CVE-2026-64648
Next.js: Response Body Cache Confusion for Requests Containing Bodies
Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a server-side fetch with a request body may return a cached response body from a different request to the same URL but different body. Confidential data in the POST's response body would then leak to unauthorized requests. Though the request itself will not be deduped. This only applies to fetch calls with a request that has a different init than the one passed to fetch. A safe request would be: fetch(new Request(init), init). An unsafe request would be: fetch(new Request(init), aDifferentInit). This issue has been fixed in versions 15.5.21 and 16.2.11.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Passive
What an attacker can affect
- Confidentiality
- High
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Next.js: Response Body Cache Confusion for Requests Containing Bodies
Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a server-side fetch with a request body may return a cached response body from a different request to the same URL but different body. Confidential data in the POST's response body would then leak to unauthorized requests. Though the request itself will not be deduped. This only applies to fetch calls with a request that has a different init than the one passed to fetch. A safe request would be: fetch(new Request(init), init). An unsafe request would be: fetch(new Request(init), aDifferentInit). This issue has been fixed in versions 15.5.21 and 16.2.11.
- Record
CVE-2026-64648- CVSS 4.0
- 6.0 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-524
- Updated
- 2026-11-02
EUVDEUVD-2026-49565
Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a server-side fetch with a request body may return a cached response body from a different request to the same URL but different body. Confidential data in the POST's response body would then leak to unauthorized requests. Though the request itself will not be deduped. This only applies to fetch calls with a request that has a different init than the one passed to fetch. A safe request would be: fetch(new Request(init), init). An unsafe request would be: fetch(new Request(init), aDifferentInit). This issue has been fixed in versions 15.5.21 and 16.2.11.
- Record
EUVD-2026-49565- CVSS 4.0
- 6.0 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-68g3-v927-f742
Next.js: Cache confusion of response bodies for requests with bodies
Impact
A server-side fetch with a request body may return a cached response body from a different request to the same URL but different body. Confidential data in the POST's response body would then leak to unauthorized requests. Though the request itself will not be deduped.
This only applies to fetch calls with a request that has a different init than the one passed to fetch.
Safe: fetch(new Request(init), init)
Unsafe: fetch(new Request(init), aDifferentInit)
Workarounds
No workaround exists besides upgrading. Applications using Pages Router are not vulnerable.
- Record
GHSA-68g3-v927-f742- CVSS 4.0
- 6.0 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-524
- Updated
- 2026-11-02
GitHub AdvisoriesGHSA-mwv6-3258-q52c
Next Vulnerable to Denial of Service with Server Components
A vulnerability affects certain React packages for versions 19.0.0, 19.0.1, 19.1.0, 19.1.1, 19.1.2, 19.2.0, and 19.2.1 and frameworks that use the affected packages, including Next.js 15.x and 16.x using the App Router. The issue is tracked upstream as CVE-2025-55184.
A malicious HTTP request can be crafted and sent to any App Router endpoint that, when deserialized, can cause the server process to hang and consume CPU. This can result in denial of service in unpatched environments.
- Record
GHSA-mwv6-3258-q52c- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400, CWE-502, CWE-1395
- Updated
- 2026-11-02
GitHub AdvisoriesGHSA-w37m-7fhw-fmv9
Next Server Actions Source Code Exposure
A vulnerability affects certain React packages for versions 19.0.0, 19.0.1, 19.1.0, 19.1.1, 19.1.2, 19.2.0, and 19.2.1 and frameworks that use the affected packages, including Next.js 15.x and 16.x using the App Router. The issue is tracked upstream as CVE-2025-55183.
A malicious HTTP request can be crafted and sent to any App Router endpoint that can return the compiled source code of Server Functions. This could reveal business logic, but would not expose secrets unless they were hardcoded directly into Server Function code.
