CVE-2026-64649 | Medium | 6.5 | 2026-07-27 | Next.js is a React framework for building full-stack web applications. In versions 14.1.1 through 15.5.20 and 16.0.0 through 16.2.10, when a Server Action forw… |
CVE-2026-64648 | Medium | 5.4 | 2026-07-27 | Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a server-side fetch with… |
CVE-2026-64647 | Medium | 5.4 | 2026-07-27 | Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a server-side fetch with… |
CVE-2026-64646 | Medium | 5.3 | 2026-07-27 | Next.js is a React framework for building full-stack web applications. In versions 13.0.0 through 15.5.20 and 16.0.0 through 16.2.10, requests targeting Next.j… |
CVE-2026-64645 | Medium | 6.1 | 2026-07-27 | Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a
rewrites() or redirect… |
CVE-2026-64644 | Medium | 5.3 | 2026-07-27 | Next.js is a React framework for building full-stack web applications. In versions 15.5.0 through 15.5.20 and 16.0.0 through 16.2.10, when self-hosting Next.js… |
CVE-2026-64643 | Medium | 5.3 | 2026-07-27 | Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, Next.js applications usin… |
CVE-2026-64642 | High | 8.2 | 2026-07-27 | Next.js is a React framework for building full-stack web applications. In versions 16.0.0 through 16.2.10, crafted requests targeting Next.js applications usin… |
CVE-2026-64641 | High | 7.5 | 2026-07-27 | Next.js is a React framework for building full-stack web applications. In versions 13.0.0 through 15.5.20 and 16.0.0 through 16.2.10, crafted requests targetin… |
CVE-2026-64651 | | | 2026-07-20 | The `@ai-sdk/harness-opencode` tool connects HarnessAgent to OpenCode through a sandboxed bridge. Prior to version 1.0.28, the tool relay authorizes requests f… |
CVE-2026-64650 | | | 2026-07-20 | The `@ai-sdk/harness-opencode` tool is an HarnessV1 adapter backed by @openai/codex-sdk, which drives the codex command line interface. Prior to version 1.0.29… |
CVE-2026-8769 | Medium | 4.3 | 2026-05-17 | A vulnerability was determined in vercel ai up to 3.0.97. The impacted element is the function createJsonResponseHandler/createJsonErrorResponseHandler of the… |
CVE-2026-8768 | High | 7.3 | 2026-05-17 | A vulnerability was found in vercel ai up to 3.0.97. The affected element is the function validateDownloadUrl of the file packages/provider-utils/src/download-… |
CVE-2026-8767 | Medium | 5.0 | 2026-05-17 | A vulnerability has been found in vercel ai up to 3.0.97. Impacted is the function run of the file .github/workflows/prettier-on-automerge.yml of the component… |
CVE-2026-46508 | High | 7.8 | 2026-05-15 | Turborepo is a high-performance build system for JavaScript and TypeScript codebases. Prior to 2.9.14000, the Turborepo LSP VS Code extension could execute she… |
CVE-2026-45773 | Medium | 6.5 | 2026-05-15 | Turborepo is a high-performance build system for JavaScript and TypeScript codebases. Prior to 2.9.14, Turborepo's self-hosted login and SSO browser flows did… |
CVE-2026-45772 | Critical | 9.8 | 2026-05-15 | Turborepo is a high-performance build system for JavaScript and TypeScript codebases. From 1.1.0 to before 2.9.14, Turborepo can be vulnerable to arbitrary cod… |
CVE-2026-45109 | High | 7.5 | 2026-05-13 | Next.js is a React framework for building full-stack web applications. From 15.2.0 to before 15.5.18 and 16.2.6, it was found that the fix addressing CVE-2026-… |
CVE-2026-44582 | Low | 3.7 | 2026-05-13 | Next.js is a React framework for building full-stack web applications. From 13.4.6 to before 15.5.16 and 16.2.5, React Server Component responses can be vulner… |
CVE-2026-44581 | Medium | 4.7 | 2026-05-13 | Next.js is a React framework for building full-stack web applications. From 13.4.0 to before 15.5.16 and 16.2.5, App Router applications that rely on CSP nonce… |
CVE-2026-44580 | Medium | 6.1 | 2026-05-13 | Next.js is a React framework for building full-stack web applications. From 13.0.0 to before 15.5.16 and 16.2.5, applications that use beforeInteractive script… |
CVE-2026-44579 | High | 7.5 | 2026-05-13 | Next.js is a React framework for building full-stack web applications. From to before 15.5.16 and 16.2.5, applications using Partial Prerendering through the… |
