vercel

Records84All Threatist records

Exploited (KEV)1In CISA KEV

CVSS critical4CVSS 9.0–10.0

CVSS high32CVSS 7.0–8.9

Exploited now

vercel records in CISA KEV

TI-2025-34861 Meta React Server Components Remote Code Execution Vulnerability CRITICAL 100KEV 2025-12-05

Components

Products in the NVD configurations · select one to filter the records

Next.js 63 records CRITICAL Ai 4 records HIGH Hyper 2 records HIGH Ms 2 records MEDIUM Turborepo 2 records LOW Vercel 2 records MEDIUM Pkg 1 record LOW Turborepo Language Server Protocol 1 record LOW

Records

63 records in Next.js · all components

TI-2025-34861 CVE-2025-55182 · GHSA-fv66-9v8q-g76r

Deserialization of untrusted data in Meta react-server-dom-webpack

CRITICAL 100KEV

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack…

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.99731 Published 2025-12-03 Fixed in 19.0.1, 19.1.2 +1 CWE-502

TI-2025-21309 CVE-2025-29927 · GHSA-f82v-jwr5-mffw

Authorization Bypass in Next.js Middleware

CRITICAL 92

Next.js is a React framework for building full-stack web applications.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.99225 Published 2025-03-21 Fixed in 12.3.5, 14.2.25 +2 CWE-285

TI-2025-34863 CVE-2025-55184 · GHSA-2m3v-v2m8-q956

Deserialization of untrusted data in Meta react-server-dom-webpack

HIGH 75

A pre-authentication denial of service vulnerability exists in React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following packages: react-server-dom-parcel, react-s…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.66615 Published 2025-12-11 Fixed in 19.0.2, 19.1.3 +1 CWE-502

TI-2024-31371 CVE-2024-46982 · GHSA-gp8f-8m3g-qvj9

Cache Poisoning in next.js

HIGH 73

Next.js is a React framework for building full-stack web applications.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.5918 Published 2024-09-17 Fixed in 13.5.7, 14.2.10 CWE-639

TI-2023-24914 CVE-2023-46298 · GHSA-c59h-r6p8-q9wc

Next.js before 13.4.20-canary.13 lacks a cache-control header and thus empty prefetch…

HIGH 72

Next.js before 13.4.20-canary.13 lacks a cache-control header and thus empty prefetch responses may sometimes be cached by a CDN, causing a denial of service to all users requesting the same URL via that CDN.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01608 Published 2023-10-22 Fixed in 13.4.20-canary.13

TI-2026-32490 CVE-2026-44578 · GHSA-c4j6-fc7j-m34r

Next.js: Server-side request forgery in applications using WebSocket upgrades

HIGH 69

Next.js is a React framework for building full-stack web applications.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.35539 Published 2026-05-13 Partial fix · 16.2.5, 15.5.16 CWE-918

TI-2025-34862 CVE-2025-55183 · GHSA-925w-6v3x-g4j4

Deserialization of untrusted data in Meta react-server-dom-webpack

HIGH 66

An information leak vulnerability exists in specific configurations of React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following packages: react-server-dom-parcel,…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.64233 Published 2025-12-11 Fixed in 19.0.2, 19.1.3 +1 CWE-497

TI-2021-19609 CVE-2021-43803 · GHSA-25mp-g6fv-mqxx

Unexpected server crash in Next.js

MEDIUM 63

Next.js is a React framework.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.47254 Published 2021-12-09 Fixed in 11.1.3, 12.0.5 CWE-20

TI-2025-41449 CVE-2025-67779 · GHSA-7gmr-mq3h-m5h9

Uncontrolled resource consumption in Meta react-server-dom-parcel

MEDIUM 57

It was found that the fix addressing CVE-2025-55184 in React Server Components was incomplete and does not prevent a denial of service attack in a specific case.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.19986 Published 2025-12-11 Fixed in 19.0.3, 19.1.4 +1 CWE-400

TI-2025-31133 CVE-2025-49005 · GHSA-r2fc-ccr8-96c4

Next.js cache poisoning due to omission of Vary header

MEDIUM 51

Next.js is a React framework for building full-stack web applications.

