CVE-2026-64646
Next.js: Unbounded Server Action payload in Edge runtime
Next.js is a React framework for building full-stack web applications. In versions 13.0.0 through 15.5.20 and 16.0.0 through 16.2.10, requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive memory consumption if that Server Actions uses the Edge runtime. This issue has been fixed in versions 15.5.21 and 16.2.11.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Next.js: Unbounded Server Action payload in Edge runtime
Next.js is a React framework for building full-stack web applications. In versions 13.0.0 through 15.5.20 and 16.0.0 through 16.2.10, requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive memory consumption if that Server Actions uses the Edge runtime. This issue has been fixed in versions 15.5.21 and 16.2.11.
- Record
CVE-2026-64646- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N - Weakness
- CWE-770
- Updated
- 2026-11-02
EUVDEUVD-2026-49401
Next.js is a React framework for building full-stack web applications. In versions 13.0.0 through 15.5.20 and 16.0.0 through 16.2.10, requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive memory consumption if that Server Actions uses the Edge runtime. This issue has been fixed in versions 15.5.21 and 16.2.11.
- Record
EUVD-2026-49401- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-4c39-4ccg-62r3
Next.js: Unbounded Server Action payload in Edge runtime
Impact
Requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive memory consumption if that Server Actions uses the Edge runtime
Workarounds
If you cannot upgrade, ensure your hosting provider limits the request's body size. 5 MiB should be allowed at max by your hosting provider.
- Record
GHSA-4c39-4ccg-62r3- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N - Weakness
- CWE-770
- Updated
- 2026-11-02
GitHub AdvisoriesGHSA-8h8q-6873-q5fj
Next.js Vulnerable to Denial of Service with Server Components
A vulnerability affects certain React Server Components packages for versions 19.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. The issue is tracked upstream as CVE-2026-23870.
A specially crafted HTTP request can be sent to any App Router Server Function endpoint that, when deserialized, may trigger excessive CPU usage. This can result in denial of service in unpatched environments.
- Record
GHSA-8h8q-6873-q5fj- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-02
GitHub AdvisoriesGHSA-h25m-26qc-wcjf
Next.js HTTP request deserialization can lead to DoS when using insecure React Server Components
A vulnerability affects certain React Server Components packages for versions 19.0.x, 19.1.x, and 19.2.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. The issue is tracked upstream as CVE-2026-23864.
A specially crafted HTTP request can be sent to any App Router Server Function endpoint that, when deserialized, may trigger excessive CPU usage, out-of-memory exceptions, or server crashes. This can result in denial of service in unpatched environments.
- Record
GHSA-h25m-26qc-wcjf- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400, CWE-502
- Updated
- 2026-11-02
GitHub AdvisoriesGHSA-q4gf-8mx6-v5v3
Next.js has a Denial of Service with Server Components
A vulnerability affects certain React Server Components packages for versions 19.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. The issue is tracked upstream as CVE-2026-23869. You can read more about this advisory our this changelog.
A specially crafted HTTP request can be sent to any App Router Server Function endpoint that, when deserialized, may trigger excessive CPU usage. This can result in denial of service in unpatched environments.
- Record
GHSA-q4gf-8mx6-v5v3- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-02
Show 35 moreShow less
NVD
Next.js is a React framework for building full-stack web applications. In versions 13.0.0 through 15.5.20 and 16.0.0 through 16.2.10, requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive memory consumption if that Server Actions uses the Edge runtime. This issue has been fixed in versions 15.5.21 and 16.2.11.
- Record
CVE-2026-64646- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-770
- Updated
- 2026-11-02
OSV
Next.js: Unbounded Server Action payload in Edge runtime
Next.js is a React framework for building full-stack web applications. In versions 13.0.0 through 15.5.20 and 16.0.0 through 16.2.10, requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive memory consumption if that Server Actions uses the Edge runtime. This issue has been fixed in versions 15.5.21 and 16.2.11.
- Record
CVE-2026-64646- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N - Weakness
- CWE-770
- Updated
- 2026-11-02
OSVGHSA-4c39-4ccg-62r3
Next.js: Unbounded Server Action payload in Edge runtime
Impact
Requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive memory consumption if that Server Actions uses the Edge runtime
Workarounds
If you cannot upgrade, ensure your hosting provider limits the request's body size. 5 MiB should be allowed at max by your hosting provider.
- Record
GHSA-4c39-4ccg-62r3- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N - Weakness
- CWE-770
- Updated
- 2026-11-02
OSVGHSA-8h8q-6873-q5fj
Next.js Vulnerable to Denial of Service with Server Components
A vulnerability affects certain React Server Components packages for versions 19.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. The issue is tracked upstream as CVE-2026-23870.
A specially crafted HTTP request can be sent to any App Router Server Function endpoint that, when deserialized, may trigger excessive CPU usage. This can result in denial of service in unpatched environments.
- Record
GHSA-8h8q-6873-q5fj- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-02
OSVGHSA-h25m-26qc-wcjf
Next.js HTTP request deserialization can lead to DoS when using insecure React Server Components
A vulnerability affects certain React Server Components packages for versions 19.0.x, 19.1.x, and 19.2.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. The issue is tracked upstream as CVE-2026-23864.
A specially crafted HTTP request can be sent to any App Router Server Function endpoint that, when deserialized, may trigger excessive CPU usage, out-of-memory exceptions, or server crashes. This can result in denial of service in unpatched environments.
