.0-root.io.514.0.4-root.io.513.4.19-root.io.314.0.4-root.io.714.1.0-root.io.714.1.0-root.io.814.2.32-root.io.114.2.3-root.io.514.0.3-root.io.314.2.5-root.io.914.2.5-root.io.1014.2.2-root.io.714.2.33-root.io.114.1.3-root.io.514.2.29-root.io.114.2.29-root.io.514.2.31-root.io.214.0.0-root.io.714.2.10-root.io.414.2.13-root.io.414.2.18-root.io.614.2.21-root.io.614.2.16-root.io.614.2.25-root.io.114.2.0-root.io.614.2.31-root.io.514.2.2-root.io.914.2.30-root.io.813.1.6-root.io.114.2.24-root.io.714.2.24-root.io.414.0.3-root.io.614.2.32-root.io.514.2.33-root.io.314.0.0-root.io.516.1.6-root.io.116.1.6-root.io.216.1.6-root.io.314.2.3-root.io.314.2.2-root.io.413.5.4-root.io.514.2.2-root.io.513.5.11-root.io.714.2.2-root.io.614.0.0-root.io.114.1.3-root.io.613.3.0-root.io.113.3.0-root.io.613.4.19-root.io.114.0.3-root.io.413.5.11-root.io.414.0.3-root.io.114.2.21-root.io.413.5.6-root.io.114.0.0-root.io.314.1.4-root.io.713.5.4-root.io.114.2.21-root.io.213.3.0-root.io.214.2.16-root.io.214.2.16-root.io.413.5.4-root.io.214.2.35-root.io.513.5.6-root.io.214.2.30-root.io.413.3.0-root.io.714.2.33-root.io.414.2.26-root.io.314.0.3-root.io.514.2.30-root.io.915.5.10-root.io.414.1.4-root.io.814.2.35-root.io.314.2.32-root.io.614.2.35-root.io.613.5.4-root.io.614.2.24-root.io.514.1.3-root.io.714.2.16-root.io.514.0.0-root.io.614.2.21-root.io.514.2.3-root.io.414.2.2-root.io.813.4.19-root.io.414.2.15-root.io.514.2.30-root.io.514.2.3-root.io.213.5.6-root.io.313.5.6-root.io.415.5.10-root.io.514.2.28-root.io.514.2.24-root.io.114.2.32-root.io.214.1.4-root.io.916.1.6-root.io.414.1.3-root.io.116.1.7-root.io.113.3.0-root.io.314.2.32-root.io.713.5.6-root.io.514.2.15-root.io.616.1.6-root.io.513.2.4-root.io.714.1.3-root.io.814.2.32-root.io.814.2.29-root.io.414.2.33-root.io.514.2.35-root.io.213.5.6-root.io.613.5.11-root.io.814.2.26-root.io.515.5.10-root.io.614.0.4-root.io.814.2.28-root.io.314.2.24-root.io.614.2.31-root.io.314.2.35-root.io.714.1.4-root.io.614.2.18-root.io.313.3.0-root.io.414.1.0-root.io.516.1.7-root.io.214.2.16-root.io.314.0.0-root.io.413.5.11-root.io.514.1.0-root.io.313.5.11-root.io.614.2.18-root.io.413.5.4-root.io.313.4.19-root.io.514.0.0-root.io.214.2.31-root.io.416.1.6-root.io.614.2.29-root.io.213.5.4-root.io.414.2.21-root.io.114.1.3-root.io.316.1.6-root.io.716.1.7-root.io.313.3.0-root.io.814.2.24-root.io.313.1.6-root.io.214.2.21-root.io.314.2.32-root.io.314.2.29-root.io.313.5.11-root.io.914.0.3-root.io.214.1.3-root.io.414.2.30-root.io.614.2.33-root.io.614.2.28-root.io.414.1.0-root.io.614.2.35-root.io.814.2.35-root.io.415.5.10-root.io.313.5.6-root.io.716.1.6-root.io.814.2.18-root.io.514.2.35-root.io.1014.2.35-root.io.1115.5.15-root.io.115.5.15-root.io.215.5.15-root.io.315.5.15-root.io.4 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | ||
| affected, aliases | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-44582 is a low vulnerability (CVSS 3.7) in Vercel Next.js, published December 11, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.21%, the 11th percentile. Fixed in next 15.5.16.
References
github.com/vercel/next.js/security/advisories/GHSA-vfv6-92ff-j949
nvd.nist.gov/vuln/detail/CVE-2026-23870
Show 21 moreShow less
vercel.com/changelog/summary-of-cve-2026-23864
nextjs.org/blog/security-update-2025-12-11
cve.org/CVERecord?id=CVE-2025-55184