vercel

Records84All Threatist records

Exploited (KEV)1In CISA KEV

CVSS critical4CVSS 9.0–10.0

CVSS high32CVSS 7.0–8.9

Exploited now

vercel records in CISA KEV

TI-2025-34861 Meta React Server Components Remote Code Execution Vulnerability CRITICAL 100KEV 2025-12-05

Components

Products in the NVD configurations · select one to filter the records

Next.js 63 records CRITICAL Ai 4 records HIGH Hyper 2 records HIGH Ms 2 records MEDIUM Turborepo 2 records LOW Vercel 2 records MEDIUM Pkg 1 record LOW Turborepo Language Server Protocol 1 record LOW

Records

84 records

TI-2025-34861 CVE-2025-55182 · GHSA-fv66-9v8q-g76r

Deserialization of untrusted data in Meta react-server-dom-webpack

CRITICAL 100KEV

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack…

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.99731 Published 2025-12-03 Fixed in 19.0.1, 19.1.2 +1 CWE-502

TI-2025-21309 CVE-2025-29927 · GHSA-f82v-jwr5-mffw

Authorization Bypass in Next.js Middleware

CRITICAL 92

Next.js is a React framework for building full-stack web applications.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.99225 Published 2025-03-21 Fixed in 12.3.5, 14.2.25 +2 CWE-285

TI-2024-15745 CVE-2024-23741 · GHSA-wpfm-839m-3pxg

An issue in Hyper on macOS version 3.4.1 and before, allows remote attackers to execute…

HIGH 82

An issue in Hyper on macOS version 3.4.1 and before, allows remote attackers to execute arbitrary code via the RunAsNode and enableNodeClilnspectArguments settings.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01574 Published 2024-01-28 No fix listed CWE-94

TI-2025-34863 CVE-2025-55184 · GHSA-2m3v-v2m8-q956

Deserialization of untrusted data in Meta react-server-dom-webpack

HIGH 75

A pre-authentication denial of service vulnerability exists in React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following packages: react-server-dom-parcel, react-s…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.66615 Published 2025-12-11 Fixed in 19.0.2, 19.1.3 +1 CWE-502

TI-2024-31371 CVE-2024-46982 · GHSA-gp8f-8m3g-qvj9

Cache Poisoning in next.js

HIGH 73

Next.js is a React framework for building full-stack web applications.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.5918 Published 2024-09-17 Fixed in 13.5.7, 14.2.10 CWE-639

TI-2023-24914 CVE-2023-46298 · GHSA-c59h-r6p8-q9wc

Next.js before 13.4.20-canary.13 lacks a cache-control header and thus empty prefetch…

HIGH 72

Next.js before 13.4.20-canary.13 lacks a cache-control header and thus empty prefetch responses may sometimes be cached by a CDN, causing a denial of service to all users requesting the same URL via that CDN.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01608 Published 2023-10-22 Fixed in 13.4.20-canary.13

TI-2026-07706 CVE-2026-8768 · GHSA-8rqj-9gxc-63cr

vercel ai provider-utils download-blob.ts validateDownloadUrl server-side request forgery

HIGH 70

A vulnerability was found in vercel ai up to 3.0.97.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00458 Published 2026-05-17 No fix listed CWE-918

TI-2026-32490 CVE-2026-44578 · GHSA-c4j6-fc7j-m34r

Next.js: Server-side request forgery in applications using WebSocket upgrades

HIGH 69

Next.js is a React framework for building full-stack web applications.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.35539 Published 2026-05-13 Partial fix · 16.2.5, 15.5.16 CWE-918

TI-2025-34862 CVE-2025-55183 · GHSA-925w-6v3x-g4j4

Deserialization of untrusted data in Meta react-server-dom-webpack

HIGH 66

An information leak vulnerability exists in specific configurations of React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following packages: react-server-dom-parcel,…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.64233 Published 2025-12-11 Fixed in 19.0.2, 19.1.3 +1 CWE-497

TI-2021-19609 CVE-2021-43803 · GHSA-25mp-g6fv-mqxx

Unexpected server crash in Next.js

MEDIUM 63

Next.js is a React framework.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.47254 Published 2021-12-09 Fixed in 11.1.3, 12.0.5 CWE-20

TI-2026-07707 CVE-2026-8769 · GHSA-866g-f22w-33x8

vercel ai provider-utils response-handler.ts createJsonErrorResponseHandler resource consumption

MEDIUM 57

A vulnerability was determined in vercel ai up to 3.0.97.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00561 Published 2026-05-17 Fixed in 3.0.28, 4.0.33 +1 CWE-400

TI-2025-41449 CVE-2025-67779 · GHSA-7gmr-mq3h-m5h9

Uncontrolled resource consumption in Meta react-server-dom-parcel

MEDIUM 57

It was found that the fix addressing CVE-2025-55184 in React Server Components was incomplete and does not prevent a denial of service attack in a specific case.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.19986 Published 2025-12-11 Fixed in 19.0.3, 19.1.4 +1 CWE-400