- Record
GHSA-h25m-26qc-wcjf- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400, CWE-502
- Updated
- 2026-11-02
OSVGHSA-q4gf-8mx6-v5v3
Next.js has a Denial of Service with Server Components
A vulnerability affects certain React Server Components packages for versions 19.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. The issue is tracked upstream as CVE-2026-23869. You can read more about this advisory our this changelog.
A specially crafted HTTP request can be sent to any App Router Server Function endpoint that, when deserialized, may trigger excessive CPU usage. This can result in denial of service in unpatched environments.
- Record
GHSA-q4gf-8mx6-v5v3- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-02
OSVCLSA-2026-1786360051 No score
TuxCare security update for 13 packages (13 CVEs)
TuxCare rebuilt 13 packages to address 13 CVEs. Fixed in 13.5.11-tuxcare.14.
- Record
CLSA-2026-1786360051- Updated
- 2026-11-02
OSVCLSA-2026-1786538556 No score
TuxCare security update for 13 packages (3 CVEs)
TuxCare rebuilt 13 packages to address 3 CVEs. Fixed in 14.2.35-tuxcare.6.
- Record
CLSA-2026-1786538556- Updated
- 2026-11-02
OSVCLSA-2026-1791807020 No score
TuxCare security update for 9 packages (28 CVEs)
TuxCare rebuilt 9 packages to address 28 CVEs. Fixed in 15.1.2-tuxcare.2.
- Record
CLSA-2026-1791807020- Updated
- 2026-11-02
OSVCLSA-2026-1792195727 No score
TuxCare security update for create-next-app (13 CVEs)
TuxCare rebuilt create-next-app to address 13 CVEs. Fixed in 13.5.11-tuxcare.14.
- Record
CLSA-2026-1792195727- Updated
- 2026-11-02
OSVCLSA-2026-1792195748 No score
TuxCare security update for create-next-app (3 CVEs)
TuxCare rebuilt create-next-app to address 3 CVEs. Fixed in 14.2.35-tuxcare.6.
- Record
CLSA-2026-1792195748- Updated
- 2026-11-02
OSVCLSA-2026-1792196726 No score
TuxCare security update for @next/eslint-plugin-next (13 CVEs)
TuxCare rebuilt @next/eslint-plugin-next to address 13 CVEs. Fixed in 13.5.11-tuxcare.14.
- Record
CLSA-2026-1792196726- Updated
- 2026-11-02
OSVCLSA-2026-1792196877 No score
TuxCare security update for @next/eslint-plugin-next (3 CVEs)
TuxCare rebuilt @next/eslint-plugin-next to address 3 CVEs. Fixed in 14.2.35-tuxcare.6.
- Record
CLSA-2026-1792196877- Updated
- 2026-11-02
OSVCLSA-2026-1792206290 No score
TuxCare security update for @next/bundle-analyzer (13 CVEs)
TuxCare rebuilt @next/bundle-analyzer to address 13 CVEs. Fixed in 13.5.11-tuxcare.14.
- Record
CLSA-2026-1792206290- Updated
- 2026-11-02
OSVCLSA-2026-1792206303 No score
TuxCare security update for @next/bundle-analyzer (3 CVEs)
TuxCare rebuilt @next/bundle-analyzer to address 3 CVEs. Fixed in 14.2.35-tuxcare.6.
- Record
CLSA-2026-1792206303- Updated
- 2026-11-02
OSVCLSA-2026-1792272230 No score
TuxCare security update for @next/plugin-storybook (13 CVEs)
TuxCare rebuilt @next/plugin-storybook to address 13 CVEs. Fixed in 13.5.11-tuxcare.14.
- Record
CLSA-2026-1792272230- Updated
- 2026-11-02
OSVCLSA-2026-1792272243 No score
TuxCare security update for @next/plugin-storybook (3 CVEs)
TuxCare rebuilt @next/plugin-storybook to address 3 CVEs. Fixed in 14.2.35-tuxcare.6.
- Record
CLSA-2026-1792272243- Updated
- 2026-11-02
OSVCLSA-2026-1792293000 No score
TuxCare security update for @next/polyfill-module (13 CVEs)
TuxCare rebuilt @next/polyfill-module to address 13 CVEs. Fixed in 13.5.11-tuxcare.14.
- Record
CLSA-2026-1792293000- Updated
- 2026-11-02
OSVCLSA-2026-1792293014 No score
TuxCare security update for @next/polyfill-module (3 CVEs)
TuxCare rebuilt @next/polyfill-module to address 3 CVEs. Fixed in 14.2.35-tuxcare.6.
- Record
CLSA-2026-1792293014- Updated
- 2026-11-02
OSVCLSA-2026-1792304720 No score
TuxCare security update for @next/polyfill-nomodule (13 CVEs)
TuxCare rebuilt @next/polyfill-nomodule to address 13 CVEs. Fixed in 13.5.11-tuxcare.14.
- Record
CLSA-2026-1792304720- Updated
- 2026-11-02
OSVCLSA-2026-1792304721 No score
TuxCare security update for @next/polyfill-nomodule (3 CVEs)
TuxCare rebuilt @next/polyfill-nomodule to address 3 CVEs. Fixed in 14.2.35-tuxcare.6.
