CVE-2026-64643
Next.js: Unauthenticated Disclosure of Internal Server Function endpoints
Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, Next.js applications using App Router, Server Actions (use server) or use cache endpoints can be disclosed bypassing any authentication on the pages where these endpoints are usually used. Server Action IDs can be disclosed to unauthenticated users via publicly served client artifacts (for example, static chunks containing action references). Affected users are applications using App Router and Server Actions. By itself, this disclosure is typically a recon/enumeration primitive; however, it can increase risk when combined with other weaknesses. This issue has been fixed in versions 15.5.21 and 16.2.11.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Next.js: Unauthenticated Disclosure of Internal Server Function endpoints
Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, Next.js applications using App Router, Server Actions (use server) or use cache endpoints can be disclosed bypassing any authentication on the pages where these endpoints are usually used. Server Action IDs can be disclosed to unauthenticated users via publicly served client artifacts (for example, static chunks containing action references). Affected users are applications using App Router and Server Actions. By itself, this disclosure is typically a recon/enumeration primitive; however, it can increase risk when combined with other weaknesses. This issue has been fixed in versions 15.5.21 and 16.2.11.
- Record
CVE-2026-64643- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-201
- Updated
- 2026-11-02
EUVDEUVD-2026-49383
Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, Next.js applications using App Router, Server Actions (use server) or use cache endpoints can be disclosed bypassing any authentication on the pages where these endpoints are usually used. Server Action IDs can be disclosed to unauthenticated users via publicly served client artifacts (for example, static chunks containing action references). Affected users are applications using App Router and Server Actions. By itself, this disclosure is typically a recon/enumeration primitive; however, it can increase risk when combined with other weaknesses. This issue has been fixed in versions 15.5.21 and 16.2.11.
- Record
EUVD-2026-49383- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-8h8q-6873-q5fj
Next.js Vulnerable to Denial of Service with Server Components
A vulnerability affects certain React Server Components packages for versions 19.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. The issue is tracked upstream as CVE-2026-23870.
A specially crafted HTTP request can be sent to any App Router Server Function endpoint that, when deserialized, may trigger excessive CPU usage. This can result in denial of service in unpatched environments.
- Record
GHSA-8h8q-6873-q5fj- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-02
GitHub AdvisoriesGHSA-955p-x3mx-jcvp
Next.js: Unauthenticated disclosure of internal Server Function endpoints
Impact
In Next.js applications using App Router, Server Actions (use server) or use cache endpoints can be disclosed bypassing any authentication on the pages where these endpoints are usually used.
Server Action IDs can be disclosed to unauthenticated users via publicly served client artifacts (for example, static chunks containing action references).
Affected users are applications using App Router + Server Actions.
By itself, this disclosure is typically a recon/enumeration primitive; however, it can increase risk when combined with other weaknesses.
Workarounds
Never assume any authentication claims at the use cache or use server boundary. Always authenticate within the boundary.
- Record
GHSA-955p-x3mx-jcvp- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-201
- Updated
- 2026-11-02
GitHub AdvisoriesGHSA-h25m-26qc-wcjf
Next.js HTTP request deserialization can lead to DoS when using insecure React Server Components
A vulnerability affects certain React Server Components packages for versions 19.0.x, 19.1.x, and 19.2.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. The issue is tracked upstream as CVE-2026-23864.
A specially crafted HTTP request can be sent to any App Router Server Function endpoint that, when deserialized, may trigger excessive CPU usage, out-of-memory exceptions, or server crashes. This can result in denial of service in unpatched environments.
- Record
GHSA-h25m-26qc-wcjf- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400, CWE-502
- Updated
- 2026-11-02
GitHub AdvisoriesGHSA-q4gf-8mx6-v5v3
Next.js has a Denial of Service with Server Components
A vulnerability affects certain React Server Components packages for versions 19.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. The issue is tracked upstream as CVE-2026-23869. You can read more about this advisory our this changelog.
A specially crafted HTTP request can be sent to any App Router Server Function endpoint that, when deserialized, may trigger excessive CPU usage. This can result in denial of service in unpatched environments.
- Record
GHSA-q4gf-8mx6-v5v3- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-02
Show 32 moreShow less
NVD
Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, Next.js applications using App Router, Server Actions (use server) or use cache endpoints can be disclosed bypassing any authentication on the pages where these endpoints are usually used. Server Action IDs can be disclosed to unauthenticated users via publicly served client artifacts (for example, static chunks containing action references). Affected users are applications using App Router and Server Actions. By itself, this disclosure is typically a recon/enumeration primitive; however, it can increase risk when combined with other weaknesses. This issue has been fixed in versions 15.5.21 and 16.2.11.
- Record
CVE-2026-64643- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-201
- Updated
- 2026-11-02
OSV
Next.js: Unauthenticated Disclosure of Internal Server Function endpoints
Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, Next.js applications using App Router, Server Actions (use server) or use cache endpoints can be disclosed bypassing any authentication on the pages where these endpoints are usually used. Server Action IDs can be disclosed to unauthenticated users via publicly served client artifacts (for example, static chunks containing action references). Affected users are applications using App Router and Server Actions. By itself, this disclosure is typically a recon/enumeration primitive; however, it can increase risk when combined with other weaknesses. This issue has been fixed in versions 15.5.21 and 16.2.11.
