Skip to content
OpenAdvisories
Medium WID-SEC-2026-0748 5 CVEs

Vercel Next.js: Mehrere Schwachstellen

Published Mar 16, 2026 · Updated Jul 1, 2026 · Revision 4 · de-DE

Vendor: Red Hat Vendor: vercel Product: Enterprise Linux Product: next.js Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Vercel Next.js ausnutzen, um einen Denial of Service Angriff durchzuführen oder Sicherheitsmaßnahmen zu umgehen.

Product

Next.js ist ein Framework für React-basierte Web-Anwendungen.

Vulnerabilities 5

  • Medium 6.9
    CVE-2026-27979

    Next.js: Unbounded postponed resume buffering can lead to DoS

    Next.js is a React framework for building full-stack web applications. Starting in version 16.0.1 and prior to version 16.1.7, a request containing the `next-resume: 1` header (corresponding with a PPR resume request) would buffer request bodies without consi…

    vercel next.js next npm
  • Medium 6.9
    CVE-2026-27980

    Next.js: Unbounded next/image disk cache growth can exhaust storage

    Next.js is a React framework for building full-stack web applications. Starting in version 10.0.0 and prior to version 16.1.7, the default Next.js image optimization disk cache (`/_next/image`) did not have a configurable upper bound, allowing unbounded cache…

    vercel next.js langfuse-3 jitsucom-jitsu-console Wolfi npm
  • Medium 6.3
    CVE-2026-29057 Public exploit

    Next.js: HTTP request smuggling in rewrites

    Next.js is a React framework for building full-stack web applications. Starting in version 9.5.0 and prior to versions 15.5.13 and 16.1.7, when Next.js rewrites proxy traffic to an external backend, a crafted `DELETE`/`OPTIONS` request using `Transfer-Encodin…

    vercel next.js langfuse-3 jitsucom-jitsu-console Wolfi npm
  • Medium 5.3
    CVE-2026-27978 Public exploit

    Next.js: null origin can bypass Server Actions CSRF checks

    Next.js is a React framework for building full-stack web applications. Starting in version 16.0.1 and prior to version 16.1.7, `origin: null` was treated as a "missing" origin during Server Action CSRF validation. As a result, requests from opaque contexts (s…

    vercel next.js next npm
  • Low 2.3
    CVE-2026-27977

    Next.js: null origin can bypass dev HMR websocket CSRF checks

    Next.js is a React framework for building full-stack web applications. Starting in version 16.0.1 and prior to version 16.1.7, in `next dev`, cross-site protection for internal websocket endpoints could treat `Origin: null` as a bypass case even if `allowedDe…

    vercel next.js next npm

Revision history

  1. #4

    Neue Updates von Red Hat aufgenommen

  2. #3

    Neue Updates von Red Hat aufgenommen

  3. #2

    Referenz(en) aufgenommen: EUVD-2026-12684, EUVD-2026-12683, EUVD-2026-12704, EUVD-2026-12692, EUVD-2026-12694

  4. #1

    Initiale Fassung

References