Login Request a demo
NE
Product
next.js
by vercel · last CVE Oct 22, 2026
On CISA KEVExploited in the wildRansomware-linked
65
CVEs
1
On KEV
10.0
Max CVSS
8
New 30D
Vulnerabilities65In the news6Timeline
Severity mix
Critical 3High 27Medium 32Low 3
Severity
All severities65Critical3High27Medium32Low3
Exploitation
On CISA KEV1Exploited in the wild1
Watch

Add next.js to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2025-55182
RansomwareIn wildKEV
10.0
100%
Dec 3
Meta React Server Components Remote Code Execution Vulnerability
Affected: 15.0.0 before 15.0.5; 15.1.0 before 15.1.9; 15.2.0 before 15.2.6; 15.3.0 before 15.3.6; 15.4.0 before 15.4.8; 15.5.0 before 15.5.7; +34 more
CVE-2025-29927
9.1
99%
Mar 21
Next.js is a React framework for building full-stack web applications
Affected: 11.1.4 before 12.3.5; 13.0.0 before 13.5.9; 14.0.0 before 14.2.25; 15.0.0 before 15.2.3
CVE-2026-75604
9.0
2%
Sep 1
Next.js: Unauthenticated Remote Code Execution on windows-hosted servers
Affected: >= 13.4.0, < 15.5.24; >= 16.0.0, < 16.3.3
CVE-2026-44578
8.6
36%
May 13
Next.js: Server-side request forgery in applications using WebSocket upgrades
Affected: >= 16.0.0, < 16.2.5; >= 13.4.13, < 15.5.16
CVE-2026-94482
New
8.2
0%
Oct 22
Next.js: Denial of Service in App Router using Server Actions
Affected: >= 13.0.0, < 15.5.28; >= 16.0.0, < 16.4.1
CVE-2026-64642
8.2
1%
Jul 27
Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale
Affected: >= 16.0.0, < 16.2.11
CVE-2025-57822
8.2
3%
Aug 29
Next.js is a React framework for building full-stack web applications
Affected: before 14.2.32; 15.0.0 before 15.4.7
CVE-2026-44574
8.1
1%
May 13
Next.js: Middleware / Proxy bypass through dynamic route parameter injection
Affected: >= 15.4.0, < 15.5.16; >= 16.0.0, < 16.2.5
CVE-2026-64641
7.5
1%
Jul 27
Next.js: Denial of Service in App Router using Server Actions
Affected: >= 13.0.0, < 15.5.21; >= 16.0.0, < 16.2.11
CVE-2026-45109
7.5
1%
May 13
Next.js: Middleware / Proxy bypass in App Router applications via segment-prefetch routes
Affected: >= 15.2.0, < 15.5.17; >= 16.0.0, < 16.2.6
CVE-2026-44579
7.5
1%
May 13
Next.js: Denial of Service via connection exhaustion in applications using Cache Components
Affected: >= 16.0.0, < 16.2.5; >= 15.0.0, < 15.5.16
CVE-2026-44575
7.5
2%
May 13
Next.js: Middleware / Proxy bypass in App Router applications via segment-prefetch routes
Affected: >= 16.0.0, < 16.2.5; >= 15.2.0, < 15.5.16
CVE-2026-44573
7.5
1%
May 13
Next.js: Middleware / Proxy bypass in Pages Router applications using i18n
Affected: >= 12.2.0, < 15.5.16; >= 16.0.0, < 16.2.5
CVE-2026-27980
7.5
1%
Mar 18
Next.js: Unbounded next/image disk cache growth can exhaust storage
Affected: >= 10.0.0, < 16.1.7
CVE-2026-27979
7.5
1%
Mar 18
Next.js: Unbounded postponed resume buffering can lead to DoS
Affected: >= 16.0.1, < 16.1.7
CVE-2025-59472
7.5
0%
Jan 26
A denial of service vulnerability exists in Next.js versions with Partial Prerendering (PPR) enabled when running in minimal mode
Affected: 15.0.0 before 15.6.0; 16.0.0 before 16.1.5; 15.6.0; 15.6.0; 15.6.0; 15.6.0; +34 more
CVE-2025-59471
7.5
0%
Jan 26
A denial of service vulnerability exists in self-hosted Next.js applications that have `remotePatterns` configured for the Image Optimizer
Affected: 10.0.0 before 15.5.10; 16.0.0 before 16.1.5
CVE-2025-67779
7.5
20%
Dec 12
It was found that the fix addressing CVE-2025-55184 in React Server Components was incomplete and does not prevent a denial of service attack in a specific case
Affected: 13.3.0 before 14.2.35; 15.0.0 before 15.0.7; 15.1.0 before 15.1.11; 15.2.0 before 15.2.8; 15.3.0 before 15.3.8; 15.4.0 before 15.4.10; +34 more
CVE-2025-55184
7.5
67%
Dec 11
A pre-authentication denial of service vulnerability exists in React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following…
Affected: 13.3.0 before 14.2.35; 15.0.0 before 15.0.7; 15.1.0 before 15.1.11; 15.2.0 before 15.2.8; 15.3.0 before 15.3.8; 15.4.0 before 15.4.10; +34 more
CVE-2025-49826
7.5
1%
Jul 3
Next.js is a React framework for building full-stack web applications
Affected: after 15.0.4 before 15.1.8; 15.0.4; 15.0.4
CVE-2024-51479
7.5
4%
Dec 17
