Skip to content
OpenAdvisories

Package · npm

next

77 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 6.3
    CVE-2026-29057 Public exploit

    Next.js: HTTP request smuggling in rewrites

    Next.js is a React framework for building full-stack web applications. Starting in version 9.5.0 and prior to versions 15.5.13 and 16.1.7, when Next.js rewrites proxy traffic to an external backend, a crafted `DELETE`/`OPTIONS` request using `Transfer-Encodin…

    vercel next.js next npm
  • Medium 5.3
    CVE-2026-27978 Public exploit

    Next.js: null origin can bypass Server Actions CSRF checks

    Next.js is a React framework for building full-stack web applications. Starting in version 16.0.1 and prior to version 16.1.7, `origin: null` was treated as a "missing" origin during Server Action CSRF validation. As a result, requests from opaque contexts (s…

    vercel next.js next npm