NE
Product
next.js
On CISA KEVExploited in the wildRansomware-linked
65
CVEs
1
On KEV
10.0
Max CVSS
8
New 30D
Severity mix
Critical 3High 27Medium 32Low 3
Watch
Add next.js to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-44582 | 3.7 | May 13 | Next.js: Cache poisoning via collisions in React Server Component cache-busting Affected: >= 13.4.6, < 15.5.16; >= 16.0.0, < 16.2.5 |
| CVE-2025-49005 | 3.7 | Jul 3 | Next.js is a React framework for building full-stack web applications Affected: 15.3.0 before 15.3.3 |
| CVE-2025-32421 | 3.7 | May 14 | Next.js is a React framework for building full-stack web applications Affected: before 14.2.24; 15.0.0 before 15.1.6 |
Showing 3