Skip to contentVercel vulnerabilities
Newest
- vercel next.jsNext.js: Denial of Service in App Router using Server ActionsCVE-2026-64641Fix available8.2 High
- vercel next.jsNext.js: Cache poisoning via collisions in React Server Component cache-bustingCVE-2026-44582Fix available3.7 Low
- facebook react, meta react-server-dom-parcel, react-server-dom-turbopack +2 more +4 moreDenial of Service Vulnerability in React Server ComponentsCVE-2025-55184Public exploitFix availableEPSS 64.4%7.5 High
- facebook react, meta react-server-dom-parcel, react-server-dom-turbopack +2 more +4 moreSource Code Exposure Vulnerability in React Server ComponentsCVE-2025-55183Public exploitFix availableEPSS 61.9%5.3 Medium
- drupal next.jsNext.js - Critical - Access bypass - SA-CONTRIB-2025-122CVE-2025-13984Fix available6.1 Medium
- facebook react, meta react server components, react-server-dom-parcel +3 more +5 moreReact Server Components are Vulnerable to RCECVE-2025-55182In KEVPublic exploitFix availableEPSS 99.7%10.0 Critical
- vercel ai, ai sdk +1 moreVercel’s AI SDK's filetype whitelists can be bypassed when uploading filesCVE-2025-48985Fix available3.7 Low
- nuxt devtools, vercel nuxt devtools +1 moreNuxt DevTools vulnerable to cross-site scripting (XSS)CVE-2025-52662Fix available6.9 Medium
- vercel next.jsNext.js Affected by Cache Key Confusion for Image Optimization API RoutesCVE-2025-57752Fix available6.2 Medium
- vercel next.jsNext.js Content Injection Vulnerability for Image OptimizationCVE-2025-55173Fix available4.3 Medium
- vercel next.jsNext.js Improper Middleware Redirect Handling Leads to SSRFCVE-2025-57822Fix available6.5 Medium
- vercel hypervercel hyper rimraf-standalone.js ignoreMap redosCVE-2025-70745.3 Medium
- vercel next.jsNext.js DoS vulnerability via cache poisoningCVE-2025-49826Fix available7.5 High
- vercel next.js, vercel +1 moreNext.js cache poisoning due to omission of Vary headerCVE-2025-49005Fix available3.7 Low
- vercel next.jsInformation exposure in Next.js dev server due to lack of origin verificationCVE-2025-48068Fix available2.3 Low
- vercel next.jsNext.js Race Condition to Cache PoisoningCVE-2025-32421Public exploitFix available3.7 Low
- vercel flagsInformation Disclosure via Flags override linkCVE-2025-46332Fix available6.5 Medium
- vercel next.jsNext.js may leak x-middleware-subrequest-id to external hostsCVE-2025-30218Fix available1.7 Low
- vercel next.jsAuthorization Bypass in Next.js MiddlewareCVE-2025-29927Public exploitFix availableEPSS 99.2%9.1 Critical
- vercel next.jsNext.js Vulnerable to Denial of Service (DoS) with Server ActionsCVE-2024-56332Fix available5.3 Medium
- vercel next.jsAuthorization bypass in Next.jsCVE-2024-51479Fix available7.5 High
- vercel next.jsNext.js image optimization has Denial of Service conditionCVE-2024-47831Fix available5.9 Medium
- vercel next.jsCache Poisoning in next.jsCVE-2024-46982Public exploitFix availableEPSS 59.2%7.5 High
- vercel next.jsNext.js Denial of Service (DoS) conditionCVE-2024-39693Fix available7.5 High
- vercel next.jsNext.js Server-Side Request Forgery in Server ActionsCVE-2024-34351Public exploitFix available7.5 High
- vercel next.jsNext.js Vulnerable to HTTP Request SmugglingCVE-2024-34350Fix available7.5 High
- vercel pkgLocal Privilege Escalation in execuatables bundled by pkgCVE-2024-248286.6 Medium
- hyperAn issue in Hyper on macOS version 3.4.1 and before, allows remote attackers to execute arbitrary...CVE-2024-23741Public exploit9.8 Critical
- vercel next.jsNext.js missing cache-control header may lead to CDN caching empty replyCVE-2023-46298Fix available7.5 High
- vercel msvercel ms index.js parse redosCVE-2017-20162Fix available4.3 Medium
- vercel next.jsUnexpected server crash in Next.js version 12.2.3CVE-2022-36046Fix available5.3 Medium
- vercel next.jsImproper CSP in Image Optimization API for Next.jsCVE-2022-23646Fix available5.9 Medium
- vercel next.jsDOS Vulnerability in next.jsCVE-2022-21721Fix available5.9 Medium
- vercel next.jsUnexpected server crash in Next.jsCVE-2021-43803Fix availableEPSS 47.3%7.5 High
- vercel next.jsXSS in Image Optimization API for Next.js versions between 10.0.0 and 11.1.0CVE-2021-39178Fix available7.5 High
- vercel next.jsOpen Redirect in Next.js versions below 11.1.0CVE-2021-37699Fix available6.9 Medium
- hyperLenient Parsing of Content-Length Header When Prefixed with Plus SignCVE-2021-32715Fix available3.1 Low
- hyperInteger Overflow in Chunked Transfer-EncodingCVE-2021-32714Fix available5.9 Medium
- hyperMultiple Transfer-Encoding headers misinterprets request payloadCVE-2021-21299Fix available4.8 Medium
- vercel next.jsOpen Redirect in Next.jsCVE-2020-15242Fix available4.7 Medium
- vercel next.jsDirectory Traversal in Next.js versions below 9.3.2CVE-2020-5284Fix availableEPSS 44.8%4.4 Medium
- vercel msRegular Expression Denial of Service in msCVE-2015-8315Fix available7.5 High