- Record
CLSA-2026-1792304721- Updated
- 2026-11-02
OSVCLSA-2026-1792326296 No score
TuxCare security update for @next/react-refresh-utils (3 CVEs)
TuxCare rebuilt @next/react-refresh-utils to address 3 CVEs. Fixed in 14.2.35-tuxcare.6.
- Record
CLSA-2026-1792326296- Updated
- 2026-11-02
OSVCLSA-2026-1792326302 No score
TuxCare security update for @next/react-refresh-utils (13 CVEs)
TuxCare rebuilt @next/react-refresh-utils to address 13 CVEs. Fixed in 13.5.11-tuxcare.14.
- Record
CLSA-2026-1792326302- Updated
- 2026-11-02
OSVCLSA-2026-1792338232 No score
TuxCare security update for @next/third-parties (13 CVEs)
TuxCare rebuilt @next/third-parties to address 13 CVEs. Fixed in 13.5.11-tuxcare.14.
- Record
CLSA-2026-1792338232- Updated
- 2026-11-02
OSVCLSA-2026-1792338236 No score
TuxCare security update for @next/third-parties (3 CVEs)
TuxCare rebuilt @next/third-parties to address 3 CVEs. Fixed in 14.2.35-tuxcare.6.
- Record
CLSA-2026-1792338236- Updated
- 2026-11-02
OSVCLSA-2026-1792346490 No score
TuxCare security update for @next/swc-linux-x64-gnu (28 CVEs)
TuxCare rebuilt @next/swc-linux-x64-gnu to address 28 CVEs. Fixed in 15.1.2-tuxcare.2.
- Record
CLSA-2026-1792346490- Updated
- 2026-11-02
OSVCLSA-2026-1792358596 No score
TuxCare security update for @next/codemod (13 CVEs)
TuxCare rebuilt @next/codemod to address 13 CVEs. Fixed in 13.5.11-tuxcare.14.
- Record
CLSA-2026-1792358596- Updated
- 2026-11-02
OSVCLSA-2026-1792358597 No score
TuxCare security update for @next/codemod (3 CVEs)
TuxCare rebuilt @next/codemod to address 3 CVEs. Fixed in 14.2.35-tuxcare.6.
- Record
CLSA-2026-1792358597- Updated
- 2026-11-02
OSVCLSA-2026-1792364002 No score
TuxCare security update for @next/mdx (13 CVEs)
TuxCare rebuilt @next/mdx to address 13 CVEs. Fixed in 13.5.11-tuxcare.14.
- Record
CLSA-2026-1792364002- Updated
- 2026-11-02
OSVCLSA-2026-1792364003 No score
TuxCare security update for @next/mdx (3 CVEs)
TuxCare rebuilt @next/mdx to address 3 CVEs. Fixed in 14.2.35-tuxcare.6.
- Record
CLSA-2026-1792364003- Updated
- 2026-11-02
OSVCLSA-2026-1792367406 No score
TuxCare security update for @next/swc-linux-arm64-gnu (28 CVEs)
TuxCare rebuilt @next/swc-linux-arm64-gnu to address 28 CVEs. Fixed in 15.1.2-tuxcare.2.
- Record
CLSA-2026-1792367406- Updated
- 2026-11-02
OSVROOT-APP-NPM-CVE-2026-64646 No score
CVE-2026-64646 in next - Patched by Root
Root has patched CVE-2026-64646 in the next package for Root:npm. Multiple fixed versions available.
- Record
ROOT-APP-NPM-CVE-2026-64646- Updated
- 2026-11-02
OSVROOT-APP-NPM-GHSA-8h8q-6873-q5fj No score
GHSA-8h8q-6873-q5fj in next - Patched by Root
Root has patched GHSA-8h8q-6873-q5fj in the next package for Root:npm. Multiple fixed versions available.
- Record
ROOT-APP-NPM-GHSA-8h8q-6873-q5fj- Updated
- 2026-11-02
OSVROOT-APP-NPM-GHSA-h25m-26qc-wcjf No score
GHSA-h25m-26qc-wcjf in next - Patched by Root
Root has patched GHSA-h25m-26qc-wcjf in the next package for Root:npm. Multiple fixed versions available.
- Record
ROOT-APP-NPM-GHSA-h25m-26qc-wcjf- Updated
- 2026-11-02
OSVROOT-APP-NPM-GHSA-q4gf-8mx6-v5v3 No score
GHSA-q4gf-8mx6-v5v3 in next - Patched by Root
Root has patched GHSA-q4gf-8mx6-v5v3 in the next package for Root:npm. Multiple fixed versions available.
