Skip to content
OpenAdvisories

Product · vercel

next

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 5.3
    CVE-2026-94545 Public exploit

    Satori-generated SVG has improper escaping

    Satori is a library to convert HTML and CSS to SVG. Starting in version 0.0.27 and prior to version 0.33.5, Satori does not properly escape certain values before including them in generated SVG output. This can allow crafted values to be interpreted as SVG ma…

    vercel next satori satori npm
  • Medium 5.9
    CVE-2025-59472

    Next.js has Unbounded Memory Consumption via PPR Resume Endpoint

    A denial of service vulnerability exists in Next.js versions with Partial Prerendering (PPR) enabled when running in minimal mode. The PPR resume endpoint accepts unauthenticated POST requests with the `Next-Resume: 1` header and processes attacker-controlled…

    vercel next next npm
  • Medium 5.9
    CVE-2025-59471

    Next.js self-hosted applications vulnerable to DoS via Image Optimizer remotePatterns configuration

    A denial of service vulnerability exists in self-hosted Next.js applications that have `remotePatterns` configured for the Image Optimizer. The image optimization endpoint (`/_next/image`) loads external images entirely into memory without enforcing a maximum…

    vercel next next npm