CVE-2026-44578 | High | 8.6 | 2026-05-13 | Next.js is a React framework for building full-stack web applications. From 13.4.13 to before 15.5.16 and 16.2.5, self-hosted applications using the built-in N… |
CVE-2026-44577 | Medium | 5.9 | 2026-05-13 | Next.js is a React framework for building full-stack web applications. From 10.0.0 to before 15.5.16 and 16.2.5, when self-hosting Next.js with the default ima… |
CVE-2026-44576 | Medium | 5.4 | 2026-05-13 | Next.js is a React framework for building full-stack web applications. From 14.2.0 to before 15.5.16 and 16.2.5, applications using React Server Components can… |
CVE-2026-44575 | High | 7.5 | 2026-05-13 | Next.js is a React framework for building full-stack web applications. From 15.2.0 to before 15.5.16 and 16.2.5, App Router applications that rely on middlewar… |
CVE-2026-44574 | High | 8.1 | 2026-05-13 | Next.js is a React framework for building full-stack web applications. From 15.4.0 to before 15.5.16 and 16.2.5, applications that rely on middleware to protec… |
CVE-2026-44573 | High | 7.5 | 2026-05-13 | Next.js is a React framework for building full-stack web applications. From 12.2.0 to before 15.5.16 and 16.2.5, Applications using the Pages Router with i18n… |
CVE-2026-44572 | Low | 3.7 | 2026-05-13 | Next.js is a React framework for building full-stack web applications. From 12.2.0 to before 15.5.16 and 16.2.5, an external client could send a x-nextjs-data… |
CVE-2026-44479 | Medium | 5.5 | 2026-05-13 | Vercel’s AI Cloud is a unified platform for building modern applications. From 50.16.0 to 52.0.0, hen the Vercel CLI runs in non-interactive mode (--non-inter… |
CVE-2026-29057 | Medium | 6.5 | 2026-03-18 | Next.js is a React framework for building full-stack web applications. Starting in version 9.5.0 and prior to versions 15.5.13 and 16.1.7, when Next.js rewrite… |
CVE-2026-27980 | High | 7.5 | 2026-03-18 | Next.js is a React framework for building full-stack web applications. Starting in version 10.0.0 and prior to version 16.1.7, the default Next.js image optimi… |
CVE-2026-27979 | High | 7.5 | 2026-03-18 | Next.js is a React framework for building full-stack web applications. Starting in version 16.0.1 and prior to version 16.1.7, a request containing the `next-r… |
CVE-2026-27978 | Medium | 4.3 | 2026-03-18 | Next.js is a React framework for building full-stack web applications. Starting in version 16.0.1 and prior to version 16.1.7, `origin: null` was treated as a… |
CVE-2026-27977 | Medium | 5.4 | 2026-03-18 | Next.js is a React framework for building full-stack web applications. Starting in version 16.0.1 and prior to version 16.1.7, in `next dev`, cross-site protec… |
CVE-2025-59472 | Medium | 5.9 | 2026-01-26 | A denial of service vulnerability exists in Next.js versions with Partial Prerendering (PPR) enabled when running in minimal mode. The PPR resume endpoint acce… |
CVE-2025-59471 | Medium | 5.9 | 2026-01-26 | A denial of service vulnerability exists in self-hosted Next.js applications that have `remotePatterns` configured for the Image Optimizer. The image optimizat… |
CVE-2025-67779 | High | 7.5 | 2025-12-12 | It was found that the fix addressing CVE-2025-55184 in React Server Components was incomplete and does not prevent a denial of service attack in a specific cas… |
CVE-2025-55184 | High | 7.5 | 2025-12-11 | A pre-authentication denial of service vulnerability exists in React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, inclu… |
CVE-2025-55183 | Medium | 5.3 | 2025-12-11 | An information leak vulnerability exists in specific configurations of React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2… |
CVE-2025-55182 | Critical | 10.0 | 2025-12-03 | A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following… |
CVE-2025-52662 | Medium | 6.9 | 2025-11-07 | A vulnerability in Nuxt DevTools has been fixed in version **2.6.4***. This issue may have allowed Nuxt auth token extraction via XSS under certain configurati… |
CVE-2025-48985 | Low | 3.7 | 2025-11-07 | A vulnerability in Vercel’s AI SDK has been fixed in versions 5.0.52, 5.1.0-beta.9, and 6.0.0-beta. This issue may have allowed users to bypass filetype whitel… |
