NE
Product
next.js
On CISA KEVExploited in the wildRansomware-linked
65
CVEs
1
On KEV
10.0
Max CVSS
8
New 30D
Severity mix
Critical 3High 27Medium 32Low 3
Watch
Add next.js to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-44578 | 8.6 | May 13 | Next.js: Server-side request forgery in applications using WebSocket upgrades Affected: >= 16.0.0, < 16.2.5; >= 13.4.13, < 15.5.16 |
| CVE-2026-94482 New | 8.2 | Oct 22 | Next.js: Denial of Service in App Router using Server Actions Affected: >= 13.0.0, < 15.5.28; >= 16.0.0, < 16.4.1 |
| CVE-2026-64642 | 8.2 | Jul 27 | Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale Affected: >= 16.0.0, < 16.2.11 |
| CVE-2025-57822 | 8.2 | Aug 29 | Next.js is a React framework for building full-stack web applications Affected: before 14.2.32; 15.0.0 before 15.4.7 |
| CVE-2026-44574 | 8.1 | May 13 | Next.js: Middleware / Proxy bypass through dynamic route parameter injection Affected: >= 15.4.0, < 15.5.16; >= 16.0.0, < 16.2.5 |
| CVE-2026-64641 | 7.5 | Jul 27 | Next.js: Denial of Service in App Router using Server Actions Affected: >= 13.0.0, < 15.5.21; >= 16.0.0, < 16.2.11 |
| CVE-2026-45109 | 7.5 | May 13 | Next.js: Middleware / Proxy bypass in App Router applications via segment-prefetch routes Affected: >= 15.2.0, < 15.5.17; >= 16.0.0, < 16.2.6 |
| CVE-2026-44579 | 7.5 | May 13 | Next.js: Denial of Service via connection exhaustion in applications using Cache Components Affected: >= 16.0.0, < 16.2.5; >= 15.0.0, < 15.5.16 |
| CVE-2026-44575 | 7.5 | May 13 | Next.js: Middleware / Proxy bypass in App Router applications via segment-prefetch routes Affected: >= 16.0.0, < 16.2.5; >= 15.2.0, < 15.5.16 |
| CVE-2026-44573 | 7.5 | May 13 | Next.js: Middleware / Proxy bypass in Pages Router applications using i18n Affected: >= 12.2.0, < 15.5.16; >= 16.0.0, < 16.2.5 |
| CVE-2026-27980 | 7.5 | Mar 18 | Next.js: Unbounded next/image disk cache growth can exhaust storage Affected: >= 10.0.0, < 16.1.7 |
| CVE-2026-27979 | 7.5 | Mar 18 | Next.js: Unbounded postponed resume buffering can lead to DoS Affected: >= 16.0.1, < 16.1.7 |
| CVE-2025-59472 | 7.5 | Jan 26 | A denial of service vulnerability exists in Next.js versions with Partial Prerendering (PPR) enabled when running in minimal mode Affected: 15.0.0 before 15.6.0; 16.0.0 before 16.1.5; 15.6.0; 15.6.0; 15.6.0; 15.6.0; +34 more |
| CVE-2025-59471 | 7.5 | Jan 26 | A denial of service vulnerability exists in self-hosted Next.js applications that have `remotePatterns` configured for the Image Optimizer Affected: 10.0.0 before 15.5.10; 16.0.0 before 16.1.5 |
| CVE-2025-67779 | 7.5 | Dec 11 | It was found that the fix addressing CVE-2025-55184 in React Server Components was incomplete and does not prevent a denial of service attack in a specific case Affected: 13.3.0 before 14.2.35; 15.0.0 before 15.0.7; 15.1.0 before 15.1.11; 15.2.0 before 15.2.8; 15.3.0 before 15.3.8; 15.4.0 before 15.4.10; +34 more |
| CVE-2025-55184 | 7.5 | Dec 11 | A pre-authentication denial of service vulnerability exists in React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following… Affected: 13.3.0 before 14.2.35; 15.0.0 before 15.0.7; 15.1.0 before 15.1.11; 15.2.0 before 15.2.8; 15.3.0 before 15.3.8; 15.4.0 before 15.4.10; +34 more |
| CVE-2025-49826 | 7.5 | Jul 3 | Next.js is a React framework for building full-stack web applications Affected: after 15.0.4 before 15.1.8; 15.0.4; 15.0.4 |
| CVE-2024-51479 | 7.5 | Dec 17 | Next.js is a React framework for building full-stack web applications Affected: 9.5.5 before 14.2.15 |
| CVE-2024-47831 | 7.5 | Oct 14 | Next.js is a React Framework for the Web Affected: 10.0.0 before 14.2.7 |
| CVE-2024-46982 | 7.5 | Sep 17 | Next.js is a React framework for building full-stack web applications Affected: 13.5.1 before 13.5.7; 14.0.0 before 14.2.10 |
| CVE-2024-39693 | 7.5 | Jul 10 | Next.js is a React framework Affected: 13.3.1 before 13.5.0 |
| CVE-2024-34351 | 7.5 | May 14 | Next.js is a React framework that can provide building blocks to create web applications Affected: 13.4.0 before 14.1.1 |
| CVE-2024-34350 | 7.5 | May 14 | Next.js is a React framework that can provide building blocks to create web applications Affected: 13.4.0 before 13.5.1 |
| CVE-2023-46298 | 7.5 | Oct 22 | Next.js before 13.4.20-canary.13 lacks a cache-control header and thus empty prefetch responses may sometimes be cached by a CDN, causing a denial of service to all users… Affected: before 13.4.20; 13.4.20; 13.4.20; 13.4.20; 13.4.20; 13.4.20; +8 more |
| CVE-2022-23646 | 7.5 | Feb 17 | Next.js is a React framework Affected: 10.0.0 before 12.1.0 |
| CVE-2022-21721 | 7.5 | Jan 28 | Next.js is a React framework Affected: 12.0.0 before 12.0.9 |
| CVE-2021-43803 | 7.5 | Dec 10 | Next.js is a React framework Affected: 11.1.0 before 11.1.3; 12.0.0 before 12.0.5 |
Showing 27