- Record
GHSA-w37m-7fhw-fmv9- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-497, CWE-502, CWE-1395
- Updated
- 2026-11-02
NVD
Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a server-side fetch with a request body may return a cached response body from a different request to the same URL but different body. Confidential data in the POST's response body would then leak to unauthorized requests. Though the request itself will not be deduped. This only applies to fetch calls with a request that has a different init than the one passed to fetch. A safe request would be: fetch(new Request(init), init). An unsafe request would be: fetch(new Request(init), aDifferentInit). This issue has been fixed in versions 15.5.21 and 16.2.11.
- Record
CVE-2026-64648- CVSS 4.0
- 6.0 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N - Weakness
- CWE-524
- Updated
- 2026-11-02
Show 31 moreShow less
OSV
Next.js: Response Body Cache Confusion for Requests Containing Bodies
Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a server-side fetch with a request body may return a cached response body from a different request to the same URL but different body. Confidential data in the POST's response body would then leak to unauthorized requests. Though the request itself will not be deduped. This only applies to fetch calls with a request that has a different init than the one passed to fetch. A safe request would be: fetch(new Request(init), init). An unsafe request would be: fetch(new Request(init), aDifferentInit). This issue has been fixed in versions 15.5.21 and 16.2.11.
- Record
CVE-2026-64648- CVSS 4.0
- 6.0 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-524
- Updated
- 2026-11-02
OSVGHSA-68g3-v927-f742
Next.js: Cache confusion of response bodies for requests with bodies
Impact
A server-side fetch with a request body may return a cached response body from a different request to the same URL but different body. Confidential data in the POST's response body would then leak to unauthorized requests. Though the request itself will not be deduped.
This only applies to fetch calls with a request that has a different init than the one passed to fetch.
Safe: fetch(new Request(init), init)
Unsafe: fetch(new Request(init), aDifferentInit)
Workarounds
No workaround exists besides upgrading. Applications using Pages Router are not vulnerable.
- Record
GHSA-68g3-v927-f742- CVSS 4.0
- 6.0 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-524
- Updated
- 2026-11-02
OSVGHSA-mwv6-3258-q52c
Next Vulnerable to Denial of Service with Server Components
A vulnerability affects certain React packages for versions 19.0.0, 19.0.1, 19.1.0, 19.1.1, 19.1.2, 19.2.0, and 19.2.1 and frameworks that use the affected packages, including Next.js 15.x and 16.x using the App Router. The issue is tracked upstream as CVE-2025-55184.
A malicious HTTP request can be crafted and sent to any App Router endpoint that, when deserialized, can cause the server process to hang and consume CPU. This can result in denial of service in unpatched environments.
- Record
GHSA-mwv6-3258-q52c- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-1395, CWE-400, CWE-502
- Updated
- 2026-11-02
OSVGHSA-w37m-7fhw-fmv9
Next Server Actions Source Code Exposure
A vulnerability affects certain React packages for versions 19.0.0, 19.0.1, 19.1.0, 19.1.1, 19.1.2, 19.2.0, and 19.2.1 and frameworks that use the affected packages, including Next.js 15.x and 16.x using the App Router. The issue is tracked upstream as CVE-2025-55183.
A malicious HTTP request can be crafted and sent to any App Router endpoint that can return the compiled source code of Server Functions. This could reveal business logic, but would not expose secrets unless they were hardcoded directly into Server Function code.
- Record
GHSA-w37m-7fhw-fmv9- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-1395, CWE-497, CWE-502
- Updated
- 2026-11-02
OSVCLSA-2026-1786538556 No score
TuxCare security update for 13 packages (3 CVEs)
TuxCare rebuilt 13 packages to address 3 CVEs. Fixed in 14.2.35-tuxcare.6.
- Record
CLSA-2026-1786538556- Updated
- 2026-11-02
OSVCLSA-2026-1787663916 No score
TuxCare security update for 13 packages (2 CVEs)
TuxCare rebuilt 13 packages to address 2 CVEs. Fixed in 13.5.11-tuxcare.16.