- Record
ROOT-APP-NPM-GHSA-q4gf-8mx6-v5v3- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
nextnpm |
13.0.0 up to 15.5.21 | 15.5.21 |
nextnpm |
16.0.0 up to 16.2.11 | 16.2.11 |
nextnpm |
13.0.0 up to 15.5.16 | 15.5.16 |
nextnpm |
16.0.0 up to 16.2.5 | 16.2.5 |
nextnpm |
13.0.0 up to 15.0.8 | 15.0.8 |
nextnpm |
15.1.1-canary.0 up to 15.1.12 | 15.1.12 |
nextnpm |
15.2.0-canary.0 up to 15.2.9 | 15.2.9 |
nextnpm |
15.3.0-canary.0 up to 15.3.9 | 15.3.9 |
nextnpm |
15.4.0-canary.0 up to 15.4.11 | 15.4.11 |
nextnpm |
15.5.1-canary.0 up to 15.5.10 | 15.5.10 |
Show 33 moreShow less
| Package | Affected | Fixed |
|---|---|---|
nextnpm |
15.6.0-canary.0 up to 15.6.0-canary.61 | 15.6.0-canary.61 |
nextnpm |
16.0.0-beta.0 up to 16.0.11 | 16.0.11 |
nextnpm |
16.1.0-canary.0 up to 16.1.5 | 16.1.5 |
nextnpm |
13.0.0 up to 15.5.15 | 15.5.15 |
nextnpm |
16.0.0-beta.0 up to 16.2.3 | 16.2.3 |
create-next-appTuxCare:npm From an advisory covering 11 CVEs |
13.5.11-tuxcare.0 up to 13.5.11-tuxcare.14, plus listed versions 13.5.1113.5.11-tuxcare.13 |
13.5.11-tuxcare.14 |
create-next-appTuxCare:npm From an advisory covering 3 CVEs |
14.2.35-tuxcare.0 up to 14.2.35-tuxcare.6, plus listed versions 14.2.3514.2.35-tuxcare.414.2.35-tuxcare.5 |
14.2.35-tuxcare.6 |
@next/eslint-plugin-nextTuxCare:npm From an advisory covering 11 CVEs |
13.5.11-tuxcare.0 up to 13.5.11-tuxcare.14, plus listed versions 13.5.1113.5.11-tuxcare.13 |
13.5.11-tuxcare.14 |
@next/eslint-plugin-nextTuxCare:npm From an advisory covering 3 CVEs |
14.2.35-tuxcare.0 up to 14.2.35-tuxcare.6, plus listed versions 14.2.3514.2.35-tuxcare.414.2.35-tuxcare.5 |
14.2.35-tuxcare.6 |
@next/bundle-analyzerTuxCare:npm From an advisory covering 11 CVEs |
13.5.11-tuxcare.0 up to 13.5.11-tuxcare.14, plus listed versions 13.5.1113.5.11-tuxcare.13 |
13.5.11-tuxcare.14 |
@next/bundle-analyzerTuxCare:npm From an advisory covering 3 CVEs |
14.2.35-tuxcare.0 up to 14.2.35-tuxcare.6, plus listed versions 14.2.3514.2.35-tuxcare.414.2.35-tuxcare.5 |
14.2.35-tuxcare.6 |
@next/plugin-storybookTuxCare:npm From an advisory covering 11 CVEs |
13.5.11-tuxcare.0 up to 13.5.11-tuxcare.14, plus listed versions 13.5.1113.5.11-tuxcare.13 |
13.5.11-tuxcare.14 |
@next/plugin-storybookTuxCare:npm From an advisory covering 3 CVEs |
14.2.35-tuxcare.0 up to 14.2.35-tuxcare.6, plus listed versions 14.2.3514.2.35-tuxcare.414.2.35-tuxcare.5 |
14.2.35-tuxcare.6 |
@next/polyfill-moduleTuxCare:npm From an advisory covering 11 CVEs |
13.5.11-tuxcare.0 up to 13.5.11-tuxcare.14, plus listed versions 13.5.1113.5.11-tuxcare.13 |
13.5.11-tuxcare.14 |
@next/polyfill-moduleTuxCare:npm From an advisory covering 3 CVEs |
14.2.35-tuxcare.0 up to 14.2.35-tuxcare.6, plus listed versions 14.2.3514.2.35-tuxcare.414.2.35-tuxcare.5 |
14.2.35-tuxcare.6 |
@next/polyfill-nomoduleTuxCare:npm From an advisory covering 11 CVEs |
13.5.11-tuxcare.0 up to 13.5.11-tuxcare.14, plus listed versions 13.5.1113.5.11-tuxcare.13 |
13.5.11-tuxcare.14 |
@next/polyfill-nomoduleTuxCare:npm From an advisory covering 3 CVEs |
14.2.35-tuxcare.0 up to 14.2.35-tuxcare.6, plus listed versions 14.2.3514.2.35-tuxcare.414.2.35-tuxcare.5 |
14.2.35-tuxcare.6 |
@next/react-refresh-utilsTuxCare:npm From an advisory covering 3 CVEs |
14.2.35-tuxcare.0 up to 14.2.35-tuxcare.6, plus listed versions 14.2.3514.2.35-tuxcare.414.2.35-tuxcare.5 |
14.2.35-tuxcare.6 |
@next/react-refresh-utilsTuxCare:npm From an advisory covering 11 CVEs |
13.5.11-tuxcare.0 up to 13.5.11-tuxcare.14, plus listed versions 13.5.1113.5.11-tuxcare.13 |
13.5.11-tuxcare.14 |
@next/third-partiesTuxCare:npm From an advisory covering 11 CVEs |
