Name: Vietnam CyStack Joint Stock Company
Address: Tan Hong Ha Complex, 317 Truong Chinh Street, Hanoi, Vietnam, 100000, VN
Telephone: (+84) 247 109 9656
Price range: Negotiable

Products & ServicesProducts & Services
SolutionsSolutions
PricingPricing
CompanyCompany
ResourcesResources

VulnScan

vercel Security Vulnerabilities | CyStack CVE Database

Vulnerability	Exploitation status	Fix	Affected product	Published	Severity

`CVE-2026-75604`Next.js: Unauthenticated Remote Code Execution on windows-hosted servers	Exploitation statusNot known exploited	FixYes	Affected productnext.js	Published09/01/2026	SeverityCritical
`CVE-2026-64649`Next.js: Server-Side Request Forgery in Server Actions on Custom Servers	Exploitation statusNot known exploited	FixYes	Affected productnext.js	Published07/27/2026	SeverityHigh
`CVE-2026-64648`Next.js: Response Body Cache Confusion for Requests Containing Bodies	Exploitation statusNot known exploited	FixYes	Affected productnext.js	Published07/27/2026	SeverityMedium
`CVE-2026-64647`Next.js: Response Body Cache Confusion with Invalid UTF-8 Request Bodies	Exploitation statusNot known exploited	FixYes	Affected productnext.js	Published07/27/2026	SeverityMedium
`CVE-2026-64646`Next.js: Unbounded Server Action payload in Edge runtime	Exploitation statusNot known exploited	FixYes	Affected productnext.js	Published07/27/2026	SeverityMedium
`CVE-2026-64644`Next.js: Denial of Service in the Image Optimization API using SVGs	Exploitation statusNot known exploited	FixYes	Affected productnext.js	Published07/27/2026	SeverityMedium
`CVE-2026-64643`Next.js: Unauthenticated Disclosure of Internal Server Function endpoints	Exploitation statusNot known exploited	FixYes	Affected productnext.js	Published07/27/2026	SeverityMedium
`CVE-2026-64642`Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale	Exploitation statusNot known exploited	FixYes	Affected productnext.js	Published07/27/2026	SeverityHigh
`CVE-2026-64641`Next.js: Denial of Service in App Router using Server Actions	Exploitation statusNot known exploited	FixYes	Affected productnext.js	Published07/27/2026	SeverityHigh
`CVE-2026-64645`Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname	Exploitation statusNot known exploited	FixYes	Affected productnext.js	Published07/27/2026	SeverityHigh
`CVE-2026-64650`AI SDK Codex Harness Tool Relay Authorization Bypass	Exploitation statusNot known exploited	FixNot confirmed	Affected product@ai-sdk/harness-codex	Published07/20/2026	SeverityMedium
`CVE-2026-64651`AI SDK OpenCode Harness Tool Relay Authorization Bypass	Exploitation statusNot known exploited	FixNot confirmed	Affected product@ai-sdk/harness-opencode	Published07/20/2026	SeverityMedium
`CVE-2026-8769`vercel ai provider-utils response-handler.ts createJsonErrorResponseHandler resource consumption	Exploitation statusPublic exploit	FixNot confirmed	Affected productai	Published05/17/2026	SeverityMedium
`CVE-2026-8768`vercel ai provider-utils download-blob.ts validateDownloadUrl server-side request forgery	Exploitation statusPublic exploit	FixNot confirmed	Affected productai	Published05/17/2026	SeverityMedium
`CVE-2026-8767`vercel ai PR Branch Name Interpolation prettier-on-automerge.yml run os command injection	Exploitation statusPublic exploit	FixNot confirmed	Affected productai	Published05/17/2026	SeverityLow
`CVE-2026-45773`Turborepo: Login callback CSRF/session fixation	Exploitation statusNot known exploited	FixYes	Affected productturborepo	Published05/15/2026	SeverityMedium
`CVE-2026-46508`Turborepo: VSCode Extension command injection	Exploitation statusNot known exploited	FixYes	Affected productturborepo	Published05/15/2026	SeverityHigh
`CVE-2026-45772`Turborepo: Unexpected local code execution during Yarn Berry detection	Exploitation statusNot known exploited	FixYes	Affected productturborepo	Published05/15/2026	SeverityInformational
`CVE-2026-45109`Next.js: Middleware / Proxy bypass in App Router applications via segment-prefetch routes	Exploitation statusNot known exploited	FixYes	Affected productnext.js	Published05/13/2026	SeverityHigh
`CVE-2026-44582`Next.js: Cache poisoning via collisions in React Server Component cache-busting	Exploitation statusNot known exploited	FixYes	Affected productnext.js	Published05/13/2026	SeverityLow
`CVE-2026-44581`Next.js: Cross-site scripting in App Router applications using CSP nonces	Exploitation statusNot known exploited	FixYes	Affected productnext.js	Published05/13/2026	SeverityMedium