TI-2025-06436 CVE-2025-7074 · GHSA-2wxg-6mgc-2cm5

vercel hyper rimraf-standalone.js ignoreMap redos

MEDIUM 57

A vulnerability classified as problematic has been found in vercel hyper up to 3.4.1.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00679 Published 2025-07-05 No fix listed CWE-1333

TI-2025-31133 CVE-2025-49005 · GHSA-r2fc-ccr8-96c4

Next.js cache poisoning due to omission of Vary header

MEDIUM 51

Next.js is a React framework for building full-stack web applications.

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.00491 Published 2025-07-03 Partial fix · 15.3.3 CWE-444

TI-2015-06844 CVE-2015-8315 · GHSA-3fx5-fwvr-xrjg

The ms package before 0.7.1 for Node.js allows attackers to cause a denial of service…

MEDIUM 49

The ms package before 0.7.1 for Node.js allows attackers to cause a denial of service (CPU consumption) via a long version string, aka a "regular expression denial of service (ReDoS)."

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.06954 Published 2017-01-23 Fixed in 0.7.1 CWE-1333

TI-2024-22691 CVE-2024-34351 · GHSA-fr5h-rqp8-mj6g

Next.js Server-Side Request Forgery in Server Actions

MEDIUM 47

Next.js is a React framework that can provide building blocks to create web applications.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.05453 Published 2024-05-09 Partial fix · 14.1.1 CWE-918

TI-2024-34400 CVE-2024-51479 · GHSA-7gfc-8cq8-jh5f

Authorization bypass in Next.js

MEDIUM 46

Next.js is a React framework for building full-stack web applications.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.03995 Published 2024-12-17 Partial fix · 14.2.15 CWE-285

TI-2026-52910 CVE-2026-75604 · GHSA-p293-qw3h-jr36

Next.js: Unauthenticated Remote Code Execution on windows-hosted servers

MEDIUM 45

Next.js is a React framework for building full-stack web applications.

CVSS 3.1CRITICAL 9.0 Network No auth No interaction EPSS 0.02105 Published 2026-09-01 Fixed in 15.5.24, 16.3.3 CWE-22

TI-2026-07705 CVE-2026-8767 · GHSA-9pj2-3x6v-c3pp

vercel ai PR Branch Name Interpolation prettier-on-automerge.yml run os command injection

MEDIUM 45

A vulnerability has been found in vercel ai up to 3.0.97.

CVSS 4.0LOW 2.3 Network Low privileges No interaction EPSS 0.06966 Published 2026-05-17 No fix listed CWE-77

TI-2026-46202 CVE-2026-64641 · GHSA-m99w-x7hq-7vfj

Next.js: Denial of Service in App Router using Server Actions

MEDIUM 43

Next.js is a React framework for building full-stack web applications.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00856 Published 2026-07-27 Partial fix · 15.5.21, 16.2.11 CWE-834

TI-2026-79302 CVE-2026-94482 · GHSA-p3m5-59mp-jv5r

Denial of service in Next.js App Router using Server Actions

MEDIUM 42

Next.js is a React framework for building full-stack web applications.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00386 Published 2026-10-22 Partial fix · 15.5.28, 16.4.1 CWE-770

TI-2026-32487 CVE-2026-44575 · GHSA-267c-6grr-h53f

Next.js: Middleware / Proxy bypass in App Router applications via segment-prefetch routes

MEDIUM 42

Next.js is a React framework for building full-stack web applications.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01594 Published 2026-05-13 Partial fix · 16.2.5, 15.5.16 CWE-288

TI-2025-35705 CVE-2025-57822 · GHSA-4342-x723-ch2f

Next.js Improper Middleware Redirect Handling Leads to SSRF

MEDIUM 41

Next.js is a React framework for building full-stack web applications.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.02584 Published 2025-08-29 Fixed in 14.2.32, 15.4.7 CWE-918

TI-2025-31741 CVE-2025-49826 · GHSA-67rr-84xm-4c7r

Next.js DoS vulnerability via cache poisoning

MEDIUM 41

Next.js is a React framework for building full-stack web applications.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01133 Published 2025-07-03 Partial fix · 15.1.8 CWE-444

TI-2026-32946 CVE-2026-45109 · GHSA-26hh-7cqf-hhc6

Next.js: Middleware / Proxy bypass in App Router applications via segment-prefetch routes

MEDIUM 40

Next.js is a React framework for building full-stack web applications.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00854 Published 2026-05-13 Partial fix · 15.5.17, 16.2.6 +1 CWE-288

Open these records in search →

Critical	4
High	32
Medium	39
Low	8
No CVSS	1