- Record
CVE-2026-64643- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-201
- Updated
- 2026-11-02
OSVGHSA-8h8q-6873-q5fj
Next.js Vulnerable to Denial of Service with Server Components
A vulnerability affects certain React Server Components packages for versions 19.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. The issue is tracked upstream as CVE-2026-23870.
A specially crafted HTTP request can be sent to any App Router Server Function endpoint that, when deserialized, may trigger excessive CPU usage. This can result in denial of service in unpatched environments.
- Record
GHSA-8h8q-6873-q5fj- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-02
OSVGHSA-955p-x3mx-jcvp
Next.js: Unauthenticated disclosure of internal Server Function endpoints
Impact
In Next.js applications using App Router, Server Actions (use server) or use cache endpoints can be disclosed bypassing any authentication on the pages where these endpoints are usually used.
Server Action IDs can be disclosed to unauthenticated users via publicly served client artifacts (for example, static chunks containing action references).
Affected users are applications using App Router + Server Actions.
By itself, this disclosure is typically a recon/enumeration primitive; however, it can increase risk when combined with other weaknesses.
Workarounds
Never assume any authentication claims at the use cache or use server boundary. Always authenticate within the boundary.
- Record
GHSA-955p-x3mx-jcvp- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-201
- Updated
- 2026-11-02
OSVGHSA-h25m-26qc-wcjf
Next.js HTTP request deserialization can lead to DoS when using insecure React Server Components
A vulnerability affects certain React Server Components packages for versions 19.0.x, 19.1.x, and 19.2.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. The issue is tracked upstream as CVE-2026-23864.
A specially crafted HTTP request can be sent to any App Router Server Function endpoint that, when deserialized, may trigger excessive CPU usage, out-of-memory exceptions, or server crashes. This can result in denial of service in unpatched environments.
- Record
GHSA-h25m-26qc-wcjf- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400, CWE-502
- Updated
- 2026-11-02
OSVGHSA-q4gf-8mx6-v5v3
Next.js has a Denial of Service with Server Components
A vulnerability affects certain React Server Components packages for versions 19.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. The issue is tracked upstream as CVE-2026-23869. You can read more about this advisory our this changelog.
A specially crafted HTTP request can be sent to any App Router Server Function endpoint that, when deserialized, may trigger excessive CPU usage. This can result in denial of service in unpatched environments.
- Record
GHSA-q4gf-8mx6-v5v3- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-02
OSVCLSA-2026-1786360051No score
TuxCare security update for 13 packages (13 CVEs)
TuxCare rebuilt 13 packages to address 13 CVEs. Fixed in 13.5.11-tuxcare.14.
- Record
CLSA-2026-1786360051- Updated
- 2026-11-02
OSVCLSA-2026-1786531569No score
TuxCare security update for 13 packages (9 CVEs)
TuxCare rebuilt 13 packages to address 9 CVEs. Fixed in 14.2.35-tuxcare.5.
- Record
CLSA-2026-1786531569- Updated
- 2026-11-02
OSVCLSA-2026-1791807020No score
TuxCare security update for 9 packages (28 CVEs)
TuxCare rebuilt 9 packages to address 28 CVEs. Fixed in 15.1.2-tuxcare.2.
- Record
CLSA-2026-1791807020- Updated
- 2026-11-02
OSVCLSA-2026-1792195727No score
TuxCare security update for create-next-app (13 CVEs)
TuxCare rebuilt create-next-app to address 13 CVEs. Fixed in 13.5.11-tuxcare.14.
- Record
CLSA-2026-1792195727- Updated
- 2026-11-02
OSVCLSA-2026-1792195746No score
TuxCare security update for create-next-app (9 CVEs)
TuxCare rebuilt create-next-app to address 9 CVEs. Fixed in 14.2.35-tuxcare.5.
- Record
CLSA-2026-1792195746- Updated
- 2026-11-02
OSVCLSA-2026-1792196726No score
TuxCare security update for @next/eslint-plugin-next (13 CVEs)
TuxCare rebuilt @next/eslint-plugin-next to address 13 CVEs. Fixed in 13.5.11-tuxcare.14.
- Record
CLSA-2026-1792196726- Updated
- 2026-11-02
OSVCLSA-2026-1792196727No score
TuxCare security update for @next/eslint-plugin-next (9 CVEs)
TuxCare rebuilt @next/eslint-plugin-next to address 9 CVEs. Fixed in 14.2.35-tuxcare.5.
- Record
CLSA-2026-1792196727- Updated
- 2026-11-02
OSVCLSA-2026-1792206290No score
TuxCare security update for @next/bundle-analyzer (13 CVEs)
TuxCare rebuilt @next/bundle-analyzer to address 13 CVEs. Fixed in 13.5.11-tuxcare.14.
- Record
CLSA-2026-1792206290- Updated
- 2026-11-02
OSVCLSA-2026-1792206302No score
TuxCare security update for @next/bundle-analyzer (9 CVEs)
TuxCare rebuilt @next/bundle-analyzer to address 9 CVEs. Fixed in 14.2.35-tuxcare.5.
- Record
CLSA-2026-1792206302- Updated
- 2026-11-02
OSVCLSA-2026-1792272230No score
TuxCare security update for @next/plugin-storybook (13 CVEs)
TuxCare rebuilt @next/plugin-storybook to address 13 CVEs. Fixed in 13.5.11-tuxcare.14.