`CVE-2026-44580`Next.js: Cross-site scripting in beforeInteractive scripts with untrusted input	Exploitation statusNot known exploited	FixYes	Affected productnext.js	Published05/13/2026	SeverityMedium
`CVE-2026-44579`Next.js: Denial of Service via connection exhaustion in applications using Cache Components	Exploitation statusNot known exploited	FixYes	Affected productnext.js	Published05/13/2026	SeverityHigh
`CVE-2026-44578`Next.js: Server-side request forgery in applications using WebSocket upgrades	Exploitation statusNot known exploited	FixYes	Affected productnext.js	Published05/13/2026	SeverityHigh
`CVE-2026-44577`Next.js: Denial of Service in the Image Optimization API	Exploitation statusNot known exploited	FixYes	Affected productnext.js	Published05/13/2026	SeverityHigh
`CVE-2026-44576`Next.js: Cache poisoning in React Server Component responses	Exploitation statusNot known exploited	FixYes	Affected productnext.js	Published05/13/2026	SeverityMedium
`CVE-2026-44574`Next.js: Middleware / Proxy bypass through dynamic route parameter injection	Exploitation statusNot known exploited	FixYes	Affected productnext.js	Published05/13/2026	SeverityHigh
`CVE-2026-44575`Next.js: Middleware / Proxy bypass in App Router applications via segment-prefetch routes	Exploitation statusNot known exploited	FixYes	Affected productnext.js	Published05/13/2026	SeverityHigh
`CVE-2026-44573`Next.js: Middleware / Proxy bypass in Pages Router applications using i18n	Exploitation statusNot known exploited	FixYes	Affected productnext.js	Published05/13/2026	SeverityHigh
`CVE-2026-44572`Next.js: Middleware / Proxy redirects can be cache-poisoned	Exploitation statusNot known exploited	FixYes	Affected productnext.js	Published05/13/2026	SeverityLow
`CVE-2026-44479`Vercel: Non-interactive mode includes CLI arguments in suggested command output	Exploitation statusNot known exploited	FixYes	Affected productvercel	Published05/13/2026	SeverityMedium
`CVE-2026-29057`Next.js: HTTP request smuggling in rewrites	Exploitation statusNot known exploited	FixYes	Affected productnext.js	Published03/18/2026	SeverityMedium
`CVE-2026-27980`Next.js: Unbounded next/image disk cache growth can exhaust storage	Exploitation statusNot known exploited	FixYes	Affected productnext.js	Published03/18/2026	SeverityMedium
`CVE-2026-27979`Next.js: Unbounded postponed resume buffering can lead to DoS	Exploitation statusNot known exploited	FixYes	Affected productnext.js	Published03/18/2026	SeverityMedium
`CVE-2026-27978`Next.js: null origin can bypass Server Actions CSRF checks	Exploitation statusNot known exploited	FixYes	Affected productnext.js	Published03/17/2026	SeverityMedium
`CVE-2026-27977`Next.js: null origin can bypass dev HMR websocket CSRF checks	Exploitation statusNot known exploited	FixYes	Affected productnext.js	Published03/17/2026	SeverityLow
`CVE-2025-59472`	Exploitation statusNot known exploited	FixYes	Affected productnext	Published01/26/2026	SeverityMedium
`CVE-2025-59471`	Exploitation statusNot known exploited	FixYes	Affected productnext	Published01/26/2026	SeverityMedium
`CVE-2025-67779`	Exploitation statusNot known exploited	FixYes	Affected productreact-server-dom-parcel	Published12/11/2025	SeverityHigh
`CVE-2025-55184`	Exploitation statusPublic exploit	FixYes	Affected productreact-server-dom-webpack	Published12/11/2025	SeverityHigh
`CVE-2025-55183`	Exploitation statusPublic exploit	FixYes	Affected productreact-server-dom-webpack	Published12/11/2025	SeverityMedium
`CVE-2025-55182`	Exploitation statusKEV	FixYes	Affected productreact-server-dom-webpack	Published12/03/2025	SeverityCritical
`CVE-2025-48985`	Exploitation statusNot known exploited	FixYes	Affected productAI SDK	Published11/07/2025	SeverityLow
`CVE-2025-52662`	Exploitation statusNot known exploited	FixYes	Affected productNuxt Devtools	Published11/07/2025	SeverityMedium
`CVE-2025-57752`Next.js Affected by Cache Key Confusion for Image Optimization API Routes	Exploitation statusNot known exploited	FixYes	Affected productnext.js	Published08/29/2025	SeverityMedium
`CVE-2025-55173`Next.js Content Injection Vulnerability for Image Optimization	Exploitation statusNot known exploited	FixYes	Affected productnext.js	Published08/29/2025	SeverityMedium
`CVE-2025-57822`Next.js Improper Middleware Redirect Handling Leads to SSRF	Exploitation statusNot known exploited	FixYes	Affected productnext.js	Published08/29/2025	SeverityMedium
