Vercel Next.js vulnerabilities

• vercel next.js Next.js: Information disclosure in Next.js App Router metadata image routes via dynamicParams bypass CVE-2026-94485 Fix available 6.3 MediumOctober 2, 2026
• vercel next.js Next.js: Server-Side Request Forgery in Image Optimization CVE-2026-94483 Fix available 8.3 HighOctober 2, 2026
• vercel next.js Next.js: Pending `use cache` fill can leak Draft Mode content into regular responses and persisted pages CVE-2026-94544 Fix available 6.3 MediumOctober 2, 2026
• vercel next.js Next.js: Information disclosure in the Next.js development server's Model Context Protocol endpoint CVE-2026-94486 Fix available 2.3 LowOctober 2, 2026
• vercel next.js next.js cache leak on warm `use cache` handlers accessing root param CVE-2026-103004 Fix available 6.3 MediumOctober 1, 2026
• vercel next.js Next.js: Denial of Service in App Router using Server Actions CVE-2026-94482 Fix available 8.2 HighSeptember 30, 2026
• vercel next.js Next.js: Denial of Service in the Image Optimization API using SVGs CVE-2026-64644 Fix available 6.3 MediumJuly 22, 2026
• vercel next.js Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale CVE-2026-64642 Fix available 8.3 HighJuly 22, 2026
• vercel next.js, red hat enterprise linux 10, enterprise linux 7 +7 more +9 more Next.js: Middleware / Proxy bypass in App Router applications via segment-prefetch routes CVE-2026-45109 Fix available 7.5 HighMay 11, 2026
• vercel next.js, red hat enterprise linux 10, enterprise linux 7 +7 more +9 more Next.js: Middleware / Proxy bypass in App Router applications via segment-prefetch routes CVE-2026-44575 Fix available 7.5 HighMay 11, 2026
• vercel next.js, red hat enterprise linux 10, enterprise linux 7 +7 more +9 more Next.js: Middleware / Proxy bypass through dynamic route parameter injection CVE-2026-44574 Fix available 8.1 HighMay 11, 2026
• vercel next.js Next.js: Server-Side Request Forgery in Server Actions on Custom Servers CVE-2026-64649 Fix available 8.3 HighJanuary 28, 2026
• vercel next.js Next.js: Response Body Cache Confusion with Invalid UTF-8 Request Bodies CVE-2026-64647 Fix available 6.3 MediumJanuary 28, 2026
• vercel next.js Next.js: Unbounded Server Action payload in Edge runtime CVE-2026-64646 Fix available 6.3 MediumJanuary 28, 2026
• vercel next.js Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname CVE-2026-64645 Fix available 8.3 HighJanuary 28, 2026
• vercel next.js Next.js: Unauthenticated Disclosure of Internal Server Function endpoints CVE-2026-64643 Fix available 6.3 MediumJanuary 28, 2026
• vercel next.js Next.js: Cross-site scripting in App Router applications using CSP nonces CVE-2026-44581 Fix available 4.7 MediumJanuary 28, 2026
• vercel next.js Next.js: Cross-site scripting in beforeInteractive scripts with untrusted input CVE-2026-44580 Fix available 6.1 MediumJanuary 28, 2026
• vercel next.js, red hat enterprise linux 10, enterprise linux 7 +7 more +9 more Next.js: Denial of Service via connection exhaustion in applications using Cache Components CVE-2026-44579 Public exploitFix available 7.5 HighJanuary 28, 2026
• vercel next.js, red hat enterprise linux 10, enterprise linux 7 +7 more +9 more Next.js: Server-side request forgery in applications using WebSocket upgrades CVE-2026-44578 Public exploitFix available EPSS 35.5% 8.6 HighJanuary 28, 2026
• vercel next.js, red hat enterprise linux 10, enterprise linux 7 +7 more +9 more Next.js: Denial of Service in the Image Optimization API CVE-2026-44577 Fix available 5.9 MediumJanuary 28, 2026
• vercel next.js Next.js: Cache poisoning in React Server Component responses CVE-2026-44576 Fix available 5.4 MediumJanuary 28, 2026
• vercel next.js, red hat enterprise linux 10, enterprise linux 7 +7 more +9 more Next.js: Middleware / Proxy bypass in Pages Router applications using i18n CVE-2026-44573 Fix available 7.5 HighJanuary 28, 2026
• vercel next.js Next.js: Middleware / Proxy redirects can be cache-poisoned CVE-2026-44572 Fix available 3.7 LowJanuary 28, 2026