- Record
CLSA-2026-1787663916- Updated
- 2026-11-02
OSVCLSA-2026-1791901908 No score
TuxCare security update for 9 packages (10 CVEs)
TuxCare rebuilt 9 packages to address 10 CVEs. Fixed in 15.1.2-tuxcare.3.
- Record
CLSA-2026-1791901908- Updated
- 2026-11-02
OSVCLSA-2026-1792195748 No score
TuxCare security update for create-next-app (3 CVEs)
TuxCare rebuilt create-next-app to address 3 CVEs. Fixed in 14.2.35-tuxcare.6.
- Record
CLSA-2026-1792195748- Updated
- 2026-11-02
OSVCLSA-2026-1792195753 No score
TuxCare security update for create-next-app (2 CVEs)
TuxCare rebuilt create-next-app to address 2 CVEs. Fixed in 13.5.11-tuxcare.16.
- Record
CLSA-2026-1792195753- Updated
- 2026-11-02
OSVCLSA-2026-1792196877 No score
TuxCare security update for @next/eslint-plugin-next (3 CVEs)
TuxCare rebuilt @next/eslint-plugin-next to address 3 CVEs. Fixed in 14.2.35-tuxcare.6.
- Record
CLSA-2026-1792196877- Updated
- 2026-11-02
OSVCLSA-2026-1792196880 No score
TuxCare security update for @next/eslint-plugin-next (2 CVEs)
TuxCare rebuilt @next/eslint-plugin-next to address 2 CVEs. Fixed in 13.5.11-tuxcare.16.
- Record
CLSA-2026-1792196880- Updated
- 2026-11-02
OSVCLSA-2026-1792206303 No score
TuxCare security update for @next/bundle-analyzer (3 CVEs)
TuxCare rebuilt @next/bundle-analyzer to address 3 CVEs. Fixed in 14.2.35-tuxcare.6.
- Record
CLSA-2026-1792206303- Updated
- 2026-11-02
OSVCLSA-2026-1792206307 No score
TuxCare security update for @next/bundle-analyzer (2 CVEs)
TuxCare rebuilt @next/bundle-analyzer to address 2 CVEs. Fixed in 13.5.11-tuxcare.16.
- Record
CLSA-2026-1792206307- Updated
- 2026-11-02
OSVCLSA-2026-1792272243 No score
TuxCare security update for @next/plugin-storybook (3 CVEs)
TuxCare rebuilt @next/plugin-storybook to address 3 CVEs. Fixed in 14.2.35-tuxcare.6.
- Record
CLSA-2026-1792272243- Updated
- 2026-11-02
OSVCLSA-2026-1792272248 No score
TuxCare security update for @next/plugin-storybook (2 CVEs)
TuxCare rebuilt @next/plugin-storybook to address 2 CVEs. Fixed in 13.5.11-tuxcare.16.
- Record
CLSA-2026-1792272248- Updated
- 2026-11-02
OSVCLSA-2026-1792293003 No score
TuxCare security update for @next/polyfill-module (2 CVEs)
TuxCare rebuilt @next/polyfill-module to address 2 CVEs. Fixed in 13.5.11-tuxcare.16.
- Record
CLSA-2026-1792293003- Updated
- 2026-11-02
OSVCLSA-2026-1792293014 No score
TuxCare security update for @next/polyfill-module (3 CVEs)
TuxCare rebuilt @next/polyfill-module to address 3 CVEs. Fixed in 14.2.35-tuxcare.6.
- Record
CLSA-2026-1792293014- Updated
- 2026-11-02
OSVCLSA-2026-1792304721 No score
TuxCare security update for @next/polyfill-nomodule (3 CVEs)
TuxCare rebuilt @next/polyfill-nomodule to address 3 CVEs. Fixed in 14.2.35-tuxcare.6.
- Record
CLSA-2026-1792304721- Updated
- 2026-11-02
OSVCLSA-2026-1792304743 No score
TuxCare security update for @next/polyfill-nomodule (2 CVEs)
TuxCare rebuilt @next/polyfill-nomodule to address 2 CVEs. Fixed in 13.5.11-tuxcare.16.