13.5.11-tuxcare.0 up to 13.5.11-tuxcare.14, plus listed versions 13.5.1113.5.11-tuxcare.13 |
13.5.11-tuxcare.14 |
@next/third-partiesTuxCare:npm From an advisory covering 3 CVEs |
14.2.35-tuxcare.0 up to 14.2.35-tuxcare.6, plus listed versions 14.2.3514.2.35-tuxcare.414.2.35-tuxcare.5 |
14.2.35-tuxcare.6 |
@next/swc-linux-x64-gnuTuxCare:npm From an advisory covering 22 CVEs |
15.1.2-tuxcare.0 up to 15.1.2-tuxcare.2, plus listed versions 15.1.215.1.2-tuxcare.1 |
15.1.2-tuxcare.2 |
@next/codemodTuxCare:npm From an advisory covering 11 CVEs |
13.5.11-tuxcare.0 up to 13.5.11-tuxcare.14, plus listed versions 13.5.1113.5.11-tuxcare.13 |
13.5.11-tuxcare.14 |
@next/codemodTuxCare:npm From an advisory covering 3 CVEs |
14.2.35-tuxcare.0 up to 14.2.35-tuxcare.6, plus listed versions 14.2.3514.2.35-tuxcare.414.2.35-tuxcare.5 |
14.2.35-tuxcare.6 |
@next/mdxTuxCare:npm From an advisory covering 11 CVEs |
13.5.11-tuxcare.0 up to 13.5.11-tuxcare.14, plus listed versions 13.5.1113.5.11-tuxcare.13 |
13.5.11-tuxcare.14 |
@next/mdxTuxCare:npm From an advisory covering 3 CVEs |
14.2.35-tuxcare.0 up to 14.2.35-tuxcare.6, plus listed versions 14.2.3514.2.35-tuxcare.414.2.35-tuxcare.5 |
14.2.35-tuxcare.6 |
@next/swc-linux-arm64-gnuTuxCare:npm From an advisory covering 22 CVEs |
15.1.2-tuxcare.0 up to 15.1.2-tuxcare.2, plus listed versions 15.1.215.1.2-tuxcare.1 |
15.1.2-tuxcare.2 |
nextRoot:npm |
before 15.5.21-aikido.1 | 15.5.21-aikido.116.2.11-aikido.116.2.11-aikido.215.5.21-aikido.2 |
@rootio/nextRoot:npm |
before 15.5.21-root.io.1 | 15.5.21-root.io.116.2.11-root.io.116.2.11-root.io.215.5.21-root.io.2 |
nextRoot:npm |
before 14.2.5-aikido.5 | 14.2.5-aikido.514.2.5-aikido.814.2.35-aikido.914.2.30-aikido.714.2.26-aikido.614.2.26-aikido.414.2.30-aikido.1013.4.19-aikido.613.4.19-aikido.714.2.10-aikido.314.2.13-aikido.314.0.4-aikido.614.2.3-aikido.114.0.4-aikido.914.2.24-aikido.214.2.25-aikido.214.1.0-aikido.414.2.18-aikido.213.3.0-aikido.514.0.4-aikido.514.0.4-aikido.714.0.4-aikido.214.1.0-aikido.714.1.0-aikido.814.0.4-aikido.314.2.13-aikido.114.2.3-aikido.514.2.0-aikido.214.0.3-aikido.314.2.5-aikido.914.2.5-aikido.1014.2.2-aikido.714.2.10-aikido.114.2.29-aikido.514.2.31-aikido.214.2.18-aikido.114.0.0-aikido.714.2.10-aikido.414.2.13-aikido.414.2.10-aikido.214.2.18-aikido.614.2.21-aikido.614.2.16-aikido.614.1.4-aikido.514.2.25-aikido.113.2.4-aikido.314.2.0-aikido.614.0.4-aikido.414.2.31-aikido.514.2.0-aikido.514.2.2-aikido.914.2.30-aikido.813.1.6-aikido.113.2.4-aikido.414.0.3-aikido.614.0.0-aikido.514.2.5-aikido.214.2.5-aikido.314.2.3-aikido.313.5.11-aikido.713.5.4-aikido.514.2.5-aikido.413.3.0-aikido.614.2.30-aikido.314.0.3-aikido.414.2.13-aikido.214.2.5-aikido.614.2.21-aikido.414.0.0-aikido.314.1.4-aikido.714.2.21-aikido.214.2.16-aikido.214.2.16-aikido.413.5.4-aikido.214.2.30-aikido.413.2.4-aikido.513.3.0-aikido.714.2.26-aikido.314.0.3-aikido.514.2.30-aikido.915.5.10-aikido.414.1.4-aikido.813.5.4-aikido.614.2.16-aikido.514.0.0-aikido.614.2.21-aikido.514.2.5-aikido.714.2.3-aikido.414.2.2-aikido.813.4.19-aikido.414.2.15-aikido.514.2.30-aikido.514.2.3-aikido.215.5.10-aikido.514.2.28-aikido.514.1.4-aikido.913.2.4-aikido.216.1.6-aikido.416.1.7-aikido.113.5.6-aikido.514.2.15-aikido.616.1.6-aikido.515.5.15-aikido.214.1.3-aikido.813.2.4-aikido.714.2.32-aikido.814.2.29-aikido.414.2.33-aikido.513.5.6-aikido.613.5.11-aikido.814.2.26-aikido.515.5.10-aikido.614.2.26-aikido.214.0.4-aikido.814.2.28-aikido.314.2.31-aikido.314.1.4-aikido.614.2.18-aikido.313.3.0-aikido.414.1.0-aikido.516.1.7-aikido.214.2.16-aikido.314.0.0-aikido.414.1.0-aikido.313.5.11-aikido.614