• vercel next.js Next.js: HTTP request smuggling in rewrites CVE-2026-29057 Public exploitFix available 6.3 MediumJanuary 28, 2026
• vercel next.js Next.js: Unbounded next/image disk cache growth can exhaust storage CVE-2026-27980 Fix available 6.9 MediumJanuary 28, 2026
• facebook react, meta react-server-dom-parcel, react-server-dom-turbopack +2 more +4 more Denial of Service Vulnerability in React Server Components CVE-2025-67779 Fix available EPSS 20.0% 7.5 HighDecember 11, 2025
• vercel next.js Next.js: Unbounded postponed resume buffering can lead to DoS CVE-2026-27979 Fix available 6.9 MediumDecember 11, 2025
• vercel next.js Next.js: null origin can bypass Server Actions CSRF checks CVE-2026-27978 Public exploitFix available 5.3 MediumDecember 11, 2025
• vercel next.js Next.js: null origin can bypass dev HMR websocket CSRF checks CVE-2026-27977 Fix available 2.3 LowDecember 11, 2025
• vercel next, next.js +1 more Next.js has Unbounded Memory Consumption via PPR Resume Endpoint CVE-2025-59472 Fix available 5.9 MediumDecember 11, 2025
• vercel next, next.js +1 more Next.js Vulnerable to Denial of Service with Server Components CVE-2025-59471 Fix available 5.9 MediumDecember 11, 2025
• vercel next.js Next.js: Cache poisoning of SSG and ISR pages in self-hosted Next.js applications CVE-2026-94543 Fix available 6.3 MediumDecember 11, 2025
• vercel next.js Next.js: Cache poisoning in Next.js SSG/ISR rendering leads to cross-user content substitution and persistent denial of service CVE-2026-94484 Fix available 6.3 MediumDecember 11, 2025
• vercel next.js Next.js: Unauthenticated Remote Code Execution on windows-hosted servers CVE-2026-75604 Public exploitFix available 9.0 CriticalDecember 11, 2025
• vercel next.js Next.js: Response Body Cache Confusion for Requests Containing Bodies CVE-2026-64648 Fix available 6.0 MediumDecember 11, 2025
• vercel next.js Next.js: Denial of Service in App Router using Server Actions CVE-2026-64641 Fix available 8.2 HighDecember 11, 2025
• vercel next.js Next.js: Cache poisoning via collisions in React Server Component cache-busting CVE-2026-44582 Fix available 3.7 LowDecember 11, 2025
• facebook react, meta react-server-dom-parcel, react-server-dom-turbopack +2 more +4 more Denial of Service Vulnerability in React Server Components CVE-2025-55184 Public exploitFix available EPSS 66.6% 7.5 HighDecember 11, 2025
• facebook react, meta react-server-dom-parcel, react-server-dom-turbopack +2 more +4 more Source Code Exposure Vulnerability in React Server Components CVE-2025-55183 Public exploitFix available EPSS 64.2% 5.3 MediumDecember 11, 2025
• drupal next.js Next.js - Critical - Access bypass - SA-CONTRIB-2025-122 CVE-2025-13984 Fix available 6.1 MediumDecember 3, 2025
• facebook react, meta react server components, react-server-dom-parcel +3 more +5 more React Server Components are Vulnerable to RCE CVE-2025-55182 In KEVPublic exploitFix available EPSS 99.7% 10.0 CriticalDecember 3, 2025
• vercel next.js Next.js Affected by Cache Key Confusion for Image Optimization API Routes CVE-2025-57752 Fix available 6.2 MediumAugust 29, 2025
• vercel next.js Next.js Content Injection Vulnerability for Image Optimization CVE-2025-55173 Fix available 4.3 MediumAugust 29, 2025
• vercel next.js Next.js Improper Middleware Redirect Handling Leads to SSRF CVE-2025-57822 Fix available 6.5 MediumAugust 29, 2025
• vercel next.js Next.js DoS vulnerability via cache poisoning CVE-2025-49826 Fix available 7.5 HighJuly 3, 2025
• vercel next.js, vercel +1 more Next.js cache poisoning due to omission of Vary header CVE-2025-49005 Fix available 3.7 LowJuly 3, 2025
• vercel next.js Information exposure in Next.js dev server due to lack of origin verification CVE-2025-48068 Fix available 2.3 LowMay 28, 2025
• vercel next.js Next.js Race Condition to Cache Poisoning CVE-2025-32421 Public exploitFix available 3.7 LowMay 14, 2025
• vercel next.js Next.js may leak x-middleware-subrequest-id to external hosts CVE-2025-30218 Fix available 1.7 LowApril 2, 2025
• Show olderLoading…