- Record
CLSA-2026-1792272230- Updated
- 2026-11-02
OSVCLSA-2026-1792272244No score
TuxCare security update for @next/plugin-storybook (9 CVEs)
TuxCare rebuilt @next/plugin-storybook to address 9 CVEs. Fixed in 14.2.35-tuxcare.5.
- Record
CLSA-2026-1792272244- Updated
- 2026-11-02
OSVCLSA-2026-1792293000No score
TuxCare security update for @next/polyfill-module (13 CVEs)
TuxCare rebuilt @next/polyfill-module to address 13 CVEs. Fixed in 13.5.11-tuxcare.14.
- Record
CLSA-2026-1792293000- Updated
- 2026-11-02
OSVCLSA-2026-1792293013No score
TuxCare security update for @next/polyfill-module (9 CVEs)
TuxCare rebuilt @next/polyfill-module to address 9 CVEs. Fixed in 14.2.35-tuxcare.5.
- Record
CLSA-2026-1792293013- Updated
- 2026-11-02
OSVCLSA-2026-1792304720No score
TuxCare security update for @next/polyfill-nomodule (13 CVEs)
TuxCare rebuilt @next/polyfill-nomodule to address 13 CVEs. Fixed in 13.5.11-tuxcare.14.
- Record
CLSA-2026-1792304720- Updated
- 2026-11-02
OSVCLSA-2026-1792304739No score
TuxCare security update for @next/polyfill-nomodule (9 CVEs)
TuxCare rebuilt @next/polyfill-nomodule to address 9 CVEs. Fixed in 14.2.35-tuxcare.5.
- Record
CLSA-2026-1792304739- Updated
- 2026-11-02
OSVCLSA-2026-1792326302No score
TuxCare security update for @next/react-refresh-utils (13 CVEs)
TuxCare rebuilt @next/react-refresh-utils to address 13 CVEs. Fixed in 13.5.11-tuxcare.14.
- Record
CLSA-2026-1792326302- Updated
- 2026-11-02
OSVCLSA-2026-1792326303No score
TuxCare security update for @next/react-refresh-utils (9 CVEs)
TuxCare rebuilt @next/react-refresh-utils to address 9 CVEs. Fixed in 14.2.35-tuxcare.5.
- Record
CLSA-2026-1792326303- Updated
- 2026-11-02
OSVCLSA-2026-1792338232No score
TuxCare security update for @next/third-parties (13 CVEs)
TuxCare rebuilt @next/third-parties to address 13 CVEs. Fixed in 13.5.11-tuxcare.14.
- Record
CLSA-2026-1792338232- Updated
- 2026-11-02
OSVCLSA-2026-1792358588No score
TuxCare security update for @next/codemod (9 CVEs)
TuxCare rebuilt @next/codemod to address 9 CVEs. Fixed in 14.2.35-tuxcare.5.
- Record
CLSA-2026-1792358588- Updated
- 2026-11-02
OSVCLSA-2026-1792358596No score
TuxCare security update for @next/codemod (13 CVEs)
TuxCare rebuilt @next/codemod to address 13 CVEs. Fixed in 13.5.11-tuxcare.14.
- Record
CLSA-2026-1792358596- Updated
- 2026-11-02
OSVCLSA-2026-1792363988No score
TuxCare security update for @next/mdx (9 CVEs)
TuxCare rebuilt @next/mdx to address 9 CVEs. Fixed in 14.2.35-tuxcare.5.
- Record
CLSA-2026-1792363988- Updated
- 2026-11-02
OSVCLSA-2026-1792364002No score
TuxCare security update for @next/mdx (13 CVEs)
TuxCare rebuilt @next/mdx to address 13 CVEs. Fixed in 13.5.11-tuxcare.14.
- Record
CLSA-2026-1792364002- Updated
- 2026-11-02
OSVROOT-APP-NPM-CVE-2026-64643No score
CVE-2026-64643 in next - Patched by Root
Root has patched CVE-2026-64643 in the next package for Root:npm. Multiple fixed versions available.
- Record
ROOT-APP-NPM-CVE-2026-64643- Updated
- 2026-11-02
OSVROOT-APP-NPM-GHSA-8h8q-6873-q5fjNo score
GHSA-8h8q-6873-q5fj in next - Patched by Root
Root has patched GHSA-8h8q-6873-q5fj in the next package for Root:npm. Multiple fixed versions available.
- Record
ROOT-APP-NPM-GHSA-8h8q-6873-q5fj- Updated
- 2026-11-02
OSVROOT-APP-NPM-GHSA-h25m-26qc-wcjfNo score
GHSA-h25m-26qc-wcjf in next - Patched by Root
Root has patched GHSA-h25m-26qc-wcjf in the next package for Root:npm. Multiple fixed versions available.
- Record
ROOT-APP-NPM-GHSA-h25m-26qc-wcjf- Updated
- 2026-11-02
OSVROOT-APP-NPM-GHSA-q4gf-8mx6-v5v3No score
GHSA-q4gf-8mx6-v5v3 in next - Patched by Root
Root has patched GHSA-q4gf-8mx6-v5v3 in the next package for Root:npm. Multiple fixed versions available.
