Vercel next.js

• CVE-2026-94482 High 8.2 Next.js: Denial of Service in App Router using Server Actions 0.4%
• CVE-2026-94484 Medium 6.3 Next.js: Cache poisoning in Next.js SSG/ISR rendering leads to cross-user content substitution and persistent denial of service 0.2%
• CVE-2026-94485 Medium 6.3 Next.js: Information disclosure in Next.js App Router metadata image routes via dynamicParams bypass 0.2%
• CVE-2026-94483 High 8.3 Next.js: Server-Side Request Forgery in Image Optimization 0.3%
• CVE-2026-94543 Medium 6.3 Next.js: Cache poisoning of SSG and ISR pages in self-hosted Next.js applications 0.5%
• CVE-2026-94544 Medium 6.3 Next.js: Pending `use cache` fill can leak Draft Mode content into regular responses and persisted pages 0.2%
• CVE-2026-94486 Low 2.3 Next.js: Information disclosure in the Next.js development server's Model Context Protocol endpoint 0.1%
• CVE-2026-103004 Medium 6.3 next.js cache leak on warm `use cache` handlers accessing root param 0.2%
• CVE-2026-75604 Critical 9.0 Next.js: Unauthenticated Remote Code Execution on windows-hosted servers 2.1%
• CVE-2026-64649 High 8.3 Next.js: Server-Side Request Forgery in Server Actions on Custom Servers 0.5%
• CVE-2026-64648 Medium 6.0 Next.js: Response Body Cache Confusion for Requests Containing Bodies 0.3%
• CVE-2026-64647 Medium 6.3 Next.js: Response Body Cache Confusion with Invalid UTF-8 Request Bodies 0.3%
• CVE-2026-64646 Medium 6.3 Next.js: Unbounded Server Action payload in Edge runtime 0.5%
• CVE-2026-64644 Medium 6.3 Next.js: Denial of Service in the Image Optimization API using SVGs 0.7%
• CVE-2026-64643 Medium 6.3 Next.js: Unauthenticated Disclosure of Internal Server Function endpoints 0.5%
• CVE-2026-64642 High 8.3 Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale 0.6%
• CVE-2026-64641 High 8.2 Next.js: Denial of Service in App Router using Server Actions 0.9%
• CVE-2026-64645 High 8.3 Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname 0.4%
• CVE-2026-45109 High 7.5 Next.js: Middleware / Proxy bypass in App Router applications via segment-prefetch routes 0.9%
• CVE-2026-44582 Low 3.7 Next.js: Cache poisoning via collisions in React Server Component cache-busting 0.2%
• CVE-2026-44581 Medium 4.7 Next.js: Cross-site scripting in App Router applications using CSP nonces 0.2%
• CVE-2026-44580 Medium 6.1 Next.js: Cross-site scripting in beforeInteractive scripts with untrusted input 0.2%
• CVE-2026-44579 High 7.5 Next.js: Denial of Service via connection exhaustion in applications using Cache Components 0.7%
• CVE-2026-44578 High 8.6 Next.js: Server-side request forgery in applications using WebSocket upgrades 35.5%
• CVE-2026-44577 Medium 5.9 Next.js: Denial of Service in the Image Optimization API 0.7%
• CVE-2026-44576 Medium 5.4 Next.js: Cache poisoning in React Server Component responses 0.3%
• CVE-2026-44574 High 8.1 Next.js: Middleware / Proxy bypass through dynamic route parameter injection 0.6%
• CVE-2026-44575 High 7.5 Next.js: Middleware / Proxy bypass in App Router applications via segment-prefetch routes 1.6%
• CVE-2026-44573 High 7.5 Next.js: Middleware / Proxy bypass in Pages Router applications using i18n 0.8%
• CVE-2026-44572 Low 3.7 Next.js: Middleware / Proxy redirects can be cache-poisoned 0.3%
• CVE-2026-29057 Medium 6.3 Next.js: HTTP request smuggling in rewrites 0.5%
• CVE-2026-27980 Medium 6.9 Next.js: Unbounded next/image disk cache growth can exhaust storage 0.7%
• CVE-2026-27979 Medium 6.9 Next.js: Unbounded postponed resume buffering can lead to DoS 0.7%
• CVE-2026-27978 Medium 5.3 Next.js: null origin can bypass Server Actions CSRF checks 0.2%
• CVE-2026-27977 Low 2.3 Next.js: null origin can bypass dev HMR websocket CSRF checks 0.2%
• CVE-2025-57752 Medium 6.2 Next.js Affected by Cache Key Confusion for Image Optimization API Routes 0.3%
• CVE-2025-55173 Medium 4.3 Next.js Content Injection Vulnerability for Image Optimization 0.6%
• CVE-2025-57822 Medium 6.5 Next.js Improper Middleware Redirect Handling Leads to SSRF 2.6%
• CVE-2025-49826 High 7.5 Next.js DoS vulnerability via cache poisoning 1.1%
• CVE-2025-49005 Low 3.7 Next.js cache poisoning due to omission of Vary header 0.5%
• CVE-2025-48068 Low 2.3 Information exposure in Next.js dev server due to lack of origin verification 0.2%
• CVE-2025-32421 Low 3.7 Next.js Race Condition to Cache Poisoning 0.8%
• CVE-2025-30218 Low 1.7 Next.js may leak x-middleware-subrequest-id to external hosts 0.4%
• CVE-2025-29927 Critical 9.1 Authorization Bypass in Next.js Middleware 99.2%
• CVE-2024-56332 Medium 5.3 Next.js Vulnerable to Denial of Service (DoS) with Server Actions 0.8%
• CVE-2024-51479 High 7.5 Authorization bypass in Next.js 4.0%
• CVE-2024-47831 Medium 5.9 Next.js image optimization has Denial of Service condition 0.7%
• CVE-2024-46982 High 7.5 Cache Poisoning in next.js 59.2%
• CVE-2024-39693 High 7.5 Next.js Denial of Service (DoS) condition 0.5%
• CVE-2024-34351 High 7.5 Next.js Server-Side Request Forgery in Server Actions 5.5%