NE
Product
next.js
On CISA KEVExploited in the wildRansomware-linked
65
CVEs
1
On KEV
10.0
Max CVSS
8
New 30D
Severity mix
Critical 3High 27Medium 32Low 3
Watch
Add next.js to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-94483 | 6.5 | Oct 2 | Next.js: Server-Side Request Forgery in Image Optimization Affected: >= 16.0.0, < 16.3.8 |
| CVE-2026-64649 | 6.5 | Jul 27 | Next.js: Server-Side Request Forgery in Server Actions on Custom Servers Affected: >= 14.1.1, < 15.5.21; >= 16.0.0 < 16.2.11 |
| CVE-2026-29057 | 6.5 | Mar 18 | Next.js: HTTP request smuggling in rewrites Affected: >= 16.0.0-beta.0, < 16.1.7; >= 9.5.0, < 15.5.13 |
| CVE-2025-57752 | 6.2 | Aug 29 | Next.js Affected by Cache Key Confusion for Image Optimization API Routes Affected: >= 15.0.0, < 15.4.5; < 14.2.31 |
| CVE-2026-64645 | 6.1 | Jul 27 | Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname Affected: >= 12.0.0 < 15.5.21; >= 16.0.0, < 16.2.11 |
| CVE-2026-44580 | 6.1 | May 13 | Next.js: Cross-site scripting in beforeInteractive scripts with untrusted input Affected: >= 13.0.0, < 15.5.16; >= 16.0.0, < 16.2.5 |
| CVE-2021-39178 | 6.1 | Aug 31 | Next.js is a React framework Affected: 10.0.0 before 11.1.1 |
| CVE-2021-37699 | 6.1 | Aug 12 | Next.js is an open source website development framework to be used with the React library Affected: 10.0.5 through 10.2.0; 11.0.0 through 11.0.1 |
| CVE-2020-15242 | 6.1 | Oct 8 | Next.js versions >=9.5.0 and <9.5.4 are vulnerable to an Open Redirect Affected: 9.5.0 before 9.5.4 |
| CVE-2026-44577 | 5.9 | May 13 | Next.js: Denial of Service in the Image Optimization API Affected: >= 10.0.0, < 15.5.16; >= 16.0.0, < 16.2.5 |
| CVE-2026-44572 | 5.9 | May 13 | Next.js: Middleware / Proxy redirects can be cache-poisoned Affected: >= 12.2.0, < 15.5.16; >= 16.0.0, < 16.2.5 |
| CVE-2025-30218 | 5.9 | Apr 2 | Next.js is a React framework for building full-stack web applications Affected: 12.3.5; 13.5.9; 14.2.25; 15.2.3 |
| CVE-2026-94486 | 5.4 | Oct 2 | Next.js: Information disclosure in the Next.js development server's Model Context Protocol endpoint Affected: >= 16.0.0, < 16.3.8 |
| CVE-2026-64648 | 5.4 | Jul 27 | Next.js: Response Body Cache Confusion for Requests Containing Bodies Affected: >= 13.0.0, < 15.5.21; >= 16.0.0, < 16.2.11 |
| CVE-2026-64647 | 5.4 | Jul 27 | Next.js: Response Body Cache Confusion with Invalid UTF-8 Request Bodies Affected: >= 13.0.0, < 15.5.21; >= 16.0.0, < 16.2.11 |
| CVE-2026-44576 | 5.4 | May 13 | Next.js: Cache poisoning in React Server Component responses Affected: >= 14.2.0, < 15.5.16; >= 16.0.0, < 16.2.5 |
| CVE-2026-27977 | 5.4 | Mar 17 | Next.js: null origin can bypass dev HMR websocket CSRF checks Affected: >= 16.0.1, < 16.1.7 |
| CVE-2026-94485 | 5.3 | Oct 2 | Next.js: Information disclosure in Next.js App Router metadata image routes via dynamicParams bypass Affected: >= 16.0.0, < 16.3.8 |
| CVE-2026-94543 | 5.3 | Oct 2 | Next.js: Cache poisoning of SSG and ISR pages in self-hosted Next.js applications Affected: >= 15.0.0, < 15.5.27; >= 16.0.0, < 16.3.8 |
| CVE-2026-103004 | 5.3 | Oct 1 | next.js cache leak on warm `use cache` handlers accessing root param Affected: < 16.3.8 |
| CVE-2026-64646 | 5.3 | Jul 27 | Next.js: Unbounded Server Action payload in Edge runtime Affected: >= 13.0.0 < 15.5.21; >= 16.0.0, < 16.2.11 |
| CVE-2026-64644 | 5.3 | Jul 27 | Next.js: Denial of Service in the Image Optimization API using SVGs Affected: >= 15.5.0, < 15.5.21; >= 16.0.0, < 16.2.11 |
| CVE-2026-64643 | 5.3 | Jul 27 | Next.js: Unauthenticated Disclosure of Internal Server Function endpoints Affected: >= 13.0.0, < 15.5.21; >= 16.0.0, < 16.2.11 |
| CVE-2025-55183 | 5.3 | Dec 11 | An information leak vulnerability exists in specific configurations of React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the… Affected: 15.0.0 before 15.0.7; 15.1.0 before 15.1.11; 15.2.0 before 15.2.8; 15.3.0 before 15.3.8; 15.4.0 before 15.4.10; 15.5.0 before 15.5.9; +34 more |
| CVE-2024-56332 | 5.3 | Jan 3 | Next.js Vulnerable to Denial of Service (DoS) with Server Actions Affected: >= 13.0.0, < 13.5.8; >= 14.0.0, < 14.2.21; >= 15.0.0, < 15.1.2 |
| CVE-2022-36046 | 5.3 | Aug 31 | Next.js is a React framework that can provide building blocks to create web applications Affected: 12.2.3 |
| CVE-2026-94484 | 4.8 | Oct 2 | Next.js: Cache poisoning in Next.js SSG/ISR rendering leads to cross-user content substitution and persistent denial of service Affected: >= 15.0.0, < 15.5.27; >= 16.0.0, < 16.3.8 |
| CVE-2026-44581 | 4.7 | May 13 | Next.js: Cross-site scripting in App Router applications using CSP nonces Affected: >= 13.4.0, < 15.5.16; >= 16.0.0, < 16.2.5 |
| CVE-2026-27978 | 4.3 | Mar 17 | Next.js: null origin can bypass Server Actions CSRF checks Affected: >= 16.0.1, < 16.1.7 |
| CVE-2025-55173 | 4.3 | Aug 29 | Next.js Content Injection Vulnerability for Image Optimization Affected: >= 15.0.0, < 15.4.5; < 14.2.31 |
| CVE-2025-48068 | 4.3 | May 30 | Information exposure in Next.js dev server due to lack of origin verification Affected: >= 13.0, < 14.2.30; >= 15.0.0, < 15.2.2 |
| CVE-2026-94544 | 4.2 | Oct 2 | Next.js: Pending `use cache` fill can leak Draft Mode content into regular responses and persisted pages Affected: >= 16.3.0, < 16.3.8 |
Showing 32