- Record
CLSA-2026-1792304743- Updated
- 2026-11-02
OSVCLSA-2026-1792326296 No score
TuxCare security update for @next/react-refresh-utils (3 CVEs)
TuxCare rebuilt @next/react-refresh-utils to address 3 CVEs. Fixed in 14.2.35-tuxcare.6.
- Record
CLSA-2026-1792326296- Updated
- 2026-11-02
OSVCLSA-2026-1792326306 No score
TuxCare security update for @next/react-refresh-utils (2 CVEs)
TuxCare rebuilt @next/react-refresh-utils to address 2 CVEs. Fixed in 13.5.11-tuxcare.16.
- Record
CLSA-2026-1792326306- Updated
- 2026-11-02
OSVCLSA-2026-1792338236 No score
TuxCare security update for @next/third-parties (3 CVEs)
TuxCare rebuilt @next/third-parties to address 3 CVEs. Fixed in 14.2.35-tuxcare.6.
- Record
CLSA-2026-1792338236- Updated
- 2026-11-02
OSVCLSA-2026-1792338239 No score
TuxCare security update for @next/third-parties (2 CVEs)
TuxCare rebuilt @next/third-parties to address 2 CVEs. Fixed in 13.5.11-tuxcare.16.
- Record
CLSA-2026-1792338239- Updated
- 2026-11-02
OSVCLSA-2026-1792346492 No score
TuxCare security update for @next/swc-linux-x64-gnu (10 CVEs)
TuxCare rebuilt @next/swc-linux-x64-gnu to address 10 CVEs. Fixed in 15.1.2-tuxcare.3.
- Record
CLSA-2026-1792346492- Updated
- 2026-11-02
OSVCLSA-2026-1792358597 No score
TuxCare security update for @next/codemod (3 CVEs)
TuxCare rebuilt @next/codemod to address 3 CVEs. Fixed in 14.2.35-tuxcare.6.
- Record
CLSA-2026-1792358597- Updated
- 2026-11-02
OSVCLSA-2026-1792358600 No score
TuxCare security update for @next/codemod (2 CVEs)
TuxCare rebuilt @next/codemod to address 2 CVEs. Fixed in 13.5.11-tuxcare.16.
- Record
CLSA-2026-1792358600- Updated
- 2026-11-02
OSVCLSA-2026-1792364003 No score
TuxCare security update for @next/mdx (3 CVEs)
TuxCare rebuilt @next/mdx to address 3 CVEs. Fixed in 14.2.35-tuxcare.6.
- Record
CLSA-2026-1792364003- Updated
- 2026-11-02
OSVCLSA-2026-1792364007 No score
TuxCare security update for @next/mdx (2 CVEs)
TuxCare rebuilt @next/mdx to address 2 CVEs. Fixed in 13.5.11-tuxcare.16.
- Record
CLSA-2026-1792364007- Updated
- 2026-11-02
OSVCLSA-2026-1792367395 No score
TuxCare security update for @next/swc-linux-arm64-gnu (10 CVEs)
TuxCare rebuilt @next/swc-linux-arm64-gnu to address 10 CVEs. Fixed in 15.1.2-tuxcare.3.
- Record
CLSA-2026-1792367395- Updated
- 2026-11-02
OSVROOT-APP-NPM-CVE-2026-64648 No score
CVE-2026-64648 in next - Patched by Root
Root has patched CVE-2026-64648 in the next package for Root:npm. Multiple fixed versions available.
- Record
ROOT-APP-NPM-CVE-2026-64648- Updated
- 2026-11-02
OSVROOT-APP-NPM-GHSA-mwv6-3258-q52c No score
GHSA-mwv6-3258-q52c in next - Patched by Root
Root has patched GHSA-mwv6-3258-q52c in the next package for Root:npm. Multiple fixed versions available.
