Skip to content
OpenAdvisories
Medium WID-SEC-2026-3699 7 CVEs

Vercel Next.js: Mehrere Schwachstellen

Published Sep 30, 2026 · Updated Oct 4, 2026 · Revision 3 · de-DE

Vendor: vercel Product: next.js Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Vercel Next.js ausnutzen, um vertrauliche Informationen offenzulegen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren oder Denial-of-Service-Zustände auszulösen.

Product

Next.js ist ein Framework für React-basierte Web-Anwendungen.

Vulnerabilities 7

  • High 8.3
    CVE-2026-94483

    Next.js: Server-Side Request Forgery in Image Optimization

    Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, Image Optimization can follow attacker-controlled DNS resolution for a remote URL that matches images.remotePatterns, allowing the optimized image fetch to reach …

    vercel next.js next npm
  • Medium 6.3
    CVE-2026-103004

    next.js cache leak on warm `use cache` handlers accessing root param

    Next.js versions from 16.3.0 to 16.3.7 warm `use cache` handlers using `next/root-params` and can leak their return value to pages with different root params. With Cache Components enabled (cacheComponents: true), a 'use cache' function that calls another 'us…

    vercel next.js next npm
  • Medium 6.3
    CVE-2026-94484

    Next.js: Cache poisoning in Next.js SSG/ISR rendering leads to cross-user content substitution and persistent denial of service

    Next.js is a React framework for building full-stack web applications. From 15.0.0 until 15.5.27 and 16.3.8, applications with a root-level catch-all page and statically generated or Incremental Static Regeneration routes can use a shared response cache key t…

    vercel next.js next npm
  • Medium 6.3
    CVE-2026-94485

    Next.js: Information disclosure in Next.js App Router metadata image routes via dynamicParams bypass

    Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, the `next dev` development server exposes a Model Context Protocol endpoint without reliably restricting cross-site requests. A malicious website visited by a dev…

    vercel next.js next npm
  • Medium 6.3
    CVE-2026-94543

    Next.js: Cache poisoning of SSG and ISR pages in self-hosted Next.js applications

    Next.js is a React framework for building full-stack web applications. From 15.0.0 until 15.5.27 and 16.3.8, self-hosted applications using the Pages Router with statically generated or Incremental Static Regeneration pages can key a response cache entry with…

    vercel next.js next npm
  • Medium 6.3
    CVE-2026-94544

    Next.js: Pending `use cache` fill can leak Draft Mode content into regular responses and persisted pages

    Next.js is a React framework for building full-stack web applications. From 16.3.0 until 16.3.8, pending use cache fills for the same key are shared without separating Draft Mode requests from regular requests. An overlapping regular request can receive unaut…

    vercel next.js next npm
  • Low 2.3
    CVE-2026-94486

    Next.js: Information disclosure in the Next.js development server's Model Context Protocol endpoint

    Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, the next dev development server exposes a Model Context Protocol endpoint without reliably restricting cross-site requests. A malicious website visited by a devel…

    vercel next.js next npm

Revision history

  1. #3

    Referenz(en) aufgenommen: EUVD-2026-91673, EUVD-2026-91674, EUVD-2026-91671, EUVD-2026-91670, EUVD-2026-91668, EUVD-2026-91667

  2. #2

    Referenz(en) aufgenommen: CVE-2026-103004, EUVD-2026-90872

  3. #1

    Initiale Fassung

References