- Record
ROOT-APP-NPM-GHSA-q4gf-8mx6-v5v3- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
nextnpm | 13.0.0 up to 15.5.16 | 15.5.16 |
nextnpm | 16.0.0 up to 16.2.5 | 16.2.5 |
nextnpm | 13.0.0 up to 15.5.21 | 15.5.21 |
nextnpm | 16.0.0 up to 16.2.11 | 16.2.11 |
nextnpm | 13.0.0 up to 15.0.8 | 15.0.8 |
nextnpm | 15.1.1-canary.0 up to 15.1.12 | 15.1.12 |
nextnpm | 15.2.0-canary.0 up to 15.2.9 | 15.2.9 |
nextnpm | 15.3.0-canary.0 up to 15.3.9 | 15.3.9 |
nextnpm | 15.4.0-canary.0 up to 15.4.11 | 15.4.11 |
nextnpm | 15.5.1-canary.0 up to 15.5.10 | 15.5.10 |
Show 30 moreShow less
| Package | Affected | Fixed |
|---|---|---|
nextnpm | 15.6.0-canary.0 up to 15.6.0-canary.61 | 15.6.0-canary.61 |
nextnpm | 16.0.0-beta.0 up to 16.0.11 | 16.0.11 |
nextnpm | 16.1.0-canary.0 up to 16.1.5 | 16.1.5 |
nextnpm | 13.0.0 up to 15.5.15 | 15.5.15 |
nextnpm | 16.0.0-beta.0 up to 16.2.3 | 16.2.3 |
create-next-appTuxCare:npm From an advisory covering 11 CVEs | 13.5.11-tuxcare.0 up to 13.5.11-tuxcare.14, plus listed versions 13.5.1113.5.11-tuxcare.13 | 13.5.11-tuxcare.14 |
create-next-appTuxCare:npm From an advisory covering 8 CVEs | 14.2.35-tuxcare.0 up to 14.2.35-tuxcare.5, plus listed versions 14.2.3514.2.35-tuxcare.4 | 14.2.35-tuxcare.5 |
@next/eslint-plugin-nextTuxCare:npm From an advisory covering 11 CVEs | 13.5.11-tuxcare.0 up to 13.5.11-tuxcare.14, plus listed versions 13.5.1113.5.11-tuxcare.13 | 13.5.11-tuxcare.14 |
@next/eslint-plugin-nextTuxCare:npm From an advisory covering 8 CVEs | 14.2.35-tuxcare.0 up to 14.2.35-tuxcare.5, plus listed versions 14.2.3514.2.35-tuxcare.4 | 14.2.35-tuxcare.5 |
@next/bundle-analyzerTuxCare:npm From an advisory covering 11 CVEs | 13.5.11-tuxcare.0 up to 13.5.11-tuxcare.14, plus listed versions 13.5.1113.5.11-tuxcare.13 | 13.5.11-tuxcare.14 |
@next/bundle-analyzerTuxCare:npm From an advisory covering 8 CVEs | 14.2.35-tuxcare.0 up to 14.2.35-tuxcare.5, plus listed versions 14.2.3514.2.35-tuxcare.4 | 14.2.35-tuxcare.5 |
@next/plugin-storybookTuxCare:npm From an advisory covering 11 CVEs | 13.5.11-tuxcare.0 up to 13.5.11-tuxcare.14, plus listed versions 13.5.1113.5.11-tuxcare.13 | 13.5.11-tuxcare.14 |
@next/plugin-storybookTuxCare:npm From an advisory covering 8 CVEs | 14.2.35-tuxcare.0 up to 14.2.35-tuxcare.5, plus listed versions 14.2.3514.2.35-tuxcare.4 | 14.2.35-tuxcare.5 |
@next/polyfill-moduleTuxCare:npm From an advisory covering 11 CVEs | 13.5.11-tuxcare.0 up to 13.5.11-tuxcare.14, plus listed versions 13.5.1113.5.11-tuxcare.13 | 13.5.11-tuxcare.14 |
@next/polyfill-moduleTuxCare:npm From an advisory covering 8 CVEs | 14.2.35-tuxcare.0 up to 14.2.35-tuxcare.5, plus listed versions 14.2.3514.2.35-tuxcare.4 | 14.2.35-tuxcare.5 |
@next/polyfill-nomoduleTuxCare:npm From an advisory covering 11 CVEs | 13.5.11-tuxcare.0 up to 13.5.11-tuxcare.14, plus listed versions 13.5.1113.5.11-tuxcare.13 | 13.5.11-tuxcare.14 |
@next/polyfill-nomoduleTuxCare:npm From an advisory covering 8 CVEs | 14.2.35-tuxcare.0 up to 14.2.35-tuxcare.5, plus listed versions 14.2.3514.2.35-tuxcare.4 | 14.2.35-tuxcare.5 |
@next/react-refresh-utilsTuxCare:npm From an advisory covering 11 CVEs | 13.5.11-tuxcare.0 up to 13.5.11-tuxcare.14, plus listed versions 13.5.1113.5.11-tuxcare.13 | 13.5.11-tuxcare.14 |
@next/react-refresh-utilsTuxCare:npm From an advisory covering 8 CVEs | 14.2.35-tuxcare.0 up to 14.2.35-tuxcare.5, plus listed versions 14.2.3514.2.35-tuxcare.4 | 14.2.35-tuxcare.5 |