- Record
ROOT-APP-NPM-GHSA-mwv6-3258-q52c- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
nextnpm |
13.0.0 up to 15.5.21 | 15.5.21 |
nextnpm |
16.0.0 up to 16.2.11 | 16.2.11 |
nextnpm |
13.3.0 up to 14.2.34 | 14.2.34 |
nextnpm |
15.0.0-canary.0 up to 15.0.6 | 15.0.6 |
nextnpm |
15.1.1-canary.0 up to 15.1.10 | 15.1.10 |
nextnpm |
15.2.0-canary.0 up to 15.2.7 | 15.2.7 |
nextnpm |
15.3.0-canary.0 up to 15.3.7 | 15.3.7 |
nextnpm |
15.4.0-canary.0 up to 15.4.9 | 15.4.9 |
nextnpm |
15.5.1-canary.0 up to 15.5.8 | 15.5.8 |
nextnpm |
15.6.0-canary.0 up to 15.6.0-canary.59 | 15.6.0-canary.59 |
Show 28 moreShow less
| Package | Affected | Fixed |
|---|---|---|
nextnpm |
16.0.0-beta.0 up to 16.0.9 | 16.0.9 |
nextnpm |
16.1.0-canary.0 up to 16.1.0-canary.17 | 16.1.0-canary.17 |
create-next-appTuxCare:npm From an advisory covering 3 CVEs |
14.2.35-tuxcare.0 up to 14.2.35-tuxcare.6, plus listed versions 14.2.3514.2.35-tuxcare.414.2.35-tuxcare.5 |
14.2.35-tuxcare.6 |
create-next-appTuxCare:npm From an advisory covering 2 CVEs |
13.5.11-tuxcare.0 up to 13.5.11-tuxcare.16, plus listed versions 13.5.1113.5.11-tuxcare.1313.5.11-tuxcare.14 |
13.5.11-tuxcare.16 |
@next/eslint-plugin-nextTuxCare:npm From an advisory covering 3 CVEs |
14.2.35-tuxcare.0 up to 14.2.35-tuxcare.6, plus listed versions 14.2.3514.2.35-tuxcare.414.2.35-tuxcare.5 |
14.2.35-tuxcare.6 |
@next/eslint-plugin-nextTuxCare:npm From an advisory covering 2 CVEs |
13.5.11-tuxcare.0 up to 13.5.11-tuxcare.16, plus listed versions 13.5.1113.5.11-tuxcare.1313.5.11-tuxcare.14 |
13.5.11-tuxcare.16 |
@next/bundle-analyzerTuxCare:npm From an advisory covering 3 CVEs |
14.2.35-tuxcare.0 up to 14.2.35-tuxcare.6, plus listed versions 14.2.3514.2.35-tuxcare.414.2.35-tuxcare.5 |
14.2.35-tuxcare.6 |
@next/bundle-analyzerTuxCare:npm From an advisory covering 2 CVEs |
13.5.11-tuxcare.0 up to 13.5.11-tuxcare.16, plus listed versions 13.5.1113.5.11-tuxcare.1313.5.11-tuxcare.14 |
13.5.11-tuxcare.16 |
@next/plugin-storybookTuxCare:npm From an advisory covering 3 CVEs |
14.2.35-tuxcare.0 up to 14.2.35-tuxcare.6, plus listed versions 14.2.3514.2.35-tuxcare.414.2.35-tuxcare.5 |
14.2.35-tuxcare.6 |
@next/plugin-storybookTuxCare:npm From an advisory covering 2 CVEs |
13.5.11-tuxcare.0 up to 13.5.11-tuxcare.16, plus listed versions 13.5.1113.5.11-tuxcare.1313.5.11-tuxcare.14 |
13.5.11-tuxcare.16 |
@next/polyfill-moduleTuxCare:npm From an advisory covering 2 CVEs |
13.5.11-tuxcare.0 up to 13.5.11-tuxcare.16, plus listed versions 13.5.1113.5.11-tuxcare.1313.5.11-tuxcare.14 |
13.5.11-tuxcare.16 |
