Vercel Next.Js vulnerabilities

CVE-2025-59471 [HIGH] CWE-400 CVE-2025-59471: A denial of service vulnerability exists in self-hosted Next.js applications that have `remotePatter A denial of service vulnerability exists in self-hosted Next.js applications that have `remotePatterns` configured for the Image Optimizer. The image optimization endpoint (`/_next/image`) loads external images entirely into memory without enforcing a maximum size limit, allowing an attacker to cause out-of-memory conditions by requesting optimization

CVE-2025-59472 [HIGH] CWE-400 CVE-2025-59472: A denial of service vulnerability exists in Next.js versions with Partial Prerendering (PPR) enabled A denial of service vulnerability exists in Next.js versions with Partial Prerendering (PPR) enabled when running in minimal mode. The PPR resume endpoint accepts unauthenticated POST requests with the `Next-Resume: 1` header and processes attacker-controlled postponed state data. Two closely related vulnerabilities allow an attacker to crash the serv

CVE-2025-49826 [HIGH] CWE-444 CVE-2025-49826: Next.js is a React framework for building full-stack web applications. From versions 15.0.4-canary.5 Next.js is a React framework for building full-stack web applications. From versions 15.0.4-canary.51 to before 15.1.8, a cache poisoning bug leading to a Denial of Service (DoS) condition was found in Next.js. This issue does not impact customers hosted on Vercel. Under certain conditions, this issue may allow a HTTP 204 response to be cached for sta

CVE-2022-21721 [HIGH] CVE-2022-21721: Next.js is a React framework. Starting with version 12.0.0 and prior to version 12.0.9, vulnerable c Next.js is a React framework. Starting with version 12.0.0 and prior to version 12.0.9, vulnerable code could allow a bad actor to trigger a denial of service attack for anyone using i18n functionality. In order to be affected by this CVE, one must use next start or a custom server and the built-in i18n support. Deployments on Vercel, along with similar envir

CVE-2026-29057 [MEDIUM] CWE-444 CVE-2026-29057: Next.js is a React framework for building full-stack web applications. Starting in version 9.5.0 and Next.js is a React framework for building full-stack web applications. Starting in version 9.5.0 and prior to versions 15.5.13 and 16.1.7, when Next.js rewrites proxy traffic to an external backend, a crafted `DELETE`/`OPTIONS` request using `Transfer-Encoding: chunked` could trigger request boundary disagreement between the proxy and backend. This

CVE-2023-46298 [HIGH] CVE-2023-46298: Next.js before 13.4.20-canary.13 lacks a cache-control header and thus empty prefetch responses may Next.js before 13.4.20-canary.13 lacks a cache-control header and thus empty prefetch responses may sometimes be cached by a CDN, causing a denial of service to all users requesting the same URL via that CDN.

CVE-2024-47831 [HIGH] CWE-674 CVE-2024-47831: Next.js is a React Framework for the Web. Cersions on the 10.x, 11.x, 12.x, 13.x, and 14.x branches Next.js is a React Framework for the Web. Cersions on the 10.x, 11.x, 12.x, 13.x, and 14.x branches before version 14.2.7 contain a vulnerability in the image optimization feature which allows for a potential Denial of Service (DoS) condition which could lead to excessive CPU consumption. Neither the `next.config.js` file that is configured with `image

CVE-2024-39693 [HIGH] CWE-400 CVE-2024-39693: Next.js is a React framework. A Denial of Service (DoS) condition was identified in Next.js. Exploit Next.js is a React framework. A Denial of Service (DoS) condition was identified in Next.js. Exploitation of the bug can trigger a crash, affecting the availability of the server. his vulnerability was resolved in Next.js 13.5 and later.

CVE-2026-44577 [MEDIUM] CWE-770 CVE-2026-44577: Next.js is a React framework for building full-stack web applications. From 10.0.0 to before 15.5.16 Next.js is a React framework for building full-stack web applications. From 10.0.0 to before 15.5.16 and 16.2.5, when self-hosting Next.js with the default image loader, the Image Optimization API fetches local images entirely into memory without enforcing a maximum size limit. An attacker could cause out-of-memory conditions by requesting large loc

CVE-2025-57752 [MEDIUM] CWE-524 CVE-2025-57752: Next.js is a React framework for building full-stack web applications. In versions before 14.2.31 an Next.js is a React framework for building full-stack web applications. In versions before 14.2.31 and from 15.0.0 to before 15.4.5, Next.js Image Optimization API routes are affected by cache key confusion. When images returned from API routes vary based on request headers (such as Cookie or Authorization), these responses could be incorrectly cache

