Skip to content
OpenAdvisories
High WID-SEC-2026-2468 9 CVEs

Vercel Next.js: Mehrere Schwachstellen

Published Jul 21, 2026 · Updated Oct 4, 2026 · Revision 4 · de-DE

Vendor: IBM Vendor: Red Hat Vendor: vercel Product: Enterprise Linux Product: next.js Product: QRadar SIEM Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Vercel Next.js ausnutzen, um Daten zu manipulieren, um Informationen offenzulegen, um einen Denial of Service Angriff durchzuführen, und um Sicherheitsvorkehrungen zu umgehen.

Product

Next.js ist ein Framework für React-basierte Web-Anwendungen.

Vulnerabilities 9

  • High 8.3
    CVE-2026-64642

    Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale

    Next.js is a React framework for building full-stack web applications. In versions 16.0.0 through 16.2.10, crafted requests targeting Next.js applications using App Router built with Turbopack and a single entry in config.i18n.locales can bypass middleware/pr…

    vercel next.js langfuse-3-worker langfuse-3 Wolfi npm
  • High 8.3
    CVE-2026-64645

    Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname

    Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a rewrites() or redirects() rule that builds its external destination hostname from request-controlled input can be pointed a…

    vercel next.js langfuse-3-worker langfuse-3 Wolfi npm
  • High 8.3
    CVE-2026-64649

    Next.js: Server-Side Request Forgery in Server Actions on Custom Servers

    Next.js is a React framework for building full-stack web applications. In versions 14.1.1 through 15.5.20 and 16.0.0 through 16.2.10, when a Server Action forwards or redirects a request, an attacker can cause the server to send that outbound request to a mal…

    vercel next.js langfuse-3-worker langfuse-3 Wolfi npm
  • High 8.2
    CVE-2026-64641

    Next.js: Denial of Service in App Router using Server Actions

    Next.js is a React framework for building full-stack web applications. In versions 13.0.0 through 15.5.20 and 16.0.0 through 16.2.10, crafted requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive CPU us…

    vercel next.js langfuse-3-worker langfuse-3 Wolfi npm
  • Medium 6.3
    CVE-2026-64643

    Next.js: Unauthenticated Disclosure of Internal Server Function endpoints

    Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, Next.js applications using App Router, Server Actions (use server) or use cache endpoints can be disclosed bypassing any auth…

    vercel next.js langfuse-3-worker langfuse-3 Wolfi npm
  • Medium 6.3
    CVE-2026-64644

    Next.js: Denial of Service in the Image Optimization API using SVGs

    Next.js is a React framework for building full-stack web applications. In versions 15.5.0 through 15.5.20 and 16.0.0 through 16.2.10, when self-hosting Next.js with the default image loader, the Image Optimization API can optimize remotely hosted images if co…

    vercel next.js langfuse-3-worker langfuse-3 Wolfi npm
  • Medium 6.3
    CVE-2026-64646

    Next.js: Unbounded Server Action payload in Edge runtime

    Next.js is a React framework for building full-stack web applications. In versions 13.0.0 through 15.5.20 and 16.0.0 through 16.2.10, requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive memory consump…

    vercel next.js langfuse-3-worker langfuse-3 Wolfi npm
  • Medium 6.3
    CVE-2026-64647

    Next.js: Response Body Cache Confusion with Invalid UTF-8 Request Bodies

    Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a server-side fetch with a request body may return a cached response body from a different request to the same URL but differ…

    vercel next.js langfuse-3-worker langfuse-3 Wolfi npm
  • Medium 6.0
    CVE-2026-64648

    Next.js: Response Body Cache Confusion for Requests Containing Bodies

    Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a server-side fetch with a request body may return a cached response body from a different request to the same URL but differ…

    vercel next.js langfuse-3-worker langfuse-3 Wolfi npm

Revision history

  1. #4

    Neue Updates von IBM aufgenommen

  2. #3

    Neue Updates von Red Hat aufgenommen

  3. #2

    Referenz(en) aufgenommen: EUVD-2026-49382, EUVD-2026-49378, EUVD-2026-49381, EUVD-2026-49388, EUVD-2026-49571, EUVD-2026-49404, EUVD-2026-49565, EUVD-2026-49383, EUVD-2026-49401

  4. #1

    Initiale Fassung

References