Skip to content
OpenAdvisories

Package · npm

next

77 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • Critical 9.0
    CVE-2026-75604 Public exploit

    Next.js: Unauthenticated Remote Code Execution on windows-hosted servers

    Next.js is a React framework for building full-stack web applications. From 13.4.0 until 15.5.24 and 16.3.3, Next.js applications using Pages Router or App Router without Cache Components on Windows-hosted servers do not consistently escape backslashes in rou…

    vercel next.js next npm
  • High 7.5
    CVE-2026-44579 Public exploit

    Next.js: Denial of Service via connection exhaustion in applications using Cache Components

    Next.js is a React framework for building full-stack web applications. From to before 15.5.16 and 16.2.5, applications using Partial Prerendering through the Cache Components feature can be vulnerable to connection exhaustion through crafted POST requests to …

    vercel next.js next npm
  • High 8.6
    CVE-2026-44578 Public exploit EPSS 36%

    Next.js: Server-side request forgery in applications using WebSocket upgrades

    Next.js is a React framework for building full-stack web applications. From 13.4.13 to before 15.5.16 and 16.2.5, self-hosted applications using the built-in Node.js server can be vulnerable to server-side request forgery through crafted WebSocket upgrade req…

    vercel next.js next npm
  • Medium 6.3
    CVE-2026-29057 Public exploit

    Next.js: HTTP request smuggling in rewrites

    Next.js is a React framework for building full-stack web applications. Starting in version 9.5.0 and prior to versions 15.5.13 and 16.1.7, when Next.js rewrites proxy traffic to an external backend, a crafted `DELETE`/`OPTIONS` request using `Transfer-Encodin…

    vercel next.js next npm
  • Medium 5.3
    CVE-2026-27978 Public exploit

    Next.js: null origin can bypass Server Actions CSRF checks

    Next.js is a React framework for building full-stack web applications. Starting in version 16.0.1 and prior to version 16.1.7, `origin: null` was treated as a "missing" origin during Server Action CSRF validation. As a result, requests from opaque contexts (s…

    vercel next.js next npm
  • Low 3.7
    CVE-2025-32421 Public exploit

    Next.js Race Condition to Cache Poisoning

    Next.js is a React framework for building full-stack web applications. Versions prior to 14.2.24 and 15.1.6 have a race-condition vulnerability. This issue only affects the Pages Router under certain misconfigurations, causing normal endpoints to serve `pageP…

    vercel next.js next npm
  • Critical 9.1
    CVE-2025-29927 Public exploit EPSS 99%

    Authorization Bypass in Next.js Middleware

    Next.js is a React framework for building full-stack web applications. Starting in version 1.11.4 and prior to versions 12.3.5, 13.5.9, 14.2.25, and 15.2.3, it is possible to bypass authorization checks within a Next.js application, if the authorization check…

    vercel next.js next npm
  • High 7.5
    CVE-2024-46982 Public exploit EPSS 59%

    Cache Poisoning in next.js

    Next.js is a React framework for building full-stack web applications. By sending a crafted HTTP request, it is possible to poison the cache of a non-dynamic server-side rendered route in the pages router (this does not affect the app router). When this craft…

    vercel next.js next npm
  • High 7.5
    CVE-2024-34351 Public exploit

    Next.js Server-Side Request Forgery in Server Actions

    Next.js is a React framework that can provide building blocks to create web applications. A Server-Side Request Forgery (SSRF) vulnerability was identified in Next.js Server Actions. If the `Host` header is modified, and the below conditions are also met, an …

    vercel next.js next npm