Next.js — CVE history (npm) Next.js
61 CVEs affect the Next.js npm package (highest CVSS 10.0). 1 on CISA's Known Exploited Vulnerabilities catalog. Latest disclosed: 2026-09-01. Full CVE history sourced from NVD.
Summary Package Next.js (npm)Total CVEs 61Actively exploited (CISA KEV) 1 Highest CVSS 10.0Latest disclosed 2026-09-01 Recent CVEs (top 20) CVE Severity CVSS KEV Published Summary CVE-2026-75604Critical 9.0— 2026-09-01 Next.js is a React framework for building full-stack web applications. CVE-2026-64649Medium 6.5— 2026-07-27 Next.js is a React framework for building full-stack web applications. CVE-2026-64648Medium 5.4— 2026-07-27 Next.js is a React framework for building full-stack web applications. CVE-2026-64647Medium 5.4— 2026-07-27 Next.js is a React framework for building full-stack web applications. CVE-2026-64646Medium 5.3— 2026-07-27 Next.js is a React framework for building full-stack web applications. CVE-2026-64645Medium 6.1— 2026-07-27 Next.js is a React framework for building full-stack web applications. CVE-2026-64644Medium 5.3— 2026-07-27 Next.js is a React framework for building full-stack web applications. CVE-2026-64643Medium 5.3— 2026-07-27 Next.js is a React framework for building full-stack web applications. CVE-2026-64642High 8.2— 2026-07-27 Next.js is a React framework for building full-stack web applications. CVE-2026-64641High 7.5— 2026-07-27 Next.js is a React framework for building full-stack web applications. CVE-2026-45109High 7.5— 2026-05-13 Next.js is a React framework for building full-stack web applications. CVE-2026-44582Low 3.7— 2026-05-13 Next.js is a React framework for building full-stack web applications. CVE-2026-44581Medium 4.7— 2026-05-13 Next.js is a React framework for building full-stack web applications. CVE-2026-44580Medium 6.1— 2026-05-13 Next.js is a React framework for building full-stack web applications. CVE-2026-44579High 7.5— 2026-05-13 Next.js is a React framework for building full-stack web applications. CVE-2026-44578High 8.6— 2026-05-13 Next.js is a React framework for building full-stack web applications. CVE-2026-44577Medium 5.9— 2026-05-13 Next.js is a React framework for building full-stack web applications. CVE-2026-44576Medium 5.4— 2026-05-13 Next.js is a React framework for building full-stack web applications. CVE-2026-44575High 7.5— 2026-05-13 Next.js is a React framework for building full-stack web applications. CVE-2026-44574High 8.1— 2026-05-13 Next.js is a React framework for building full-stack web applications.
All-time worst (top 10 by CVSS) CVE Severity CVSS KEV Published Summary CVE-2025-55182Critical 10.0KEV 2025-12-03 A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-… CVE-2025-29927Critical 9.1— 2025-03-21 Next.js is a React framework for building full-stack web applications. CVE-2026-75604Critical 9.0— 2026-09-01 Next.js is a React framework for building full-stack web applications. CVE-2026-44578High 8.6— 2026-05-13 Next.js is a React framework for building full-stack web applications. CVE-2026-64642High 8.2— 2026-07-27 Next.js is a React framework for building full-stack web applications. CVE-2026-44574High 8.1— 2026-05-13 Next.js is a React framework for building full-stack web applications. CVE-2026-64641High 7.5— 2026-07-27 Next.js is a React framework for building full-stack web applications. CVE-2026-45109High 7.5— 2026-05-13 Next.js is a React framework for building full-stack web applications. CVE-2026-44579High 7.5— 2026-05-13 Next.js is a React framework for building full-stack web applications. CVE-2026-44575High 7.5— 2026-05-13 Next.js is a React framework for building full-stack web applications.
Actively exploited (CISA KEV — 1) CVE Severity CVSS KEV Published Summary CVE-2025-55182Critical 10.0KEV 2025-12-03 A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-…