Skip to content
OpenAdvisories
High WID-SEC-2026-1401 12 CVEs

Vercel Next.js: Mehrere Schwachstellen

Published May 6, 2026 · Updated Oct 12, 2026 · Revision 6 · de-DE

Vendor: Red Hat Vendor: vercel Product: Enterprise Linux Product: next.js Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Vercel Next.js ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Cross-Site-Scripting-Angriffe durchzuführen, Daten zu manipulieren, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand zu verursachen.

Product

Next.js ist ein Framework für React-basierte Web-Anwendungen.

Vulnerabilities 12

  • High 8.6
    CVE-2026-44578 Public exploit Scanner template EPSS 36%

    Next.js: Server-side request forgery in applications using WebSocket upgrades

    Next.js is a React framework for building full-stack web applications. From 13.4.13 to before 15.5.16 and 16.2.5, self-hosted applications using the built-in Node.js server can be vulnerable to server-side request forgery through crafted WebSocket upgrade req…

    vercel next.js next npm
  • High 8.1
    CVE-2026-44574

    Next.js: Middleware / Proxy bypass through dynamic route parameter injection

    Next.js is a React framework for building full-stack web applications. From 15.4.0 to before 15.5.16 and 16.2.5, applications that rely on middleware to protect dynamic routes can be vulnerable to authorization bypass. In affected deployments, specially craft…

    vercel next.js next npm
  • High 7.5
    CVE-2026-23870 Public exploit

    Facebook React has a Denial of Service Vulnerability in React Server Components

    A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to server crashes, out-of-memory exceptions or excessive CPU usage; affecting the following packages: react-server-do…

    Meta react-server-dom-parcel react-server-dom-turbopack react-server-dom-webpack npm
  • High 7.5
    CVE-2026-44573

    Next.js: Middleware / Proxy bypass in Pages Router applications using i18n

    Next.js is a React framework for building full-stack web applications. From 12.2.0 to before 15.5.16 and 16.2.5, Applications using the Pages Router with i18n configured and middleware/proxy-based authorization can allow unauthorized access to protected page …

    vercel next.js next npm
  • High 7.5
    CVE-2026-44575

    Next.js: Middleware / Proxy bypass in App Router applications via segment-prefetch routes

    Next.js is a React framework for building full-stack web applications. From 15.2.0 to before 15.5.16 and 16.2.5, App Router applications that rely on middleware or proxy-based checks for authorization can allow unauthorized access through transport-specific r…

    vercel next.js next npm
  • High 7.5
    CVE-2026-44579 Public exploit

    Next.js: Denial of Service via connection exhaustion in applications using Cache Components

    Next.js is a React framework for building full-stack web applications. From to before 15.5.16 and 16.2.5, applications using Partial Prerendering through the Cache Components feature can be vulnerable to connection exhaustion through crafted POST requests to …

    vercel next.js next npm
  • Medium 6.1
    CVE-2026-44580

    Next.js: Cross-site scripting in beforeInteractive scripts with untrusted input

    Next.js is a React framework for building full-stack web applications. From 13.0.0 to before 15.5.16 and 16.2.5, applications that use beforeInteractive scripts together with untrusted content can be vulnerable to cross-site scripting. In affected versions, s…

    vercel next.js next npm
  • Medium 5.9
    CVE-2026-44577

    Next.js: Denial of Service in the Image Optimization API

    Next.js is a React framework for building full-stack web applications. From 10.0.0 to before 15.5.16 and 16.2.5, when self-hosting Next.js with the default image loader, the Image Optimization API fetches local images entirely into memory without enforcing a …

    vercel next.js next npm
  • Medium 5.4
    CVE-2026-44576

    Next.js: Cache poisoning in React Server Component responses

    Next.js is a React framework for building full-stack web applications. From 14.2.0 to before 15.5.16 and 16.2.5, applications using React Server Components can be vulnerable to cache poisoning when shared caches do not correctly partition response variants. U…

    vercel next.js next npm
  • Medium 4.7
    CVE-2026-44581

    Next.js: Cross-site scripting in App Router applications using CSP nonces

    Next.js is a React framework for building full-stack web applications. From 13.4.0 to before 15.5.16 and 16.2.5, App Router applications that rely on CSP nonces can be vulnerable to stored cross-site scripting when deployed behind shared caches. In affected v…

    vercel next.js next npm
  • Low 3.7
    CVE-2026-44572

    Next.js: Middleware / Proxy redirects can be cache-poisoned

    Next.js is a React framework for building full-stack web applications. From 12.2.0 to before 15.5.16 and 16.2.5, an external client could send a x-nextjs-data header on a normal request to a path handled by middleware that returns a redirect. When that happen…

    vercel next.js next npm
  • Low 3.7
    CVE-2026-44582

    Next.js: Cache poisoning via collisions in React Server Component cache-busting

    Next.js is a React framework for building full-stack web applications. From 13.4.6 to before 15.5.16 and 16.2.5, React Server Component responses can be vulnerable to cache poisoning in deployments that rely on shared caches with insufficient response partiti…

    vercel next.js next npm

Revision history

  1. #6

    PoC aufgenommen CVE-2026-23870

  2. #5

    Neue Updates von Red Hat aufgenommen

  3. #4

    Neue Updates von Red Hat aufgenommen

  4. #3

    Neue Updates von Red Hat aufgenommen

  5. #2

    CVE aufgenommen

  6. #1

    Initiale Fassung

References