CVE-2025-30218 [MEDIUM] CVE-2025-30218: Next.js is a React framework for building full-stack web applications. To mitigate CVE-2025-29927, N Next.js is a React framework for building full-stack web applications. To mitigate CVE-2025-29927, Next.js validated the x-middleware-subrequest-id which persisted across multiple incoming requests. However, this subrequest ID is sent to all requests, even if the destination is not the same host as the Next.js application. Initiating a fetch request to a th

CVE-2026-44572 [MEDIUM] CWE-349 CVE-2026-44572: Next.js is a React framework for building full-stack web applications. From 12.2.0 to before 15.5.16 Next.js is a React framework for building full-stack web applications. From 12.2.0 to before 15.5.16 and 16.2.5, an external client could send a x-nextjs-data header on a normal request to a path handled by middleware that returns a redirect. When that happened, the middleware/proxy could treat the request as a data request and replace the standard

CVE-2026-44576 [MEDIUM] CWE-436 CVE-2026-44576: Next.js is a React framework for building full-stack web applications. From 14.2.0 to before 15.5.16 Next.js is a React framework for building full-stack web applications. From 14.2.0 to before 15.5.16 and 16.2.5, applications using React Server Components can be vulnerable to cache poisoning when shared caches do not correctly partition response variants. Under affected conditions, an attacker can cause an RSC response to be served from the origin

CVE-2026-44580 [MEDIUM] CWE-79 CVE-2026-44580: Next.js is a React framework for building full-stack web applications. From 13.0.0 to before 15.5.16 Next.js is a React framework for building full-stack web applications. From 13.0.0 to before 15.5.16 and 16.2.5, applications that use beforeInteractive scripts together with untrusted content can be vulnerable to cross-site scripting. In affected versions, serialized script content was not escaped safely before being embedded into the document, whic

CVE-2024-56332 [MEDIUM] CWE-770 CVE-2024-56332: Next.js is a React framework for building full-stack web applications. Starting in version 13.0.0 an Next.js is a React framework for building full-stack web applications. Starting in version 13.0.0 and prior to versions 13.5.8, 14.2.21, and 15.1.2, Next.js is vulnerable to a Denial of Service (DoS) attack that allows attackers to construct requests that leaves requests to Server Actions hanging until the hosting provider cancels the function execu

CVE-2026-27977 [MEDIUM] CWE-1385 CVE-2026-27977: Next.js is a React framework for building full-stack web applications. Starting in version 16.0.1 an Next.js is a React framework for building full-stack web applications. Starting in version 16.0.1 and prior to version 16.1.7, in `next dev`, cross-site protection for internal websocket endpoints could treat `Origin: null` as a bypass case even if `allowedDevOrigins` is configured, allowing privacy-sensitive/opaque contexts (for example sandboxed

CVE-2021-37699 [MEDIUM] CWE-601 CVE-2021-37699: Next.js is an open source website development framework to be used with the React library. In affect Next.js is an open source website development framework to be used with the React library. In affected versions specially encoded paths could be used when pages/_error.js was statically generated allowing an open redirect to occur to an external site. In general, this redirect does not directly harm users although can allow for phishing attacks by r

CVE-2021-39178 [MEDIUM] CWE-79 CVE-2021-39178: Next.js is a React framework. Versions of Next.js between 10.0.0 and 11.0.0 contain a cross-site scr Next.js is a React framework. Versions of Next.js between 10.0.0 and 11.0.0 contain a cross-site scripting vulnerability. In order for an instance to be affected by the vulnerability, the `next.config.js` file must have `images.domains` array assigned and the image host assigned in `images.domains` must allow user-provided SVG. If the `next.config.js

CVE-2022-36046 [MEDIUM] CWE-248 CVE-2022-36046: Next.js is a React framework that can provide building blocks to create web applications. All of the Next.js is a React framework that can provide building blocks to create web applications. All of the following must be true to be affected by this CVE: Next.js version 12.2.3, Node.js version above v15.0.0 being used with strict `unhandledRejection` exiting AND using next start or a [custom server](https://nextjs.org/docs/advanced-features/custom-se

CVE-2026-44581 [MEDIUM] CWE-79 CVE-2026-44581: Next.js is a React framework for building full-stack web applications. From 13.4.0 to before 15.5.16 Next.js is a React framework for building full-stack web applications. From 13.4.0 to before 15.5.16 and 16.2.5, App Router applications that rely on CSP nonces can be vulnerable to stored cross-site scripting when deployed behind shared caches. In affected versions, malformed nonce values derived from request headers could be reflected into rendered