@next/third-partiesTuxCare:npm From an advisory covering 11 CVEs | 13.5.11-tuxcare.0 up to 13.5.11-tuxcare.14, plus listed versions 13.5.1113.5.11-tuxcare.13 | 13.5.11-tuxcare.14 |
@next/codemodTuxCare:npm From an advisory covering 8 CVEs | 14.2.35-tuxcare.0 up to 14.2.35-tuxcare.5, plus listed versions 14.2.3514.2.35-tuxcare.4 | 14.2.35-tuxcare.5 |
@next/codemodTuxCare:npm From an advisory covering 11 CVEs | 13.5.11-tuxcare.0 up to 13.5.11-tuxcare.14, plus listed versions 13.5.1113.5.11-tuxcare.13 | 13.5.11-tuxcare.14 |
@next/mdxTuxCare:npm From an advisory covering 8 CVEs | 14.2.35-tuxcare.0 up to 14.2.35-tuxcare.5, plus listed versions 14.2.3514.2.35-tuxcare.4 | 14.2.35-tuxcare.5 |
@next/mdxTuxCare:npm From an advisory covering 11 CVEs | 13.5.11-tuxcare.0 up to 13.5.11-tuxcare.14, plus listed versions 13.5.1113.5.11-tuxcare.13 | 13.5.11-tuxcare.14 |
nextRoot:npm | before 15.5.21-aikido.1 | 15.5.21-aikido.116.2.11-aikido.116.2.11-aikido.215.5.21-aikido.2 |
@rootio/nextRoot:npm | before 15.5.21-root.io.1 | 15.5.21-root.io.116.2.11-root.io.116.2.11-root.io.215.5.21-root.io.2 |
nextRoot:npm | before 14.2.5-aikido.5 | 14.2.5-aikido.514.2.5-aikido.814.2.35-aikido.914.2.30-aikido.714.2.26-aikido.614.2.26-aikido.414.2.30-aikido.1013.4.19-aikido.613.4.19-aikido.714.2.10-aikido.314.2.13-aikido.314.0.4-aikido.614.2.3-aikido.114.0.4-aikido.914.2.24-aikido.214.2.25-aikido.214.1.0-aikido.414.2.18-aikido.213.3.0-aikido.514.0.4-aikido.514.0.4-aikido.714.0.4-aikido.214.1.0-aikido.714.1.0-aikido.814.0.4-aikido.314.2.13-aikido.114.2.3-aikido.514.2.0-aikido.214.0.3-aikido.314.2.5-aikido.914.2.5-aikido.1014.2.2-aikido.714.2.10-aikido.114.2.29-aikido.514.2.31-aikido.214.2.18-aikido.114.0.0-aikido.714.2.10-aikido.414.2.13-aikido.414.2.10-aikido.214.2.18-aikido.614.2.21-aikido.614.2.16-aikido.614.1.4-aikido.514.2.25-aikido.113.2.4-aikido.314.2.0-aikido.614.0.4-aikido.414.2.31-aikido.514.2.0-aikido.514.2.2-aikido.914.2.30-aikido.813.1.6-aikido.113.2.4-aikido.414.0.3-aikido.614.0.0-aikido.514.2.5-aikido.214.2.5-aikido.314.2.3-aikido.313.5.11-aikido.713.5.4-aikido.514.2.5-aikido.413.3.0-aikido.614.2.30-aikido.314.0.3-aikido.414.2.13-aikido.214.2.5-aikido.614.2.21-aikido.414.0.0-aikido.314.1.4-aikido.714.2.21-aikido.214.2.16-aikido.214.2.16-aikido.413.5.4-aikido.214.2.30-aikido.413.2.4-aikido.513.3.0-aikido.714.2.26-aikido.314.0.3-aikido.514.2.30-aikido.915.5.10-aikido.414.1.4-aikido.813.5.4-aikido.614.2.16-aikido.514.0.0-aikido.614.2.21-aikido.514.2.5-aikido.714.2.3-aikido.414.2.2-aikido.813.4.19-aikido.414.2.15-aikido.514.2.30-aikido.514.2.3-aikido.215.5.10-aikido.514.2.28-aikido.514.1.4-aikido.913.2.4-aikido.216.1.6-aikido.416.1.7-aikido.113.5.6-aikido.514.2.15-aikido.616.1.6-aikido.515.5.15-aikido.214.1.3-aikido.813.2.4-aikido.714.2.32-aikido.814.2.29-aikido.414.2.33-aikido.513.5.6-aikido.613.5.11-aikido.814.2.26-aikido.515.5.10-aikido.614.2.26-aikido.214.0.4-aikido.814.2.28-aikido.314.2.31-aikido.314.1.4-aikido.614.2.18-aikido.313.3.0-aikido.414.1.0-aikido.516.1.7-aikido.214.2.16-aikido.314.0.0-aikido.414.1.0-aikido.313.5.11-aikido.614.2.18-aikido.413.5.4-aikido.314.2.31-aikido.114.1.4-aikido.314.2.0-aikido.313.4.19-aikido.515.5.15-aikido.316.1.6-aikido.614.2.31-aikido.414.1.4-aikido.413.5.4-aikido.415.5.15-aikido.416.1.6-aikido.716.1.7-aikido.313.3.0-aikido.813.1.6-aikido.214.2.21-aikido.313.2.4-aikido.613.5.11-aikido.914.2.0-aikido.414.2.30-aikido.614.2.28-aikido.414.2.33-aikido.614.1.0-aikido.615.5.10-aikido.316.1.6-aikido.814.2.18-aikido.513.5.6-aikido.714.2.35-aikido.1014.2.35-aikido.1116.2.5-aikido.116