.2.18-aikido.413.5.4-aikido.314.2.31-aikido.114.1.4-aikido.314.2.0-aikido.313.4.19-aikido.515.5.15-aikido.316.1.6-aikido.614.2.31-aikido.414.1.4-aikido.413.5.4-aikido.415.5.15-aikido.416.1.6-aikido.716.1.7-aikido.313.3.0-aikido.813.1.6-aikido.214.2.21-aikido.313.2.4-aikido.613.5.11-aikido.914.2.0-aikido.414.2.30-aikido.614.2.28-aikido.414.2.33-aikido.614.1.0-aikido.615.5.10-aikido.316.1.6-aikido.814.2.18-aikido.513.5.6-aikido.714.2.35-aikido.1014.2.35-aikido.1116.2.5-aikido.116.2.5-aikido.316.2.5-aikido.214.2.33-aikido.214.2.32-aikido.414.2.15-aikido.414.1.3-aikido.214.2.15-aikido.314.2.32-aikido.114.2.33-aikido.114.1.3-aikido.514.2.29-aikido.114.2.32-aikido.514.2.33-aikido.314.2.2-aikido.514.2.2-aikido.614.2.30-aikido.114.2.30-aikido.214.1.3-aikido.614.2.35-aikido.514.2.33-aikido.414.2.35-aikido.314.2.32-aikido.614.2.35-aikido.614.1.3-aikido.714.2.32-aikido.214.2.32-aikido.714.2.28-aikido.114.2.35-aikido.214.2.28-aikido.214.2.35-aikido.714.0.0-aikido.214.2.29-aikido.214.2.21-aikido.114.2.16-aikido.114.1.3-aikido.314.2.32-aikido.314.2.29-aikido.314.1.3-aikido.414.2.35-aikido.814.2.35-aikido.414.2.35-aikido.1 |
@rootio/nextRoot:npm |
before 14.2.5-root.io.5 | 14.2.5-root.io.514.2.5-root.io.814.2.35-root.io.914.2.30-root.io.714.2.26-root.io.614.2.26-root.io.414.2.30-root.io.1013.4.19-root.io.613.4.19-root.io.714.2.10-root.io.314.2.13-root.io.314.0.4-root.io.614.2.3-root.io.114.0.4-root.io.914.2.25-root.io.214.2.24-root.io.214.1.0-root.io.414.2.18-root.io.213.3.0-root.io.514.0.4-root.io.514.0.4-root.io.714.0.4-root.io.214.1.0-root.io.714.1.0-root.io.814.0.4-root.io.314.2.13-root.io.114.2.3-root.io.514.2.0-root.io.214.0.3-root.io.314.2.5-root.io.914.2.5-root.io.1014.2.2-root.io.714.2.10-root.io.114.2.29-root.io.514.2.31-root.io.214.2.18-root.io.114.0.0-root.io.714.2.10-root.io.414.2.13-root.io.414.2.10-root.io.214.2.18-root.io.614.2.21-root.io.614.2.16-root.io.614.1.4-root.io.514.2.25-root.io.113.2.4-root.io.314.2.0-root.io.614.0.4-root.io.414.2.31-root.io.514.2.0-root.io.514.2.2-root.io.914.2.30-root.io.813.1.6-root.io.113.2.4-root.io.414.0.3-root.io.614.0.0-root.io.514.2.5-root.io.214.2.5-root.io.315.5.15-root.io.116.1.6-root.io.314.2.3-root.io.313.5.4-root.io.513.5.11-root.io.714.2.5-root.io.413.3.0-root.io.614.2.30-root.io.314.0.3-root.io.414.2.13-root.io.214.2.5-root.io.614.2.21-root.io.414.0.0-root.io.314.1.4-root.io.714.2.21-root.io.214.2.16-root.io.214.2.16-root.io.413.5.4-root.io.214.2.30-root.io.413.2.4-root.io.513.3.0-root.io.714.2.26-root.io.314.0.3-root.io.514.2.30-root.io.915.5.10-root.io.414.1.4-root.io.813.5.4-root.io.614.2.16-root.io.514.0.0-root.io.614.2.21-root.io.514.2.5-root.io.714.2.3-root.io.414.2.2-root.io.813.4.19-root.io.414.2.15-root.io.514.2.30-root.io.514.2.3-root.io.215.5.10-root.io.514.2.28-root.io.514.1.4-root.io.913.2.4-root.io.216.1.6-root.io.416.1.7-root.io.113.5.6-root.io.514.2.15-root.io.616.1.6-root.io.513.2.4-root.io.715.5.15-root.io.214.1.3-root.io.814.2.32-root.io.814.2.29-root.io.414.2.33-root.io.513.5.6-root.io.613.5.11-root.io.814.2.26-root.io.515.5.10-root.io.614.2.26-root.io.214.0.4-root.io.814.2.28-root.io.314.2.31-root.io.314.1.4-root.io.614.2.18-root.io.313.3.0-root.io.414.1.0-root.io.516.1.7-root.io.214.2.16-root.io.314.0.0-root.io.414.1.0-root.io.313.5.11-root.io.614.2.18-root.io.413.5.4-root.io.314.2.31-root.io.114.1.4-root.io.314.2.0-root.io.313.4.19-root.io.514.2.31-root.io.415.5.15-root.io.316.1.6-root.io.614.1.4-root.io.413.5.4-root.io.415.5.15-root.io.416.1.6-root.io.716.1.7-root.io.313.3.0-root.io.813.1.6-root.io.214.2.21-root.io.313.2.4-root.io.613.5.11-root.io.914.2.0-root.io.414.