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.00491 Published 2025-07-03 Partial fix · 15.3.3 CWE-444

TI-2024-22691 CVE-2024-34351 · GHSA-fr5h-rqp8-mj6g

Next.js Server-Side Request Forgery in Server Actions

MEDIUM 47

Next.js is a React framework that can provide building blocks to create web applications.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.05453 Published 2024-05-09 Partial fix · 14.1.1 CWE-918

TI-2024-34400 CVE-2024-51479 · GHSA-7gfc-8cq8-jh5f

Authorization bypass in Next.js

MEDIUM 46

Next.js is a React framework for building full-stack web applications.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.03995 Published 2024-12-17 Partial fix · 14.2.15 CWE-285

TI-2026-46202 CVE-2026-64641 · GHSA-m99w-x7hq-7vfj

Next.js: Denial of Service in App Router using Server Actions

MEDIUM 43

Next.js is a React framework for building full-stack web applications.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00856 Published 2026-07-27 Partial fix · 15.5.21, 16.2.11 CWE-834

TI-2026-32487 CVE-2026-44575 · GHSA-267c-6grr-h53f

Next.js: Middleware / Proxy bypass in App Router applications via segment-prefetch routes

MEDIUM 42

Next.js is a React framework for building full-stack web applications.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01594 Published 2026-05-13 Partial fix · 16.2.5, 15.5.16 CWE-288

TI-2025-35705 CVE-2025-57822 · GHSA-4342-x723-ch2f

Next.js Improper Middleware Redirect Handling Leads to SSRF

MEDIUM 41

Next.js is a React framework for building full-stack web applications.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.02584 Published 2025-08-29 Fixed in 14.2.32, 15.4.7 CWE-918

TI-2025-31741 CVE-2025-49826 · GHSA-67rr-84xm-4c7r

Next.js DoS vulnerability via cache poisoning

MEDIUM 41

Next.js is a React framework for building full-stack web applications.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01133 Published 2025-07-03 Partial fix · 15.1.8 CWE-444

TI-2026-32946 CVE-2026-45109 · GHSA-26hh-7cqf-hhc6

Next.js: Middleware / Proxy bypass in App Router applications via segment-prefetch routes

MEDIUM 40

Next.js is a React framework for building full-stack web applications.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00854 Published 2026-05-13 Partial fix · 15.5.17, 16.2.6 +1 CWE-288

TI-2026-32491 CVE-2026-44579 · GHSA-mg66-mrh9-m8jx

Next.js: Denial of Service via connection exhaustion in applications using Cache Components

MEDIUM 40

Next.js is a React framework for building full-stack web applications.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00746 Published 2026-05-13 Partial fix · 16.2.5, 15.5.16 CWE-770

TI-2026-32485 CVE-2026-44573 · GHSA-36qx-fr4f-26g5

Next.js: Middleware / Proxy bypass in Pages Router applications using i18n

MEDIUM 40

Next.js is a React framework for building full-stack web applications.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00796 Published 2026-05-13 Partial fix · 15.5.16, 16.2.5 CWE-863

TI-2024-26616 CVE-2024-39693 · GHSA-fq54-2j52-jc42

Next.js Denial of Service (DoS) condition

LOW 39

Next.js is a React framework.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00494 Published 2024-07-10 Fixed in 13.5.0 CWE-400

TI-2026-32486 CVE-2026-44574 · GHSA-492v-c6pp-mqqv

Next.js: Middleware / Proxy bypass through dynamic route parameter injection

LOW 38

Next.js is a React framework for building full-stack web applications.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00636 Published 2026-05-13 Partial fix · 15.5.16, 16.2.5 CWE-288

TI-2026-22322 CVE-2026-27980 · GHSA-3x4c-7xq6-9pq8

Next.js: Unbounded next/image disk cache growth can exhaust storage

LOW 38

Next.js is a React framework for building full-stack web applications.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00725 Published 2026-03-18 Partial fix · 16.1.7, 15.5.14 CWE-400

TI-2026-22321 CVE-2026-27979 · GHSA-h27x-g6w4-24gq

Next.js: Unbounded postponed resume buffering can lead to DoS

LOW 38

Next.js is a React framework for building full-stack web applications.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00708 Published 2026-03-18 Partial fix · 16.1.7 CWE-770

TI-2026-46203 CVE-2026-64642 · GHSA-6gpp-xcg3-4w24

Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale

LOW 37

Next.js is a React framework for building full-stack web applications.

CVSS 4.0HIGH 8.3 Network No auth No interaction EPSS 0.00635 Published 2026-07-27 Partial fix · 16.2.11 CWE-285

TI-2022-06094 CVE-2022-21721 · GHSA-wr66-vrwm-5g5x

DOS Vulnerability in next.js

LOW 37

Next.js is a React framework.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02153 Published 2022-01-28 Fixed in 12.0.9 CWE-20

Open these records in search →

Critical	4
High	32
Medium	39
Low	8
No CVSS	1