Next.js is a React framework for building full-stack web applications
Affected: 9.5.5 before 14.2.15
CVE-2024-47831
7.5
1%
Oct 14
Next.js is a React Framework for the Web
Affected: 10.0.0 before 14.2.7
CVE-2024-46982
7.5
59%
Sep 17
Next.js is a React framework for building full-stack web applications
Affected: 13.5.1 before 13.5.7; 14.0.0 before 14.2.10
CVE-2024-39693
7.5
0%
Jul 10
Next.js is a React framework
Affected: 13.3.1 before 13.5.0
CVE-2024-34351
7.5
5%
May 14
Next.js is a React framework that can provide building blocks to create web applications
Affected: 13.4.0 before 14.1.1
CVE-2024-34350
7.5
1%
May 14
Next.js is a React framework that can provide building blocks to create web applications
Affected: 13.4.0 before 13.5.1
CVE-2023-46298
7.5
2%
Oct 22
Next.js before 13.4.20-canary.13 lacks a cache-control header and thus empty prefetch responses may sometimes be cached by a CDN, causing a denial of service to all users…
Affected: before 13.4.20; 13.4.20; 13.4.20; 13.4.20; 13.4.20; 13.4.20; +8 more
CVE-2022-23646
7.5
2%
Feb 17
Next.js is a React framework
Affected: 10.0.0 before 12.1.0
CVE-2022-21721
7.5
2%
Jan 28
Next.js is a React framework
Affected: 12.0.0 before 12.0.9
CVE-2021-43803
7.5
47%
Dec 10
Next.js is a React framework
Affected: 11.1.0 before 11.1.3; 12.0.0 before 12.0.5
CVE-2026-94483
6.5
0%
Oct 2
Next.js: Server-Side Request Forgery in Image Optimization
Affected: >= 16.0.0, < 16.3.8
CVE-2026-64649
6.5
0%
Jul 27
Next.js: Server-Side Request Forgery in Server Actions on Custom Servers
Affected: >= 14.1.1, < 15.5.21; >= 16.0.0 < 16.2.11
CVE-2026-29057
6.5
0%
Mar 18
Next.js: HTTP request smuggling in rewrites
Affected: >= 16.0.0-beta.0, < 16.1.7; >= 9.5.0, < 15.5.13
CVE-2025-57752
6.2
0%
Aug 29
Next.js is a React framework for building full-stack web applications
Affected: before 14.2.31; 15.0.0 before 15.4.5
CVE-2026-64645
6.1
0%
Jul 27
Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname
Affected: >= 12.0.0 < 15.5.21; >= 16.0.0, < 16.2.11
CVE-2026-44580
6.1
0%
May 13
Next.js: Cross-site scripting in beforeInteractive scripts with untrusted input
Affected: >= 13.0.0, < 15.5.16; >= 16.0.0, < 16.2.5
CVE-2021-39178
6.1
1%
Aug 31
Next.js is a React framework
Affected: 10.0.0 before 11.1.1
CVE-2021-37699
6.1
1%
Aug 12
Next.js is an open source website development framework to be used with the React library
Affected: 10.0.5 through 10.2.0; 11.0.0 through 11.0.1
CVE-2020-15242
6.1
1%
Oct 8
Next.js versions >=9.5.0 and <9.5.4 are vulnerable to an Open Redirect
Affected: 9.5.0 before 9.5.4
CVE-2026-44577
5.9
1%
May 13
Next.js: Denial of Service in the Image Optimization API
Affected: >= 10.0.0, < 15.5.16; >= 16.0.0, < 16.2.5
CVE-2026-44572
5.9
0%
May 13
Next.js: Middleware / Proxy redirects can be cache-poisoned
Affected: >= 12.2.0, < 15.5.16; >= 16.0.0, < 16.2.5
CVE-2025-30218
5.9
0%
Apr 2
Next.js is a React framework for building full-stack web applications
Affected: 12.3.5; 13.5.9; 14.2.25; 15.2.3
CVE-2026-94486
5.4
0%
Oct 2
Next.js: Information disclosure in the Next.js development server's Model Context Protocol endpoint
Affected: >= 16.0.0, < 16.3.8
CVE-2026-64648
5.4
0%
Jul 27
Next.js: Response Body Cache Confusion for Requests Containing Bodies
Affected: >= 13.0.0, < 15.5.21; >= 16.0.0, < 16.2.11
CVE-2026-64647
5.4
0%
Jul 27
Next.js: Response Body Cache Confusion with Invalid UTF-8 Request Bodies
Affected: >= 13.0.0, < 15.5.21; >= 16.0.0, < 16.2.11
CVE-2026-44576
5.4
0%
May 13
Next.js: Cache poisoning in React Server Component responses
Affected: >= 14.2.0, < 15.5.16; >= 16.0.0, < 16.2.5
CVE-2026-27977
5.4
0%
Mar 17
Next.js: null origin can bypass dev HMR websocket CSRF checks
Affected: >= 16.0.1, < 16.1.7
CVE-2026-94485
5.3
0%
Oct 2
Next.js: Information disclosure in Next.js App Router metadata image routes via dynamicParams bypass
Affected: >= 16.0.0, < 16.3.8
CVE-2026-94543
5.3
1%
Oct 2
Next.js: Cache poisoning of SSG and ISR pages in self-hosted Next.js applications
Affected: >= 15.0.0, < 15.5.27; >= 16.0.0, < 16.3.8
CVE-2026-103004
5.3
0%
Oct 1
next.js cache leak on warm `use cache` handlers accessing root param
Affected: < 16.3.8
Page 1 of 2 · 65 total
12