What’s Vulnerable › Products

Next.js vulnerabilities

66 known vulnerabilities, 1 confirmed exploited in the wild (CISA KEV), 51 published in the last 12 months.

Check whether your Next.js version is affected

Exploited Next.js vulnerabilities

• CVE-2025-55182 — Meta React Server Components Remote Code Execution Vulnerability

Latest Next.js vulnerabilities

• CVE-2026-94482 — Next.js: Denial of Service in App Router using Server Actions (CVSS 8.2)
• CVE-2026-94544 — Next.js: Pending `use cache` fill can leak Draft Mode content into regular responses and persisted pages (CVSS 4.2)
• CVE-2026-94543 — Next.js: Cache poisoning of SSG and ISR pages in self-hosted Next.js applications (CVSS 5.3)
• CVE-2026-94486 — Next.js: Information disclosure in the Next.js development server's Model Context Protocol endpoint (CVSS 5.4)
• CVE-2026-94485 — Next.js: Information disclosure in Next.js App Router metadata image routes via dynamicParams bypass (CVSS 5.3)
• CVE-2026-94484 — Next.js: Cache poisoning in Next.js SSG/ISR rendering leads to cross-user content substitution and persistent denial of service (CVSS 4.8)
• CVE-2026-94483 — Next.js: Server-Side Request Forgery in Image Optimization (CVSS 6.5)
• CVE-2026-103004 — next.js cache leak on warm `use cache` handlers accessing root param (CVSS 5.3)
• CVE-2026-94545 — Satori-generated SVG has improper escaping (CVSS 5.3)
• CVE-2026-75604 — Next.js: Unauthenticated Remote Code Execution on windows-hosted servers (CVSS 9.0)
• CVE-2026-64649 — Next.js: Server-Side Request Forgery in Server Actions on Custom Servers (CVSS 6.5)
• CVE-2026-64648 — Next.js: Response Body Cache Confusion for Requests Containing Bodies (CVSS 5.4)
• CVE-2026-64647 — Next.js: Response Body Cache Confusion with Invalid UTF-8 Request Bodies (CVSS 5.4)
• CVE-2026-64646 — Next.js: Unbounded Server Action payload in Edge runtime (CVSS 5.3)
• CVE-2026-64645 — Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname (CVSS 6.1)
• CVE-2026-64644 — Next.js: Denial of Service in the Image Optimization API using SVGs (CVSS 5.3)
• CVE-2026-64643 — Next.js: Unauthenticated Disclosure of Internal Server Function endpoints (CVSS 5.3)
• CVE-2026-64642 — Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale (CVSS 8.2)
• CVE-2026-64641 — Next.js: Denial of Service in App Router using Server Actions (CVSS 7.5)
• CVE-2026-45109 — Next.js: Middleware / Proxy bypass in App Router applications via segment-prefetch routes (CVSS 7.5)
• CVE-2026-44582 — Next.js: Cache poisoning via collisions in React Server Component cache-busting (CVSS 3.7)
• CVE-2026-44581 — Next.js: Cross-site scripting in App Router applications using CSP nonces (CVSS 4.7)
• CVE-2026-44580 — Next.js: Cross-site scripting in beforeInteractive scripts with untrusted input (CVSS 6.1)
• CVE-2026-44579 — Next.js: Denial of Service via connection exhaustion in applications using Cache Components (CVSS 7.5)
• CVE-2026-44578 — Next.js: Server-side request forgery in applications using WebSocket upgrades (CVSS 8.6)