Skip to contentVercel Next vulnerabilities
- vercel next.jsInformation exposure in Next.js dev server due to lack of origin verificationCVE-2025-48068Fix available2.3 Low
- vercel next.jsNext.js Race Condition to Cache PoisoningCVE-2025-32421Public exploitFix available3.7 Low
- vercel next.jsNext.js may leak x-middleware-subrequest-id to external hostsCVE-2025-30218Fix available1.7 Low
- vercel next.jsAuthorization Bypass in Next.js MiddlewareCVE-2025-29927Public exploitFix availableEPSS 99.2%9.1 Critical
- vercel next.jsNext.js Vulnerable to Denial of Service (DoS) with Server ActionsCVE-2024-56332Fix available5.3 Medium
- vercel next.jsAuthorization bypass in Next.jsCVE-2024-51479Fix available7.5 High
- vercel next.jsNext.js image optimization has Denial of Service conditionCVE-2024-47831Fix available5.9 Medium
- vercel next.jsCache Poisoning in next.jsCVE-2024-46982Public exploitFix availableEPSS 59.2%7.5 High
- vercel next.jsNext.js Denial of Service (DoS) conditionCVE-2024-39693Fix available7.5 High
- vercel next.jsNext.js Server-Side Request Forgery in Server ActionsCVE-2024-34351Public exploitFix available7.5 High
- vercel next.jsNext.js Vulnerable to HTTP Request SmugglingCVE-2024-34350Fix available7.5 High
- vercel next.jsNext.js missing cache-control header may lead to CDN caching empty replyCVE-2023-46298Fix available7.5 High
- vercel next.jsUnexpected server crash in Next.js version 12.2.3CVE-2022-36046Fix available5.3 Medium
- vercel next.jsImproper CSP in Image Optimization API for Next.jsCVE-2022-23646Fix available5.9 Medium
- vercel next.jsDOS Vulnerability in next.jsCVE-2022-21721Fix available5.9 Medium
- vercel next.jsUnexpected server crash in Next.jsCVE-2021-43803Fix availableEPSS 47.3%7.5 High
- vercel next.jsXSS in Image Optimization API for Next.js versions between 10.0.0 and 11.1.0CVE-2021-39178Fix available7.5 High
- vercel next.jsOpen Redirect in Next.js versions below 11.1.0CVE-2021-37699Fix available6.9 Medium
- vercel next.jsOpen Redirect in Next.jsCVE-2020-15242Fix available4.7 Medium
- vercel next.jsDirectory Traversal in Next.js versions below 9.3.2CVE-2020-5284Fix availableEPSS 44.8%4.4 Medium