.2.5-aikido.316.2.5-aikido.214.2.33-aikido.214.2.32-aikido.414.2.15-aikido.414.1.3-aikido.214.2.15-aikido.314.2.32-aikido.114.2.33-aikido.114.1.3-aikido.514.2.29-aikido.114.2.32-aikido.514.2.33-aikido.314.2.2-aikido.514.2.2-aikido.614.2.30-aikido.114.2.30-aikido.214.1.3-aikido.614.2.35-aikido.514.2.33-aikido.414.2.35-aikido.314.2.32-aikido.614.2.35-aikido.614.1.3-aikido.714.2.32-aikido.214.2.32-aikido.714.2.28-aikido.114.2.35-aikido.214.2.28-aikido.214.2.35-aikido.714.0.0-aikido.214.2.29-aikido.214.2.21-aikido.114.2.16-aikido.114.1.3-aikido.314.2.32-aikido.314.2.29-aikido.314.1.3-aikido.414.2.35-aikido.814.2.35-aikido.414.2.35-aikido.1 |
@rootio/nextRoot:npm | before 14.2.5-root.io.5 | 14.2.5-root.io.514.2.5-root.io.814.2.35-root.io.914.2.30-root.io.714.2.26-root.io.614.2.26-root.io.414.2.30-root.io.1013.4.19-root.io.613.4.19-root.io.714.2.10-root.io.314.2.13-root.io.314.0.4-root.io.614.2.3-root.io.114.0.4-root.io.914.2.25-root.io.214.2.24-root.io.214.1.0-root.io.414.2.18-root.io.213.3.0-root.io.514.0.4-root.io.514.0.4-root.io.714.0.4-root.io.214.1.0-root.io.714.1.0-root.io.814.0.4-root.io.314.2.13-root.io.114.2.3-root.io.514.2.0-root.io.214.0.3-root.io.314.2.5-root.io.914.2.5-root.io.1014.2.2-root.io.714.2.10-root.io.114.2.29-root.io.514.2.31-root.io.214.2.18-root.io.114.0.0-root.io.714.2.10-root.io.414.2.13-root.io.414.2.10-root.io.214.2.18-root.io.614.2.21-root.io.614.2.16-root.io.614.1.4-root.io.514.2.25-root.io.113.2.4-root.io.314.2.0-root.io.614.0.4-root.io.414.2.31-root.io.514.2.0-root.io.514.2.2-root.io.914.2.30-root.io.813.1.6-root.io.113.2.4-root.io.414.0.3-root.io.614.0.0-root.io.514.2.5-root.io.214.2.5-root.io.315.5.15-root.io.116.1.6-root.io.314.2.3-root.io.313.5.4-root.io.513.5.11-root.io.714.2.5-root.io.413.3.0-root.io.614.2.30-root.io.314.0.3-root.io.414.2.13-root.io.214.2.5-root.io.614.2.21-root.io.414.0.0-root.io.314.1.4-root.io.714.2.21-root.io.214.2.16-root.io.214.2.16-root.io.413.5.4-root.io.214.2.30-root.io.413.2.4-root.io.513.3.0-root.io.714.2.26-root.io.314.0.3-root.io.514.2.30-root.io.915.5.10-root.io.414.1.4-root.io.813.5.4-root.io.614.2.16-root.io.514.0.0-root.io.614.2.21-root.io.514.2.5-root.io.714.2.3-root.io.414.2.2-root.io.813.4.19-root.io.414.2.15-root.io.514.2.30-root.io.514.2.3-root.io.215.5.10-root.io.514.2.28-root.io.514.1.4-root.io.913.2.4-root.io.216.1.6-root.io.416.1.7-root.io.113.5.6-root.io.514.2.15-root.io.616.1.6-root.io.513.2.4-root.io.715.5.15-root.io.214.1.3-root.io.814.2.32-root.io.814.2.29-root.io.414.2.33-root.io.513.5.6-root.io.613.5.11-root.io.814.2.26-root.io.515.5.10-root.io.614.2.26-root.io.214.0.4-root.io.814.2.28-root.io.314.2.31-root.io.314.1.4-root.io.614.2.18-root.io.313.3.0-root.io.414.1.0-root.io.516.1.7-root.io.214.2.16-root.io.314.0.0-root.io.414.1.0-root.io.313.5.11-root.io.614.2.18-root.io.413.5.4-root.io.314.2.31-root.io.114.1.4-root.io.314.2.0-root.io.313.4.19-root.io.514.2.31-root.io.415.5.15-root.io.316.1.6-root.io.614.1.4-root.io.413.5.4-root.io.415.5.15-root.io.416.1.6-root.io.716.1.7-root.io.313.3.0-root.io.813.1.6-root.io.214.2.21-root.io.313.2.4-root.io.613.5.11-root.io.914.2.0-root.io.414.2.30-root.io.614.2.33-root.io.614.2.28-root.io.414.1.0-root.io.615.5.10-root.io.313.5.6-root.io.716.1.6-root.io.814.2.18-root.io.514.2.35-root.io.1014.2.35-root.io.1116.2.5-root.io.116.2.5-root.io.316.2.5-root.io.214.2.33-root.io.214.2.32-root.io.414.2.15-root.io.414.1.3-root.io.214.2.15-root.io.314.2.32-root.io.114.2.33-root.io.114.1.3-root.io.514.2.29-root.io.114.2.32-root.io.514.2.33-root.io.314.2.2-root.io.514.2.2-root.io.614.2.30-root.io.114.2.30-root.io.214.1.3-root.io.614.2.35-root.io.514.2.33-root.io.414.2.35-root.io.314.2.32-root.io.614.2.35-root.io.614.1.3-root.io.714.2.32-root.io.214.2.32-root.io.714.2.28-root.io.114.2.35-root.io.214.2.28-root.io.214.2.35-root.io.714.0.0-root.io.214.2.29-root.io.214.2.21-root.io.114.1.3-root.io.314.2.16-root.io.114.2.32-root.io.314.2.29-root.io.314.1.3-root.io.414.2.35-root.io.814.2.35-root.io.414.2.35-root.io.1 |
