Skip to content
OpenAdvisories

Vendor

vercel

76 known vulnerabilities.

Products

next.js 57 ai 3 turborepo 3 next 3 pkg 1 hyper 1 flags 1 @ai-sdk/harness-codex 1 @ai-sdk/harness-opencode 1 ms 1 vercel 1 Nuxt Devtools 1 deepsec 1 satori 1 AI SDK 1
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 5.3
    CVE-2026-94545 Public exploit

    Satori-generated SVG has improper escaping

    Satori is a library to convert HTML and CSS to SVG. Starting in version 0.0.27 and prior to version 0.33.5, Satori does not properly escape certain values before including them in generated SVG output. This can allow crafted values to be interpreted as SVG ma…

    vercel next satori satori npm
  • Medium 6.3
    CVE-2026-29057 Public exploit

    Next.js: HTTP request smuggling in rewrites

    Next.js is a React framework for building full-stack web applications. Starting in version 9.5.0 and prior to versions 15.5.13 and 16.1.7, when Next.js rewrites proxy traffic to an external backend, a crafted `DELETE`/`OPTIONS` request using `Transfer-Encodin…

    vercel next.js next npm
  • Medium 5.3
    CVE-2026-27978 Public exploit

    Next.js: null origin can bypass Server Actions CSRF checks

    Next.js is a React framework for building full-stack web applications. Starting in version 16.0.1 and prior to version 16.1.7, `origin: null` was treated as a "missing" origin during Server Action CSRF validation. As a result, requests from opaque contexts (s…

    vercel next.js next npm