Login Request a demo
NE
Product
next
by vercel · last CVE Sep 30, 2026
3
CVEs
0
On KEV
7.5
Max CVSS
1
New 30D
Vulnerabilities3In the news0Timeline
Severity mix
Critical 0High 2Medium 1Low 0
Severity
All severities3Critical0High2Medium1Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add next to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2025-59472
7.5
0%
Jan 26
A denial of service vulnerability exists in Next.js versions with Partial Prerendering (PPR) enabled when running in minimal mode
Affected: 15.0.0-canary.0 before 15.0.0; 15.0.1-canary.0 before 15.0.1; 15.0.2-canary.0 before 15.0.2; 15.0.3-canary.0 before 15.0.3; 15.0.4-canary.0 before 15.0.4; 15.1.0-canary.0 before 15.1.0; +34 more
CVE-2025-59471
7.5
0%
Jan 26
A denial of service vulnerability exists in self-hosted Next.js applications that have `remotePatterns` configured for the Image Optimizer
Affected: 10.0 before 10.0; 11.0 before 11.0; 12.0 before 12.0; 13.0 before 13.0; 14.0 before 14.0; 15.0 before 15.5.10; +1 more
CVE-2026-94545
5.3
1%
Sep 30
Satori-generated SVG has improper escaping
Affected: >= 16.2.0, < 16.3.6
Showing 3