2.30-root.io.614.2.33-root.io.614.2.28-root.io.414.1.0-root.io.615.5.10-root.io.313.5.6-root.io.716.1.6-root.io.814.2.18-root.io.514.2.35-root.io.1014.2.35-root.io.1116.2.5-root.io.116.2.5-root.io.316.2.5-root.io.214.2.33-root.io.214.2.32-root.io.414.2.15-root.io.414.1.3-root.io.214.2.15-root.io.314.2.32-root.io.114.2.33-root.io.114.1.3-root.io.514.2.29-root.io.114.2.32-root.io.514.2.33-root.io.314.2.2-root.io.514.2.2-root.io.614.2.30-root.io.114.2.30-root.io.214.1.3-root.io.614.2.35-root.io.514.2.33-root.io.414.2.35-root.io.314.2.32-root.io.614.2.35-root.io.614.1.3-root.io.714.2.32-root.io.214.2.32-root.io.714.2.28-root.io.114.2.35-root.io.214.2.28-root.io.214.2.35-root.io.714.0.0-root.io.214.2.29-root.io.214.2.21-root.io.114.1.3-root.io.314.2.16-root.io.114.2.32-root.io.314.2.29-root.io.314.1.3-root.io.414.2.35-root.io.814.2.35-root.io.414.2.35-root.io.1 |
nextRoot:npm |
before 14.2.5-aikido.8 | 14.2.5-aikido.814.2.33-aikido.214.2.32-aikido.414.2.35-aikido.914.2.30-aikido.714.2.26-aikido.614.2.26-aikido.414.2.30-aikido.1013.4.19-aikido.613.4.19-aikido.714.2.10-aikido.314.2.13-aikido.314.0.4-aikido.614.0.4-aikido.913.4.19-aikido.214.1.3-aikido.214.2.24-aikido.214.2.25-aikido.214.1.0-aikido.413.3.0-aikido.513.4.19-aikido.314.0.4-aikido.514.0.4-aikido.714.1.0-aikido.714.1.0-aikido.814.2.32-aikido.114.2.3-aikido.514.0.3-aikido.314.2.5-aikido.914.2.5-aikido.1014.2.2-aikido.714.2.33-aikido.114.1.3-aikido.514.2.29-aikido.114.2.29-aikido.514.2.31-aikido.214.0.0-aikido.714.2.10-aikido.414.2.13-aikido.414.2.18-aikido.614.2.21-aikido.614.2.16-aikido.614.2.25-aikido.114.2.0-aikido.614.2.31-aikido.514.2.2-aikido.914.2.30-aikido.813.1.6-aikido.114.2.24-aikido.714.2.24-aikido.414.0.3-aikido.614.2.32-aikido.514.2.33-aikido.314.0.0-aikido.514.2.3-aikido.314.2.2-aikido.414.2.2-aikido.513.5.11-aikido.714.2.2-aikido.613.5.4-aikido.514.0.0-aikido.114.1.3-aikido.613.3.0-aikido.113.3.0-aikido.613.4.19-aikido.114.0.3-aikido.413.5.11-aikido.414.0.3-aikido.114.2.21-aikido.413.5.6-aikido.114.0.0-aikido.314.1.4-aikido.713.5.4-aikido.114.2.21-aikido.213.3.0-aikido.214.2.16-aikido.214.2.16-aikido.413.5.4-aikido.214.2.35-aikido.513.5.6-aikido.214.2.30-aikido.413.3.0-aikido.714.2.33-aikido.414.2.26-aikido.314.0.3-aikido.514.2.30-aikido.915.5.10-aikido.414.1.4-aikido.814.2.35-aikido.314.2.32-aikido.614.2.35-aikido.613.5.4-aikido.614.2.24-aikido.514.1.3-aikido.714.2.16-aikido.514.0.0-aikido.614.2.21-aikido.514.2.3-aikido.414.2.2-aikido.813.4.19-aikido.414.2.15-aikido.514.2.30-aikido.514.2.3-aikido.213.5.6-aikido.313.5.6-aikido.415.5.10-aikido.514.2.28-aikido.514.2.24-aikido.114.2.32-aikido.214.1.4-aikido.916.1.6-aikido.414.1.3-aikido.116.1.7-aikido.113.3.0-aikido.314.2.32-aikido.713.5.6-aikido.514.2.15-aikido.616.1.6-aikido.514.1.3-aikido.813.2.4-aikido.714.2.32-aikido.814.2.29-aikido.414.2.35-aikido.214.2.33-aikido.513.5.6-aikido.613.5.11-aikido.814.2.26-aikido.515.5.10-aikido.614.0.4-aikido.814.2.28-aikido.314.2.31-aikido.314.2.24-aikido.614.1.4-aikido.614.2.35-aikido.714.2.18-aikido.313.3.0-aikido.414.1.0-aikido.516.1.7-aikido.214.2.16-aikido.314.0.0-aikido.413.5.11-aikido.514.1.0-aikido.313.5.11-aikido.614.2.18-aikido.413.5.4-aikido.313.4.19-aikido.514.0.0-aikido.216.1.6-aikido.614.2.31-aikido.414.2.29-aikido.213.5.4-aikido.414.2.21-aikido.116.1.6-aikido.716.1.7-aikido.314.1.3-aikido.313.3.0-aikido.814.2.24-aikido.313.1.6-aikido.214.2.21-aikido.314.2.32-aikido.314.2.29-aikido.313.5.11-aikido.914.0.3-aikido.214.1.3-aikido.414.2.30-aikido.614.2.28-aikido.414.2.33-aikido.614.1.0-aikido.614.2.35-aikido.814.2.35-aikido.415.5.10-aikido.316.1.6-aikido.814.2.18-aikido.513.5.6-aikido.714.2.35-aikido.1014.2.35-aikido.1115.5.15-aikido.215.5.15-aikido.315.5.15-aikido.4 |
