next.js
vercel
- Product type
- Other
- Catalog vulnerabilities
- 57
Severity across 49 analyzed records
- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
Verify to analyze this security profile
As of 09/29/2026, within CyStack's analyzed data, next.js has 10 security vulnerabilities published in the last 90 days. Of these, 5 are rated High or Critical. None of these vulnerabilities is listed in the CISA KEV catalog. CyStack recommends that organizations and individual users remediate applicable vulnerabilities as soon as possible.
CyStack does not yet have sufficient official-source data to identify the latest version of next.js and determine which vulnerabilities affect that version.
| Vulnerability | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2026-75604Next.js: Unauthenticated Remote Code Execution on windows-hosted servers | Exploitation statusNot known exploited | FixYes | Published09/01/2026 | SeverityCritical |
CVE-2026-64649Next.js: Server-Side Request Forgery in Server Actions on Custom Servers | Exploitation statusNot known exploited | FixYes | Published07/27/2026 | SeverityHigh |
CVE-2026-64648Next.js: Response Body Cache Confusion for Requests Containing Bodies | Exploitation statusNot known exploited | FixYes | Published07/27/2026 | SeverityMedium |
CVE-2026-64647Next.js: Response Body Cache Confusion with Invalid UTF-8 Request Bodies | Exploitation statusNot known exploited | FixYes | Published07/27/2026 | SeverityMedium |
CVE-2026-64646Next.js: Unbounded Server Action payload in Edge runtime | Exploitation statusNot known exploited | FixYes | Published07/27/2026 | SeverityMedium |
CVE-2026-64644Next.js: Denial of Service in the Image Optimization API using SVGs | Exploitation statusNot known exploited | FixYes | Published07/27/2026 | SeverityMedium |
CVE-2026-64643Next.js: Unauthenticated Disclosure of Internal Server Function endpoints | Exploitation statusNot known exploited | FixYes | Published07/27/2026 | SeverityMedium |
CVE-2026-64642Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale | Exploitation statusNot known exploited | FixYes | Published07/27/2026 | SeverityHigh |
CVE-2026-64641Next.js: Denial of Service in App Router using Server Actions | Exploitation statusNot known exploited | FixYes | Published07/27/2026 | SeverityHigh |
CVE-2026-64645Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname | Exploitation statusNot known exploited | FixYes | Published07/27/2026 | SeverityHigh |
CVE-2026-45109Next.js: Middleware / Proxy bypass in App Router applications via segment-prefetch routes | Exploitation statusNot known exploited | FixYes | Published05/13/2026 | SeverityHigh |
CVE-2026-44582Next.js: Cache poisoning via collisions in React Server Component cache-busting | Exploitation statusNot known exploited | FixYes | Published05/13/2026 | SeverityLow |
CVE-2026-44581Next.js: Cross-site scripting in App Router applications using CSP nonces | Exploitation statusNot known exploited | FixYes | Published05/13/2026 | SeverityMedium |
CVE-2026-44580Next.js: Cross-site scripting in beforeInteractive scripts with untrusted input | Exploitation statusNot known exploited | FixYes | Published05/13/2026 | SeverityMedium |
CVE-2026-44579Next.js: Denial of Service via connection exhaustion in applications using Cache Components | Exploitation statusNot known exploited | FixYes | Published05/13/2026 | SeverityHigh |
CVE-2026-44578Next.js: Server-side request forgery in applications using WebSocket upgrades | Exploitation statusNot known exploited | FixYes | Published05/13/2026 | SeverityHigh |
CVE-2026-44577Next.js: Denial of Service in the Image Optimization API | Exploitation statusNot known exploited | FixYes | Published05/13/2026 | SeverityHigh |
CVE-2026-44576Next.js: Cache poisoning in React Server Component responses | Exploitation statusNot known exploited | FixYes | Published05/13/2026 | SeverityMedium |
CVE-2026-44574Next.js: Middleware / Proxy bypass through dynamic route parameter injection | Exploitation statusNot known exploited | FixYes | Published05/13/2026 | SeverityHigh |
CVE-2026-44575Next.js: Middleware / Proxy bypass in App Router applications via segment-prefetch routes | Exploitation statusNot known exploited | FixYes | Published05/13/2026 | SeverityHigh |
CVE-2026-44573Next.js: Middleware / Proxy bypass in Pages Router applications using i18n | Exploitation statusNot known exploited | FixYes | Published05/13/2026 | SeverityHigh |
CVE-2026-44572Next.js: Middleware / Proxy redirects can be cache-poisoned | Exploitation statusNot known exploited | FixYes | Published05/13/2026 | SeverityLow |
CVE-2026-29057Next.js: HTTP request smuggling in rewrites | Exploitation statusNot known exploited | FixYes | Published03/18/2026 | SeverityMedium |
CVE-2026-27980Next.js: Unbounded next/image disk cache growth can exhaust storage | Exploitation statusNot known exploited | FixYes | Published03/18/2026 | SeverityMedium |
