Vulnerabilities

TI-2026-65938 CVE-2026-94484 · GHSA-mcj8-r9mp-w47p

Next.js: Cache poisoning in Next.js SSG/ISR rendering leads to cross-user content…

LOW 28

Next.js is a React framework for building full-stack web applications.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00244 Published 2026-10-02 Partial fix · 15.5.27, 16.3.8 CWE-524

TI-2026-65939 CVE-2026-94485 · GHSA-f87g-xv8r-7p7x

Next.js: Information disclosure in Next.js App Router metadata image routes via dynamicParams bypass

LOW 27

Next.js is a React framework for building full-stack web applications.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00173 Published 2026-10-02 Partial fix · 16.3.8 CWE-346

TI-2026-65937 CVE-2026-94483 · GHSA-cjq9-62q9-8jv4

Next.js: Server-Side Request Forgery in Image Optimization

LOW 36

Next.js is a React framework for building full-stack web applications.

CVSS 4.0HIGH 8.3 Network No auth No interaction EPSS 0.0033 Published 2026-10-02 Partial fix · 16.3.8 CWE-918

TI-2026-65942 CVE-2026-94543 · GHSA-4jqv-mc3x-m676

Next.js: Cache poisoning of SSG and ISR pages in self-hosted Next.js applications

LOW 35

Next.js is a React framework for building full-stack web applications.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00506 Published 2026-10-02 Partial fix · 15.5.27, 16.3.8 CWE-524

TI-2026-65943 CVE-2026-94544 · GHSA-3w37-wq28-93x7

Next.js: Pending `use cache` fill can leak Draft Mode content into regular responses and persisted pages

LOW 27

Next.js is a React framework for building full-stack web applications.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00179 Published 2026-10-02 Partial fix · 16.3.8 CWE-524

TI-2026-65940 CVE-2026-94486 · GHSA-39w2-rjm5-chcv

Next.js: Information disclosure in the Next.js development server's Model Context Protocol endpoint

LOW 11

Next.js is a React framework for building full-stack web applications.

CVSS 4.0LOW 2.3 Network No auth User interaction EPSS 0.00114 Published 2026-10-02 Partial fix · 16.3.8 CWE-346

TI-2026-65559 CVE-2026-103004 · GHSA-h694-7cp9-m8p3

next.js cache leak on warm `use cache` handlers accessing root param

LOW 34

Next.js versions from 16.3.0 to 16.3.7 warm `use cache` handlers using `next/root-params` and can leak their return value to pages with different root params.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.0025 Published 2026-10-01 Partial fix · 16.3.8 CWE-524

TI-2026-46210 CVE-2026-64649 · GHSA-89xv-2m56-2m9x

Next.js: Server-Side Request Forgery in Server Actions on Custom Servers

LOW 36

Next.js is a React framework for building full-stack web applications.

CVSS 4.0HIGH 8.3 Network No auth No interaction EPSS 0.00459 Published 2026-07-27 Partial fix · 15.5.21, 16.2.11 CWE-918

TI-2026-46209 CVE-2026-64648 · GHSA-68g3-v927-f742

Next.js: Response Body Cache Confusion for Requests Containing Bodies

LOW 27

Next.js is a React framework for building full-stack web applications.

CVSS 4.0MEDIUM 6.0 Network No auth User interaction EPSS 0.00338 Published 2026-07-27 Partial fix · 15.5.21, 16.2.11 CWE-524

TI-2026-46208 CVE-2026-64647 · GHSA-4633-3j49-mh5q

Next.js: Response Body Cache Confusion with Invalid UTF-8 Request Bodies

LOW 28

Next.js is a React framework for building full-stack web applications.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00317 Published 2026-07-27 Partial fix · 15.5.21, 16.2.11 CWE-116

TI-2026-46207 CVE-2026-64646 · GHSA-4c39-4ccg-62r3

Next.js: Unbounded Server Action payload in Edge runtime

LOW 29

Next.js is a React framework for building full-stack web applications.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00524 Published 2026-07-27 Partial fix · 16.2.11, 15.5.21 CWE-770

TI-2026-46205 CVE-2026-64644 · GHSA-q8wf-6r8g-63ch

Next.js: Denial of Service in the Image Optimization API using SVGs

LOW 29

Next.js is a React framework for building full-stack web applications.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00666 Published 2026-07-27 Fixed in 15.5.21, 16.2.11 CWE-407

TI-2026-46204 CVE-2026-64643 · GHSA-955p-x3mx-jcvp

Next.js: Unauthenticated Disclosure of Internal Server Function endpoints

LOW 35

Next.js is a React framework for building full-stack web applications.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.0051 Published 2026-07-27 Partial fix · 15.5.21, 16.2.11 CWE-201

TI-2026-46203 CVE-2026-64642 · GHSA-6gpp-xcg3-4w24

Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale

LOW 37

Next.js is a React framework for building full-stack web applications.