`CVE-2025-7074`vercel hyper rimraf-standalone.js ignoreMap redos	Exploitation statusPublic exploit	FixNot confirmed	Affected producthyper	Published07/05/2025	SeverityMedium
`CVE-2025-49826`Next.js DoS vulnerability via cache poisoning	Exploitation statusNot known exploited	FixNot confirmed	Affected productnext.js	Published07/03/2025	SeverityHigh
`CVE-2025-49005`Next.js cache poisoning due to omission of Vary header	Exploitation statusPublic exploit	FixYes	Affected productnext.js	Published07/03/2025	SeverityLow
`CVE-2025-48068`Information exposure in Next.js dev server due to lack of origin verification	Exploitation statusNot known exploited	FixYes	Affected productnext.js	Published05/30/2025	SeverityLow
`CVE-2025-32421`Next.js Race Condition to Cache Poisoning	Exploitation statusNot known exploited	FixYes	Affected productnext.js	Published05/14/2025	SeverityLow
`CVE-2025-46332`Information Disclosure via Flags override link	Exploitation statusNot known exploited	FixYes	Affected productflags	Published05/02/2025	SeverityMedium
`CVE-2025-30218`Next.js may leak x-middleware-subrequest-id to external hosts	Exploitation statusNot known exploited	FixYes	Affected productnext.js	Published04/02/2025	SeverityLow
`CVE-2025-29927`Authorization Bypass in Next.js Middleware	Exploitation statusNot known exploited	FixYes	Affected productnext.js	Published03/21/2025	SeverityCritical
`CVE-2024-56332`Next.js Vulnerable to Denial of Service (DoS) with Server Actions	Exploitation statusNot known exploited	FixYes	Affected productnext.js	Published01/03/2025	SeverityMedium
`CVE-2024-51479`Authorization bypass in Next.js	Exploitation statusNot known exploited	FixYes	Affected productnext.js	Published12/17/2024	SeverityHigh
`CVE-2024-47831`Next.js image optimization has Denial of Service condition	Exploitation statusNot known exploited	FixYes	Affected productnext.js	Published10/14/2024	SeverityMedium
`CVE-2024-46982`Cache Poisoning in next.js	Exploitation statusNot known exploited	FixYes	Affected productnext.js	Published09/17/2024	SeverityHigh
`CVE-2024-39693`Next.js Denial of Service (DoS) condition	Exploitation statusNot known exploited	FixYes	Affected productnext.js	Published07/10/2024	SeverityHigh
`CVE-2024-34351`Next.js Server-Side Request Forgery in Server Actions	Exploitation statusNot known exploited	FixYes	Affected productnext.js	Published05/09/2024	SeverityHigh
`CVE-2024-34350`Next.js Vulnerable to HTTP Request Smuggling	Exploitation statusNot known exploited	FixYes	Affected productnext.js	Published05/09/2024	SeverityHigh
`CVE-2024-24828`Local Privilege Escalation in execuatables bundled by pkg	Exploitation statusNot known exploited	FixNot confirmed	Affected productpkg	Published02/09/2024	SeverityMedium
`CVE-2024-23741`	Exploitation statusPublic exploit	FixNot confirmed	Affected productNot confirmed	Published01/28/2024	SeverityCritical
`CVE-2023-46298`	Exploitation statusPublic exploit	FixNot confirmed	Affected productNot confirmed	Published10/22/2023	SeverityUnknown
`CVE-2017-20162`vercel ms index.js parse redos	Exploitation statusPublic exploit	FixYes	Affected productms	Published01/05/2023	SeverityMedium
`CVE-2022-36046`Unexpected server crash in Next.js version 12.2.3	Exploitation statusNot known exploited	FixNot confirmed	Affected productnext.js	Published08/31/2022	SeverityMedium
`CVE-2022-23646`Improper CSP in Image Optimization API for Next.js	Exploitation statusNot known exploited	FixNot confirmed	Affected productnext.js	Published02/17/2022	SeverityMedium
`CVE-2022-21721`DOS Vulnerability in next.js	Exploitation statusNot known exploited	FixYes	Affected productNot confirmed	Published01/28/2022	SeverityMedium
`CVE-2021-43803`Unexpected server crash in Next.js	Exploitation statusNot confirmed	FixNot confirmed	Affected productnext.js	Published12/09/2021	SeverityHigh
`CVE-2021-39178`XSS in Image Optimization API for Next.js versions between 10.0.0 and 11.1.0	Exploitation statusNot confirmed	FixYes	Affected productnext.js	Published08/30/2021	SeverityHigh
`CVE-2021-37699`Open Redirect in Next.js versions below 11.1.0	Exploitation statusNot confirmed	FixYes	Affected productnext.js	Published08/11/2021	SeverityMedium
`CVE-2020-15242`Open Redirect in Next.js	Exploitation statusNot confirmed	FixYes	Affected productnext.js	Published10/08/2020	SeverityMedium
`CVE-2015-8315`	Exploitation statusNot known exploited	FixNot confirmed	Affected productNot confirmed	Published01/23/2017	SeverityHigh