@next/polyfill-moduleTuxCare:npm From an advisory covering 3 CVEs |
14.2.35-tuxcare.0 up to 14.2.35-tuxcare.6, plus listed versions 14.2.3514.2.35-tuxcare.414.2.35-tuxcare.5 |
14.2.35-tuxcare.6 |
@next/polyfill-nomoduleTuxCare:npm From an advisory covering 3 CVEs |
14.2.35-tuxcare.0 up to 14.2.35-tuxcare.6, plus listed versions 14.2.3514.2.35-tuxcare.414.2.35-tuxcare.5 |
14.2.35-tuxcare.6 |
@next/polyfill-nomoduleTuxCare:npm From an advisory covering 2 CVEs |
13.5.11-tuxcare.0 up to 13.5.11-tuxcare.16, plus listed versions 13.5.1113.5.11-tuxcare.1313.5.11-tuxcare.14 |
13.5.11-tuxcare.16 |
@next/react-refresh-utilsTuxCare:npm From an advisory covering 3 CVEs |
14.2.35-tuxcare.0 up to 14.2.35-tuxcare.6, plus listed versions 14.2.3514.2.35-tuxcare.414.2.35-tuxcare.5 |
14.2.35-tuxcare.6 |
@next/react-refresh-utilsTuxCare:npm From an advisory covering 2 CVEs |
13.5.11-tuxcare.0 up to 13.5.11-tuxcare.16, plus listed versions 13.5.1113.5.11-tuxcare.1313.5.11-tuxcare.14 |
13.5.11-tuxcare.16 |
@next/third-partiesTuxCare:npm From an advisory covering 3 CVEs |
14.2.35-tuxcare.0 up to 14.2.35-tuxcare.6, plus listed versions 14.2.3514.2.35-tuxcare.414.2.35-tuxcare.5 |
14.2.35-tuxcare.6 |
@next/third-partiesTuxCare:npm From an advisory covering 2 CVEs |
13.5.11-tuxcare.0 up to 13.5.11-tuxcare.16, plus listed versions 13.5.1113.5.11-tuxcare.1313.5.11-tuxcare.14 |
13.5.11-tuxcare.16 |
@next/swc-linux-x64-gnuTuxCare:npm From an advisory covering 7 CVEs |
15.1.2-tuxcare.0 up to 15.1.2-tuxcare.3, plus listed versions 15.1.215.1.2-tuxcare.115.1.2-tuxcare.2 |
15.1.2-tuxcare.3 |
@next/codemodTuxCare:npm From an advisory covering 3 CVEs |
14.2.35-tuxcare.0 up to 14.2.35-tuxcare.6, plus listed versions 14.2.3514.2.35-tuxcare.414.2.35-tuxcare.5 |
14.2.35-tuxcare.6 |
@next/codemodTuxCare:npm From an advisory covering 2 CVEs |
13.5.11-tuxcare.0 up to 13.5.11-tuxcare.16, plus listed versions 13.5.1113.5.11-tuxcare.1313.5.11-tuxcare.14 |
13.5.11-tuxcare.16 |
@next/mdxTuxCare:npm From an advisory covering 3 CVEs |
14.2.35-tuxcare.0 up to 14.2.35-tuxcare.6, plus listed versions 14.2.3514.2.35-tuxcare.414.2.35-tuxcare.5 |
14.2.35-tuxcare.6 |
@next/mdxTuxCare:npm From an advisory covering 2 CVEs |
13.5.11-tuxcare.0 up to 13.5.11-tuxcare.16, plus listed versions 13.5.1113.5.11-tuxcare.1313.5.11-tuxcare.14 |
13.5.11-tuxcare.16 |
@next/swc-linux-arm64-gnuTuxCare:npm From an advisory covering 7 CVEs |
15.1.2-tuxcare.0 up to 15.1.2-tuxcare.3, plus listed versions 15.1.215.1.2-tuxcare.115.1.2-tuxcare.2 |
15.1.2-tuxcare.3 |
nextRoot:npm |
before 15.5.21-aikido.1 | 15.5.21-aikido.116.2.11-aikido.116.2.11-aikido.215.5.21-aikido.2 |