nextRoot:npm | before 14.2.5-aikido.8 | 14.2.5-aikido.814.2.33-aikido.214.2.32-aikido.414.2.35-aikido.914.2.30-aikido.714.2.26-aikido.614.2.26-aikido.414.2.30-aikido.1013.4.19-aikido.613.4.19-aikido.714.2.10-aikido.314.2.13-aikido.314.0.4-aikido.614.0.4-aikido.913.4.19-aikido.214.1.3-aikido.214.2.24-aikido.214.2.25-aikido.214.1.0-aikido.413.3.0-aikido.513.4.19-aikido.314.0.4-aikido.514.0.4-aikido.714.1.0-aikido.714.1.0-aikido.814.2.32-aikido.114.2.3-aikido.514.0.3-aikido.314.2.5-aikido.914.2.5-aikido.1014.2.2-aikido.714.2.33-aikido.114.1.3-aikido.514.2.29-aikido.114.2.29-aikido.514.2.31-aikido.214.0.0-aikido.714.2.10-aikido.414.2.13-aikido.414.2.18-aikido.614.2.21-aikido.614.2.16-aikido.614.2.25-aikido.114.2.0-aikido.614.2.31-aikido.514.2.2-aikido.914.2.30-aikido.813.1.6-aikido.114.2.24-aikido.714.2.24-aikido.414.0.3-aikido.614.2.32-aikido.514.2.33-aikido.314.0.0-aikido.514.2.3-aikido.314.2.2-aikido.414.2.2-aikido.513.5.11-aikido.714.2.2-aikido.613.5.4-aikido.514.0.0-aikido.114.1.3-aikido.613.3.0-aikido.113.3.0-aikido.613.4.19-aikido.114.0.3-aikido.413.5.11-aikido.414.0.3-aikido.114.2.21-aikido.413.5.6-aikido.114.0.0-aikido.314.1.4-aikido.713.5.4-aikido.114.2.21-aikido.213.3.0-aikido.214.2.16-aikido.214.2.16-aikido.413.5.4-aikido.214.2.35-aikido.513.5.6-aikido.214.2.30-aikido.413.3.0-aikido.714.2.33-aikido.414.2.26-aikido.314.0.3-aikido.514.2.30-aikido.915.5.10-aikido.414.1.4-aikido.814.2.35-aikido.314.2.32-aikido.614.2.35-aikido.613.5.4-aikido.614.2.24-aikido.514.1.3-aikido.714.2.16-aikido.514.0.0-aikido.614.2.21-aikido.514.2.3-aikido.414.2.2-aikido.813.4.19-aikido.414.2.15-aikido.514.2.30-aikido.514.2.3-aikido.213.5.6-aikido.313.5.6-aikido.415.5.10-aikido.514.2.28-aikido.514.2.24-aikido.114.2.32-aikido.214.1.4-aikido.916.1.6-aikido.414.1.3-aikido.116.1.7-aikido.113.3.0-aikido.314.2.32-aikido.713.5.6-aikido.514.2.15-aikido.616.1.6-aikido.514.1.3-aikido.813.2.4-aikido.714.2.32-aikido.814.2.29-aikido.414.2.35-aikido.214.2.33-aikido.513.5.6-aikido.613.5.11-aikido.814.2.26-aikido.515.5.10-aikido.614.0.4-aikido.814.2.28-aikido.314.2.31-aikido.314.2.24-aikido.614.1.4-aikido.614.2.35-aikido.714.2.18-aikido.313.3.0-aikido.414.1.0-aikido.516.1.7-aikido.214.2.16-aikido.314.0.0-aikido.413.5.11-aikido.514.1.0-aikido.313.5.11-aikido.614.2.18-aikido.413.5.4-aikido.313.4.19-aikido.514.0.0-aikido.216.1.6-aikido.614.2.31-aikido.414.2.29-aikido.213.5.4-aikido.414.2.21-aikido.116.1.6-aikido.716.1.7-aikido.314.1.3-aikido.313.3.0-aikido.814.2.24-aikido.313.1.6-aikido.214.2.21-aikido.314.2.32-aikido.314.2.29-aikido.313.5.11-aikido.914.0.3-aikido.214.1.3-aikido.414.2.30-aikido.614.2.28-aikido.414.2.33-aikido.614.1.0-aikido.614.2.35-aikido.814.2.35-aikido.415.5.10-aikido.316.1.6-aikido.814.2.18-aikido.513.5.6-aikido.714.2.35-aikido.1014.2.35-aikido.1115.5.15-aikido.215.5.15-aikido.315.5.15-aikido.4 |