@rootio/nextRoot:npm |
before 14.2.5-root.io.8 | 14.2.5-root.io.814.2.33-root.io.214.2.32-root.io.414.2.35-root.io.914.2.30-root.io.714.2.26-root.io.614.2.26-root.io.414.2.30-root.io.1013.4.19-root.io.613.4.19-root.io.714.2.10-root.io.314.2.13-root.io.314.0.4-root.io.614.0.4-root.io.913.4.19-root.io.214.1.3-root.io.214.2.25-root.io.214.2.24-root.io.214.1.0-root.io.413.3.0-root.io.514.0.4-root.io.513.4.19-root.io.314.0.4-root.io.714.1.0-root.io.714.1.0-root.io.814.2.32-root.io.114.2.3-root.io.514.0.3-root.io.314.2.5-root.io.914.2.5-root.io.1014.2.2-root.io.714.2.33-root.io.114.1.3-root.io.514.2.29-root.io.114.2.29-root.io.514.2.31-root.io.214.0.0-root.io.714.2.10-root.io.414.2.13-root.io.414.2.18-root.io.614.2.21-root.io.614.2.16-root.io.614.2.25-root.io.114.2.0-root.io.614.2.31-root.io.514.2.2-root.io.914.2.30-root.io.813.1.6-root.io.114.2.24-root.io.714.2.24-root.io.414.0.3-root.io.614.2.32-root.io.514.2.33-root.io.314.0.0-root.io.516.1.6-root.io.116.1.6-root.io.216.1.6-root.io.314.2.3-root.io.314.2.2-root.io.413.5.4-root.io.514.2.2-root.io.513.5.11-root.io.714.2.2-root.io.614.0.0-root.io.114.1.3-root.io.613.3.0-root.io.113.3.0-root.io.613.4.19-root.io.114.0.3-root.io.413.5.11-root.io.414.0.3-root.io.114.2.21-root.io.413.5.6-root.io.114.0.0-root.io.314.1.4-root.io.713.5.4-root.io.114.2.21-root.io.213.3.0-root.io.214.2.16-root.io.214.2.16-root.io.413.5.4-root.io.214.2.35-root.io.513.5.6-root.io.214.2.30-root.io.413.3.0-root.io.714.2.33-root.io.414.2.26-root.io.314.0.3-root.io.514.2.30-root.io.915.5.10-root.io.414.1.4-root.io.814.2.35-root.io.314.2.32-root.io.614.2.35-root.io.613.5.4-root.io.614.2.24-root.io.514.1.3-root.io.714.2.16-root.io.514.0.0-root.io.614.2.21-root.io.514.2.3-root.io.414.2.2-root.io.813.4.19-root.io.414.2.15-root.io.514.2.30-root.io.514.2.3-root.io.213.5.6-root.io.313.5.6-root.io.415.5.10-root.io.514.2.28-root.io.514.2.24-root.io.114.2.32-root.io.214.1.4-root.io.916.1.6-root.io.414.1.3-root.io.116.1.7-root.io.113.3.0-root.io.314.2.32-root.io.713.5.6-root.io.514.2.15-root.io.616.1.6-root.io.513.2.4-root.io.714.1.3-root.io.814.2.32-root.io.814.2.29-root.io.414.2.33-root.io.514.2.35-root.io.213.5.6-root.io.613.5.11-root.io.814.2.26-root.io.515.5.10-root.io.614.0.4-root.io.814.2.28-root.io.314.2.24-root.io.614.2.31-root.io.314.2.35-root.io.714.1.4-root.io.614.2.18-root.io.313.3.0-root.io.414.1.0-root.io.516.1.7-root.io.214.2.16-root.io.314.0.0-root.io.413.5.11-root.io.514.1.0-root.io.313.5.11-root.io.614.2.18-root.io.413.5.4-root.io.313.4.19-root.io.514.0.0-root.io.214.2.31-root.io.416.1.6-root.io.614.2.29-root.io.213.5.4-root.io.414.2.21-root.io.114.1.3-root.io.316.1.6-root.io.716.1.7-root.io.313.3.0-root.io.814.2.24-root.io.313.1.6-root.io.214.2.21-root.io.314.2.32-root.io.314.2.29-root.io.313.5.11-root.io.914.0.3-root.io.214.1.3-root.io.414.2.30-root.io.614.2.33-root.io.614.2.28-root.io.414.1.0-root.io.614.2.35-root.io.814.2.35-root.io.415.5.10-root.io.313.5.6-root.io.716.1.6-root.io.814.2.18-root.io.514.2.35-root.io.1014.2.35-root.io.1115.5.15-root.io.115.5.15-root.io.215.5.15-root.io.315.5.15-root.io.4 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-64646 is a medium vulnerability (CVSS 6.3) in Vercel Next.js, published January 28, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.52%, the 44th percentile. Fixed in next 15.5.21.
References
github.com/vercel/next.js/security/advisories/GHSA-4c39-4ccg-62r3
Show 16 moreShow less
nvd.nist.gov/vuln/detail/CVE-2026-23870
vercel.com/changelog/summary-of-cve-2026-23864