@rootio/nextRoot:npm |
before 15.5.21-root.io.1 | 15.5.21-root.io.116.2.11-root.io.116.2.11-root.io.215.5.21-root.io.2 |
nextRoot:npm |
before 14.2.33-aikido.2 | 14.2.33-aikido.214.2.32-aikido.414.2.30-aikido.714.2.26-aikido.614.2.26-aikido.414.2.30-aikido.1013.4.19-aikido.613.4.19-aikido.714.2.10-aikido.314.2.13-aikido.314.2.3-aikido.114.2.15-aikido.414.0.4-aikido.914.1.3-aikido.214.2.25-aikido.214.1.0-aikido.414.2.18-aikido.213.3.0-aikido.514.2.15-aikido.313.4.19-aikido.314.1.0-aikido.714.1.0-aikido.814.2.13-aikido.114.2.3-aikido.514.2.0-aikido.214.0.3-aikido.314.2.5-aikido.914.2.5-aikido.1014.2.2-aikido.714.2.33-aikido.114.1.3-aikido.514.2.29-aikido.114.2.29-aikido.514.2.31-aikido.214.2.18-aikido.114.0.0-aikido.714.2.10-aikido.414.2.13-aikido.414.2.10-aikido.214.2.18-aikido.614.2.21-aikido.614.2.16-aikido.614.2.25-aikido.114.2.0-aikido.614.2.31-aikido.514.2.0-aikido.514.2.2-aikido.914.2.30-aikido.814.2.24-aikido.714.0.3-aikido.614.2.32-aikido.514.2.33-aikido.314.0.0-aikido.514.2.3-aikido.313.5.4-aikido.514.1.3-aikido.613.3.0-aikido.614.0.3-aikido.414.2.13-aikido.214.2.21-aikido.414.0.0-aikido.314.1.4-aikido.714.2.21-aikido.213.3.0-aikido.214.2.16-aikido.214.2.16-aikido.413.5.4-aikido.213.3.0-aikido.714.2.33-aikido.414.2.26-aikido.314.0.3-aikido.514.2.30-aikido.914.1.4-aikido.814.2.32-aikido.613.5.4-aikido.614.1.3-aikido.714.2.16-aikido.514.0.0-aikido.614.2.21-aikido.514.2.3-aikido.414.2.2-aikido.813.4.19-aikido.414.2.15-aikido.514.2.3-aikido.213.5.6-aikido.414.2.28-aikido.514.2.32-aikido.214.1.4-aikido.914.1.3-aikido.113.3.0-aikido.314.2.32-aikido.713.5.6-aikido.514.2.15-aikido.614.1.3-aikido.814.2.32-aikido.814.2.29-aikido.414.2.28-aikido.114.2.33-aikido.513.5.6-aikido.614.2.26-aikido.514.2.28-aikido.214.2.26-aikido.214.0.4-aikido.814.2.28-aikido.314.1.0-aikido.214.2.31-aikido.314.2.24-aikido.614.1.4-aikido.614.2.18-aikido.313.3.0-aikido.414.1.0-aikido.514.2.16-aikido.314.0.0-aikido.414.1.0-aikido.314.2.18-aikido.413.5.4-aikido.314.2.31-aikido.114.2.0-aikido.313.4.19-aikido.514.2.31-aikido.414.2.29-aikido.214.2.0-aikido.113.5.4-aikido.414.2.21-aikido.114.2.16-aikido.114.1.3-aikido.313.3.0-aikido.814.2.21-aikido.314.2.32-aikido.314.2.29-aikido.313.5.11-aikido.914.1.3-aikido.414.2.0-aikido.414.2.30-aikido.614.2.28-aikido.414.2.33-aikido.614.1.0-aikido.614.2.18-aikido.513.5.6-aikido.7 |
@rootio/nextRoot:npm |