@rootio/nextRoot:npm | before 14.2.5-root.io.8 | 14.2.5-root.io.814.2.33-root.io.214.2.32-root.io.414.2.35-root.io.914.2.30-root.io.714.2.26-root.io.614.2.26-root.io.414.2.30-root.io.1013.4.19-root.io.613.4.19-root.io.714.2.10-root.io.314.2.13-root.io.314.0.4-root.io.614.0.4-root.io.913.4.19-root.io.214.1.3-root.io.214.2.25-root.io.214.2.24-root.io.214.1.0-root.io.413.3.0-root.io.514.0.4-root.io.513.4.19-root.io.314.0.4-root.io.714.1.0-root.io.714.1.0-root.io.814.2.32-root.io.114.2.3-root.io.514.0.3-root.io.314.2.5-root.io.914.2.5-root.io.1014.2.2-root.io.714.2.33-root.io.114.1.3-root.io.514.2.29-root.io.114.2.29-root.io.514.2.31-root.io.214.0.0-root.io.714.2.10-root.io.414.2.13-root.io.414.2.18-root.io.614.2.21-root.io.614.2.16-root.io.614.2.25-root.io.114.2.0-root.io.614.2.31-root.io.514.2.2-root.io.914.2.30-root.io.813.1.6-root.io.114.2.24-root.io.714.2.24-root.io.414.0.3-root.io.614.2.32-root.io.514.2.33-root.io.314.0.0-root.io.516.1.6-root.io.116.1.6-root.io.216.1.6-root.io.314.2.3-root.io.314.2.2-root.io.413.5.4-root.io.514.2.2-root.io.513.5.11-root.io.714.2.2-root.io.614.0.0-root.io.114.1.3-root.io.613.3.0-root.io.113.3.0-root.io.613.4.19-root.io.114.0.3-root.io.413.5.11-root.io.414.0.3-root.io.114.2.21-root.io.413.5.6-root.io.114.0.0-root.io.314.1.4-root.io.713.5.4-root.io.114.2.21-root.io.213.3.0-root.io.214.2.16-root.io.214.2.16-root.io.413.5.4-root.io.214.2.35-root.io.513.5.6-root.io.214.2.30-root.io.413.3.0-root.io.714.2.33-root.io.414.2.26-root.io.314.0.3-root.io.514.2.30-root.io.915.5.10-root.io.414.1.4-root.io.814.2.35-root.io.314.2.32-root.io.614.2.35-root.io.613.5.4-root.io.614.2.24-root.io.514.1.3-root.io.714.2.16-root.io.514.0.0-root.io.614.2.21-root.io.514.2.3-root.io.414.2.2-root.io.813.4.19-root.io.414.2.15-root.io.514.2.30-root.io.514.2.3-root.io.213.5.6-root.io.313.5.6-root.io.415.5.10-root.io.514.2.28-root.io.514.2.24-root.io.114.2.32-root.io.214.1.4-root.io.916.1.6-root.io.414.1.3-root.io.116.1.7-root.io.113.3.0-root.io.314.2.32-root.io.713.5.6-root.io.514.2.15-root.io.616.1.6-root.io.513.2.4-root.io.714.1.3-root.io.814.2.32-root.io.814.2.29-root.io.414.2.33-root.io.514.2.35-root.io.213.5.6-root.io.613.5.11-root.io.814.2.26-root.io.515.5.10-root.io.614.0.4-root.io.814.2.28-root.io.314.2.24-root.io.614.2.31-root.io.314.2.35-root.io.714.1.4-root.io.614.2.18-root.io.313.3.0-root.io.414.1.0-root.io.516.1.7-root.io.214.2.16-root.io.314.0.0-root.io.413.5.11-root.io.514.1.0-root.io.313.5.11-root.io.614.2.18-root.io.413.5.4-root.io.313.4.19-root.io.514.0.0-root.io.214.2.31-root.io.416.1.6-root.io.614.2.29-root.io.213.5.4-root.io.414.2.21-root.io.114.1.3-root.io.316.1.6-root.io.716.1.7-root.io.313.3.0-root.io.814.2.24-root.io.313.1.6-root.io.214.2.21-root.io.314.2.32-root.io.314.2.29-root.io.313.5.11-root.io.914.0.3-root.io.214.1.3-root.io.414.2.30-root.io.614.2.33-root.io.614.2.28-root.io.414.1.0-root.io.614.2.35-root.io.814.2.35-root.io.415.5.10-root.io.313.5.6-root.io.716.1.6-root.io.814.2.18-root.io.514.2.35-root.io.1014.2.35-root.io.1115.5.15-root.io.115.5.15-root.io.215.5.15-root.io.315.5.15-root.io.4 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, cwes, references | ||
| affected, cwes, references | OSV | |
| affected, facts | ||
| affected | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-64643 is a medium vulnerability (CVSS 6.3) in Vercel Next.js, published January 28, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.51%, the 44th percentile. Fixed in next 15.5.16.
References
github.com/vercel/next.js/security/advisories/GHSA-955p-x3mx-jcvp
Show 16 moreShow less
nvd.nist.gov/vuln/detail/CVE-2026-23870
vercel.com/changelog/summary-of-cve-2026-23864