Skip to content
OpenAdvisories
Medium WID-SEC-2026-0219 3 CVEs

Vercel Next.js: Mehrere Schwachstellen ermöglichen Denial of Service

Published Jan 26, 2026 · Updated Jul 1, 2026 · Revision 4 · de-DE

Vendor: Red Hat Vendor: vercel Product: Enterprise Linux Product: next.js Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Vercel Next.js ausnutzen, um einen Denial of Service Angriff durchzuführen.

Product

Next.js ist ein Framework für React-basierte Web-Anwendungen.

Vulnerabilities 3

  • High 7.5
    CVE-2026-23864

    React Server Components have multiple Denial of Service Vulnerabilities

    Multiple denial of service vulnerabilities exist in React Server Components, affecting the following packages: react-server-dom-parcel, react-server-dom-turbopack, react-server-dom-webpack. The vulnerabilities are triggered by sending specially crafted HTTP r…

    Meta react-server-dom-parcel react-server-dom-turbopack react-server-dom-webpack npm
  • Medium 5.9
    CVE-2025-59471

    Next.js self-hosted applications vulnerable to DoS via Image Optimizer remotePatterns configuration

    A denial of service vulnerability exists in self-hosted Next.js applications that have `remotePatterns` configured for the Image Optimizer. The image optimization endpoint (`/_next/image`) loads external images entirely into memory without enforcing a maximum…

    vercel next langfuse-3 next Wolfi npm
  • Medium 5.9
    CVE-2025-59472

    Next.js has Unbounded Memory Consumption via PPR Resume Endpoint

    A denial of service vulnerability exists in Next.js versions with Partial Prerendering (PPR) enabled when running in minimal mode. The PPR resume endpoint accepts unauthenticated POST requests with the `Next-Resume: 1` header and processes attacker-controlled…

    vercel next langfuse-3 jitsucom-jitsu-console Wolfi npm

Revision history

  1. #4

    Neue Updates von Red Hat aufgenommen

  2. #3

    Neue Updates von Red Hat aufgenommen

  3. #2

    Referenz(en) aufgenommen: EUVD-2025-206334, EUVD-2025-206333

  4. #1

    Initiale Fassung

References