before 14.2.33-root.io.2 | 14.2.33-root.io.214.2.32-root.io.414.2.30-root.io.714.2.26-root.io.614.2.26-root.io.414.2.30-root.io.1013.4.19-root.io.613.4.19-root.io.714.2.10-root.io.314.2.13-root.io.314.2.3-root.io.114.2.15-root.io.414.0.4-root.io.914.1.3-root.io.214.2.25-root.io.214.1.0-root.io.414.2.18-root.io.213.3.0-root.io.514.2.15-root.io.313.4.19-root.io.314.1.0-root.io.714.1.0-root.io.814.2.13-root.io.114.2.3-root.io.514.2.0-root.io.214.0.3-root.io.314.2.5-root.io.914.2.5-root.io.1014.2.2-root.io.714.2.33-root.io.114.1.3-root.io.514.2.29-root.io.114.2.29-root.io.514.2.31-root.io.214.2.18-root.io.114.0.0-root.io.714.2.10-root.io.414.2.13-root.io.414.2.10-root.io.214.2.18-root.io.614.2.21-root.io.614.2.16-root.io.614.2.25-root.io.114.2.0-root.io.614.2.31-root.io.514.2.0-root.io.514.2.2-root.io.914.2.30-root.io.814.2.24-root.io.714.0.3-root.io.614.2.32-root.io.514.2.33-root.io.314.0.0-root.io.514.2.3-root.io.313.5.4-root.io.514.1.3-root.io.613.3.0-root.io.614.0.3-root.io.414.2.13-root.io.214.2.21-root.io.414.0.0-root.io.314.1.4-root.io.714.2.21-root.io.213.3.0-root.io.214.2.16-root.io.214.2.16-root.io.413.5.4-root.io.213.3.0-root.io.714.2.33-root.io.414.2.26-root.io.314.0.3-root.io.514.2.30-root.io.914.1.4-root.io.814.2.32-root.io.613.5.4-root.io.614.1.3-root.io.714.2.16-root.io.514.0.0-root.io.614.2.21-root.io.514.2.3-root.io.414.2.2-root.io.813.4.19-root.io.414.2.15-root.io.514.2.3-root.io.213.5.6-root.io.414.2.28-root.io.514.2.32-root.io.214.1.4-root.io.914.1.3-root.io.113.3.0-root.io.314.2.32-root.io.713.5.6-root.io.514.2.15-root.io.614.1.3-root.io.814.2.32-root.io.814.2.29-root.io.414.2.28-root.io.114.2.33-root.io.513.5.6-root.io.614.2.26-root.io.514.2.28-root.io.214.2.26-root.io.214.0.4-root.io.814.2.28-root.io.314.2.24-root.io.614.1.0-root.io.214.2.31-root.io.314.1.4-root.io.614.2.18-root.io.313.3.0-root.io.414.1.0-root.io.514.2.16-root.io.314.0.0-root.io.414.1.0-root.io.314.2.18-root.io.413.5.4-root.io.314.2.31-root.io.114.2.0-root.io.313.4.19-root.io.514.2.31-root.io.414.2.29-root.io.214.2.0-root.io.113.5.4-root.io.414.2.21-root.io.114.1.3-root.io.314.2.16-root.io.113.3.0-root.io.814.2.21-root.io.314.2.32-root.io.314.2.29-root.io.313.5.11-root.io.914.1.3-root.io.414.2.0-root.io.414.2.30-root.io.614.2.33-root.io.614.2.28-root.io.414.1.0-root.io.613.5.6-root.io.714.2.18-root.io.5 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-64648 is a medium vulnerability (CVSS 6.0) in Vercel Next.js, published December 11, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.34%, the 27th percentile. Fixed in next 15.5.21.
References
github.com/vercel/next.js/security/advisories/GHSA-68g3-v927-f742
Show 10 moreShow less
nextjs.org/blog/security-update-2025-12-11
cve.org/CVERecord?id=CVE-2025-55184
nvd.nist.gov/vuln/detail/CVE-2026-64648