Skip to content
OpenAdvisories

Package · npm

next

77 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • High 7.5
    CVE-2026-44579 Public exploit

    Next.js: Denial of Service via connection exhaustion in applications using Cache Components

    Next.js is a React framework for building full-stack web applications. From to before 15.5.16 and 16.2.5, applications using Partial Prerendering through the Cache Components feature can be vulnerable to connection exhaustion through crafted POST requests to …

    vercel next.js next npm
  • High 8.6
    CVE-2026-44578 Public exploit EPSS 36%

    Next.js: Server-side request forgery in applications using WebSocket upgrades

    Next.js is a React framework for building full-stack web applications. From 13.4.13 to before 15.5.16 and 16.2.5, self-hosted applications using the built-in Node.js server can be vulnerable to server-side request forgery through crafted WebSocket upgrade req…

    vercel next.js next npm
  • High 7.5
    CVE-2024-46982 Public exploit EPSS 59%

    Cache Poisoning in next.js

    Next.js is a React framework for building full-stack web applications. By sending a crafted HTTP request, it is possible to poison the cache of a non-dynamic server-side rendered route in the pages router (this does not affect the app router). When this craft…

    vercel next.js next npm
  • High 7.5
    CVE-2024-34351 Public exploit

    Next.js Server-Side Request Forgery in Server Actions

    Next.js is a React framework that can provide building blocks to create web applications. A Server-Side Request Forgery (SSRF) vulnerability was identified in Next.js Server Actions. If the `Host` header is modified, and the below conditions are also met, an …

    vercel next.js next npm