CVSS 4.0HIGH 8.3 Network No auth No interaction EPSS 0.00635 Published 2026-07-27 Partial fix · 16.2.11 CWE-285

TI-2026-46202 CVE-2026-64641 · GHSA-m99w-x7hq-7vfj

Next.js: Denial of Service in App Router using Server Actions

MEDIUM 43

Next.js is a React framework for building full-stack web applications.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00856 Published 2026-07-27 Partial fix · 15.5.21, 16.2.11 CWE-834

TI-2026-46206 CVE-2026-64645 · GHSA-p9j2-gv94-2wf4

Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname

LOW 36

Next.js is a React framework for building full-stack web applications.

CVSS 4.0HIGH 8.3 Network No auth No interaction EPSS 0.00414 Published 2026-07-27 Partial fix · 16.2.11, 15.5.21 CWE-601

TI-2026-32946 CVE-2026-45109 · GHSA-26hh-7cqf-hhc6

Next.js: Middleware / Proxy bypass in App Router applications via segment-prefetch routes

MEDIUM 40

Next.js is a React framework for building full-stack web applications.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00854 Published 2026-05-13 Partial fix · 15.5.17, 16.2.6 +1 CWE-288

TI-2026-32494 CVE-2026-44582 · GHSA-vfv6-92ff-j949

Next.js: Cache poisoning via collisions in React Server Component cache-busting

LOW 17

Next.js is a React framework for building full-stack web applications.

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.00215 Published 2026-05-13 Partial fix · 15.5.16, 16.2.5 CWE-328

TI-2026-32493 CVE-2026-44581 · GHSA-ffhc-5mcf-pf4q

Next.js: Cross-site scripting in App Router applications using CSP nonces

LOW 21

Next.js is a React framework for building full-stack web applications.

CVSS 3.1MEDIUM 4.7 Network No auth User interaction EPSS 0.00222 Published 2026-05-13 Partial fix · 15.5.16, 16.2.5 CWE-79

TI-2026-32492 CVE-2026-44580 · GHSA-gx5p-jg67-6x7h

Next.js: Cross-site scripting in beforeInteractive scripts with untrusted input

LOW 27

Next.js is a React framework for building full-stack web applications.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00205 Published 2026-05-13 Partial fix · 15.5.16, 16.2.5 CWE-79

TI-2026-32491 CVE-2026-44579 · GHSA-mg66-mrh9-m8jx

Next.js: Denial of Service via connection exhaustion in applications using Cache Components

MEDIUM 40

Next.js is a React framework for building full-stack web applications.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00746 Published 2026-05-13 Partial fix · 16.2.5, 15.5.16 CWE-770

TI-2026-32490 CVE-2026-44578 · GHSA-c4j6-fc7j-m34r

Next.js: Server-side request forgery in applications using WebSocket upgrades

HIGH 69

Next.js is a React framework for building full-stack web applications.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.35539 Published 2026-05-13 Partial fix · 16.2.5, 15.5.16 CWE-918

TI-2026-32489 CVE-2026-44577 · GHSA-h64f-5h5j-jqjh

Next.js: Denial of Service in the Image Optimization API

LOW 28

Next.js is a React framework for building full-stack web applications.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00739 Published 2026-05-13 Partial fix · 15.5.16, 16.2.5 CWE-770

TI-2026-32488 CVE-2026-44576 · GHSA-wfc6-r584-vfw7

Next.js: Cache poisoning in React Server Component responses

LOW 24

Next.js is a React framework for building full-stack web applications.

CVSS 3.1MEDIUM 5.4 Network No auth No interaction EPSS 0.00295 Published 2026-05-13 Partial fix · 15.5.16, 16.2.5 CWE-436

TI-2026-32486 CVE-2026-44574 · GHSA-492v-c6pp-mqqv

Next.js: Middleware / Proxy bypass through dynamic route parameter injection

LOW 38

Next.js is a React framework for building full-stack web applications.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00636 Published 2026-05-13 Partial fix · 15.5.16, 16.2.5 CWE-288

Vulnerabilities

Filters