CVE-2026-27979Next.js: Unbounded postponed resume buffering can lead to DoS | Exploitation statusNot known exploited | FixYes | Published03/18/2026 | SeverityMedium |
CVE-2026-27978Next.js: null origin can bypass Server Actions CSRF checks | Exploitation statusNot known exploited | FixYes | Published03/17/2026 | SeverityMedium |
CVE-2026-27977Next.js: null origin can bypass dev HMR websocket CSRF checks | Exploitation statusNot known exploited | FixYes | Published03/17/2026 | SeverityLow |
CVE-2025-59472 | Exploitation statusNot known exploited | FixYes | Published01/26/2026 | SeverityMedium |
CVE-2025-59471 | Exploitation statusNot known exploited | FixYes | Published01/26/2026 | SeverityMedium |
CVE-2025-67779 | Exploitation statusNot known exploited | FixYes | Published12/11/2025 | SeverityHigh |
CVE-2025-55184 | Exploitation statusPublic exploit | FixYes | Published12/11/2025 | SeverityHigh |
CVE-2025-55183 | Exploitation statusPublic exploit | FixYes | Published12/11/2025 | SeverityMedium |
CVE-2025-55182 | Exploitation statusKEV | FixYes | Published12/03/2025 | SeverityCritical |
CVE-2025-57752Next.js Affected by Cache Key Confusion for Image Optimization API Routes | Exploitation statusNot known exploited | FixYes | Published08/29/2025 | SeverityMedium |
CVE-2025-55173Next.js Content Injection Vulnerability for Image Optimization | Exploitation statusNot known exploited | FixYes | Published08/29/2025 | SeverityMedium |
CVE-2025-57822Next.js Improper Middleware Redirect Handling Leads to SSRF | Exploitation statusNot known exploited | FixYes | Published08/29/2025 | SeverityMedium |
CVE-2025-49826Next.js DoS vulnerability via cache poisoning | Exploitation statusNot known exploited | FixNot confirmed | Published07/03/2025 | SeverityHigh |
CVE-2025-49005Next.js cache poisoning due to omission of Vary header | Exploitation statusPublic exploit | FixYes | Published07/03/2025 | SeverityLow |
CVE-2025-48068Information exposure in Next.js dev server due to lack of origin verification | Exploitation statusNot known exploited | FixYes | Published05/30/2025 | SeverityLow |
CVE-2025-32421Next.js Race Condition to Cache Poisoning | Exploitation statusNot known exploited | FixYes | Published05/14/2025 | SeverityLow |
CVE-2025-30218Next.js may leak x-middleware-subrequest-id to external hosts | Exploitation statusNot known exploited | FixYes | Published04/02/2025 | SeverityLow |
CVE-2025-29927Authorization Bypass in Next.js Middleware | Exploitation statusNot known exploited | FixYes | Published03/21/2025 | SeverityCritical |
CVE-2024-56332Next.js Vulnerable to Denial of Service (DoS) with Server Actions | Exploitation statusNot known exploited | FixYes | Published01/03/2025 | SeverityMedium |
CVE-2024-51479Authorization bypass in Next.js | Exploitation statusNot known exploited | FixYes | Published12/17/2024 | SeverityHigh |
CVE-2024-47831Next.js image optimization has Denial of Service condition | Exploitation statusNot known exploited | FixYes | Published10/14/2024 | SeverityMedium |
CVE-2024-46982Cache Poisoning in next.js | Exploitation statusNot known exploited | FixYes | Published09/17/2024 | SeverityHigh |
CVE-2024-39693Next.js Denial of Service (DoS) condition | Exploitation statusNot known exploited | FixYes | Published07/10/2024 | SeverityHigh |
CVE-2024-34351Next.js Server-Side Request Forgery in Server Actions | Exploitation statusNot known exploited | FixYes | Published05/09/2024 | SeverityHigh |
CVE-2024-34350Next.js Vulnerable to HTTP Request Smuggling | Exploitation statusNot known exploited | FixYes | Published05/09/2024 | SeverityHigh |
CVE-2023-46298 | Exploitation statusPublic exploit | FixNot confirmed | Published10/22/2023 | SeverityUnknown |
CVE-2022-36046Unexpected server crash in Next.js version 12.2.3 | Exploitation statusNot known exploited | FixNot confirmed | Published08/31/2022 | SeverityMedium |
CVE-2022-23646Improper CSP in Image Optimization API for Next.js | Exploitation statusNot known exploited | FixNot confirmed | Published02/17/2022 | SeverityMedium |
CVE-2022-21721DOS Vulnerability in next.js | Exploitation statusNot known exploited | FixYes | Published01/28/2022 | SeverityMedium |
CVE-2021-43803Unexpected server crash in Next.js | Exploitation statusNot confirmed | FixNot confirmed | Published12/09/2021 | SeverityHigh |
CVE-2021-39178XSS in Image Optimization API for Next.js versions between 10.0.0 and 11.1.0 | Exploitation statusNot confirmed | FixYes | Published08/30/2021 | SeverityHigh |
CVE-2021-37699Open Redirect in Next.js versions below 11.1.0 | Exploitation statusNot confirmed | FixYes | Published08/11/2021 | SeverityMedium |
CVE-2020-15242Open Redirect in Next.js | Exploitation statusNot confirmed | FixYes | Published10/08/2020 | SeverityMedium |
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
Explore CyStack VulnScan
