next vulnerabilities (Root)
73 vulnerabilities.
-
nextRoot AIKIDO-2026-104277 in next - Patched by Root No score -
nextRoot AIKIDO-2026-553733 in next - Patched by Root No score -
nextRoot Next.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays 9.5 Critical -
nextRoot Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used 9.5 Critical -
nextRoot Next.js: Denial of Service in App Router using Server Actions 8.2 High -
nextRoot Next.js: Information disclosure in Next.js App Router metadata image routes via dynamicParams bypass 6.3 Medium -
nextRoot Next.js: Server-Side Request Forgery in Image Optimization 8.3 High -
nextRoot Next.js: Pending `use cache` fill can leak Draft Mode content into regular responses and persisted pages 6.3 Medium -
nextRoot Next.js: Information disclosure in the Next.js development server's Model Context Protocol endpoint 2.3 Low -
nextRoot next.js cache leak on warm `use cache` handlers accessing root param 6.3 Medium -
nextRoot Next.js: Remote Code Execution in next/og ImageResponse 9.5 Critical -
nextRoot AIKIDO-2026-10762 in next - Patched by Root No score -
nextRoot AIKIDO-2026-10758 in next - Patched by Root No score -
nextRoot AIKIDO-2026-10757 in next - Patched by Root No score -
nextRoot AIKIDO-2026-10756 in next - Patched by Root No score -
nextRoot AIKIDO-2026-10755 in next - Patched by Root No score -
nextRoot AIKIDO-2026-10754 in next - Patched by Root No score -
nextRoot AIKIDO-2026-10095 in next - Patched by Root No score -
nextRoot AIKIDO-2025-10936 in next - Patched by Root No score -
nextRoot AIKIDO-2024-10173 in next - Patched by Root No score -
nextRoot AIKIDO-2026-10761 in next - Patched by Root No score -
nextRoot AIKIDO-2026-10760 in next - Patched by Root No score -
nextRoot AIKIDO-2026-10759 in next - Patched by Root No score -
nextRoot Next.js: Denial of Service in the Image Optimization API using SVGs 6.3 Medium -
nextRoot Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale 8.3 High -
nextRoot Next.js: Middleware / Proxy bypass in App Router applications via segment-prefetch routes 7.5 High -
nextRoot Next.js: Middleware / Proxy bypass in App Router applications via segment-prefetch routes 7.5 High -
nextRoot Next.js: Middleware / Proxy bypass through dynamic route parameter injection 8.1 High -
nextRoot Next.js: Server-Side Request Forgery in Server Actions on Custom Servers 8.3 High -
nextRoot Next.js: Response Body Cache Confusion with Invalid UTF-8 Request Bodies 6.3 Medium -
nextRoot Next.js: Unbounded Server Action payload in Edge runtime 6.3 Medium -
nextRoot Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname 8.3 High -
nextRoot Next.js: Unauthenticated Disclosure of Internal Server Function endpoints 6.3 Medium -
nextRoot Next.js: Cross-site scripting in App Router applications using CSP nonces 4.7 Medium -
nextRoot Next.js: Cross-site scripting in beforeInteractive scripts with untrusted input 6.1 Medium -
nextRoot Next.js: Denial of Service via connection exhaustion in applications using Cache Components 7.5 High -
nextRoot Next.js: Server-side request forgery in applications using WebSocket upgrades 8.6 High -
nextRoot Next.js: Denial of Service in the Image Optimization API 5.9 Medium -
nextRoot Next.js: Cache poisoning in React Server Component responses 5.4 Medium -
nextRoot Next.js: Middleware / Proxy bypass in Pages Router applications using i18n 7.5 High -
nextRoot Next.js: Middleware / Proxy redirects can be cache-poisoned 3.7 Low -
nextRoot Next.js: HTTP request smuggling in rewrites 6.3 Medium -
nextRoot Next.js: Unbounded next/image disk cache growth can exhaust storage 6.9 Medium -
nextRoot Next.js HTTP request deserialization can lead to DoS when using insecure React Server Components 7.5 High -
nextRoot React Server Components have multiple Denial of Service Vulnerabilities 7.5 High -
nextRoot Next has a Denial of Service with Server Components - Incomplete Fix Follow-Up 7.5 High -
nextRoot Next.js: Unbounded postponed resume buffering can lead to DoS 6.9 Medium -
nextRoot Next.js: null origin can bypass Server Actions CSRF checks 5.3 Medium -
nextRoot Next.js: null origin can bypass dev HMR websocket CSRF checks 2.3 Low -
nextRoot Next.js has Unbounded Memory Consumption via PPR Resume Endpoint 5.9 Medium - Show olderLoading…