vercel next.js

25 known vulnerabilities in vercel next.js, 1 critical, with patch priority, exploit likelihood and the news covering them.

Latest vulnerabilities

  • CVE-2026-94544 CVSS 6.3 medium Next.js is a React framework for building full-stack web applications. From 16.3.0 until 16.3.8, pending use cache fills for the same key…
  • CVE-2026-94543 CVSS 6.3 medium Next.js is a React framework for building full-stack web applications. From 15.0.0 until 15.5.27 and 16.3.8, self-hosted applications…
  • CVE-2026-94486 CVSS 2.3 low Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, the next dev development server exposes a…
  • CVE-2026-94485 CVSS 6.3 medium Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, the `next dev` development server exposes…
  • CVE-2026-94484 CVSS 6.3 medium Next.js is a React framework for building full-stack web applications. From 15.0.0 until 15.5.27 and 16.3.8, applications with a…
  • CVE-2026-94483 CVSS 8.3 high Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, Image Optimization can follow…
  • CVE-2026-103004 CVSS 6.3 medium Next.js versions from 16.3.0 to 16.3.7 warm `use cache` handlers using `next/root-params` and can leak their return value to pages with…
  • CVE-2026-75604 CVSS 9.0 critical Next.js is a React framework for building full-stack web applications. From 13.4.0 until 15.5.24 and 16.3.3, Next.js applications using…
  • CVE-2026-64649 CVSS 8.3 high Next.js is a React framework for building full-stack web applications. In versions 14.1.1 through 15.5.20 and 16.0.0 through 16.2.10, when…
  • CVE-2026-64648 CVSS 6.0 medium Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a…
  • CVE-2026-64647 CVSS 6.3 medium Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a…
  • CVE-2026-64646 CVSS 6.3 medium Next.js is a React framework for building full-stack web applications. In versions 13.0.0 through 15.5.20 and 16.0.0 through 16.2.10…
  • CVE-2026-64645 CVSS 8.3 high Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a…
  • CVE-2026-64643 CVSS 6.3 medium Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10…
  • CVE-2026-64641 CVSS 8.2 high Next.js is a React framework for building full-stack web applications. In versions 13.0.0 through 15.5.20 and 16.0.0 through 16.2.10…
  • CVE-2026-44582 CVSS 3.7 low Next.js is a React framework for building full-stack web applications. From 13.4.6 to before 15.5.16 and 16.2.5, React Server Component…
  • CVE-2026-44581 CVSS 4.7 medium Next.js is a React framework for building full-stack web applications. From 13.4.0 to before 15.5.16 and 16.2.5, App Router applications…
  • CVE-2026-44580 CVSS 6.1 medium Next.js is a React framework for building full-stack web applications. From 13.0.0 to before 15.5.16 and 16.2.5, applications that use…
  • CVE-2026-44578 CVSS 8.6 high Next.js is a React framework for building full-stack web applications. From 13.4.13 to before 15.5.16 and 16.2.5, self-hosted applications…
  • CVE-2026-44577 CVSS 5.9 medium Next.js is a React framework for building full-stack web applications. From 10.0.0 to before 15.5.16 and 16.2.5, when self-hosting Next.js…
  • CVE-2026-44576 CVSS 5.4 medium Next.js is a React framework for building full-stack web applications. From 14.2.0 to before 15.5.16 and 16.2.5, applications using React…
  • CVE-2026-44573 CVSS 7.5 high Next.js is a React framework for building full-stack web applications. From 12.2.0 to before 15.5.16 and 16.2.5, Applications using the…
  • CVE-2026-44572 CVSS 5.9 medium Next.js is a React framework for building full-stack web applications. From 12.2.0 to before 15.5.16 and 16.2.5, an external client could…
  • CVE-2026-29057 CVSS 6.3 medium Next.js is a React framework for building full-stack web applications. Starting in version 9.5.0 and prior to versions 15.5.13 and 16.1.7…
  • CVE-2026-27980 CVSS 6.9 medium Next.js is a React framework for building full-stack web applications. Starting in version 10.0.0 and prior to version 16.1.7, the default…