CVE-2025-57822 | Medium | 6.5 | 2025-08-29 | Next.js is a React framework for building full-stack web applications. Prior to versions 14.2.32 and 15.4.7, when next() was used without explicitly passing th… |
CVE-2025-57752 | Medium | 6.2 | 2025-08-29 | Next.js is a React framework for building full-stack web applications. In versions before 14.2.31 and from 15.0.0 to before 15.4.5, Next.js Image Optimization… |
CVE-2025-55173 | Medium | 4.3 | 2025-08-29 | Next.js is a React framework for building full-stack web applications. In versions before 14.2.31 and from 15.0.0 to before 15.4.5, Next.js Image Optimization… |
CVE-2025-7074 | Medium | 4.3 | 2025-07-05 | A vulnerability classified as problematic has been found in vercel hyper up to 3.4.1. This affects the function expand/braceExpand/ignoreMap of the file hyper/… |
CVE-2025-49826 | High | 7.5 | 2025-07-03 | Next.js is a React framework for building full-stack web applications. From versions 15.0.4-canary.51 to before 15.1.8, a cache poisoning bug leading to a Deni… |
CVE-2025-49005 | Low | 3.7 | 2025-07-03 | Next.js is a React framework for building full-stack web applications. In Next.js App Router from 15.3.0 to before 15.3.3 and Vercel CLI from 41.4.1 to 42.2.0… |
CVE-2025-48068 | Medium | 4.3 | 2025-05-30 | Next.js is a React framework for building full-stack web applications. In versions starting from 13.0 to before 14.2.30 and 15.0.0 to before 15.2.2, Next.js ma… |
CVE-2025-32421 | Low | 3.7 | 2025-05-14 | Next.js is a React framework for building full-stack web applications. Versions prior to 14.2.24 and 15.1.6 have a race-condition vulnerability. This issue onl… |
CVE-2025-46332 | Medium | 6.5 | 2025-05-02 | Flags SDK is an open-source feature flags toolkit for Next.js and SvelteKit. Impacted versions include flags from 3.2.0 and prior and @vercel/flags from 3.1.1… |
CVE-2025-30218 | Medium | 5.9 | 2025-04-02 | Next.js is a React framework for building full-stack web applications. To mitigate CVE-2025-29927, Next.js validated the x-middleware-subrequest-id which persi… |
CVE-2025-29927 | Critical | 9.1 | 2025-03-21 | Next.js is a React framework for building full-stack web applications. Starting in version 1.11.4 and prior to versions 12.3.5, 13.5.9, 14.2.25, and 15.2.3, it… |
CVE-2024-56332 | Medium | 5.3 | 2025-01-03 | Next.js is a React framework for building full-stack web applications. Starting in version 13.0.0 and prior to versions 13.5.8, 14.2.21, and 15.1.2, Next.js is… |
CVE-2024-51479 | High | 7.5 | 2024-12-17 | Next.js is a React framework for building full-stack web applications. In affected versions if a Next.js application is performing authorization in middleware… |
CVE-2024-47831 | Medium | 5.9 | 2024-10-14 | Next.js is a React Framework for the Web. Cersions on the 10.x, 11.x, 12.x, 13.x, and 14.x branches before version 14.2.7 contain a vulnerability in the image… |
CVE-2024-46982 | High | 7.5 | 2024-09-17 | Next.js is a React framework for building full-stack web applications. By sending a crafted HTTP request, it is possible to poison the cache of a non-dynamic s… |
CVE-2024-39693 | High | 7.5 | 2024-07-10 | Next.js is a React framework. A Denial of Service (DoS) condition was identified in Next.js. Exploitation of the bug can trigger a crash, affecting the availab… |
CVE-2024-34351 | High | 7.5 | 2024-05-14 | Next.js is a React framework that can provide building blocks to create web applications. A Server-Side Request Forgery (SSRF) vulnerability was identified in… |
CVE-2024-34350 | High | 7.5 | 2024-05-14 | Next.js is a React framework that can provide building blocks to create web applications. Prior to 13.5.1, an inconsistent interpretation of a crafted HTTP req… |
CVE-2024-24828 | Medium | 6.6 | 2024-02-09 | pkg is tool design to bundle Node.js projects into an executables. Any native code packages built by `pkg` are written to a hardcoded directory. On unix system… |
CVE-2024-23741 | Critical | 9.8 | 2024-01-28 | An issue in Hyper on macOS version 3.4.1 and before, allows remote attackers to execute arbitrary code via the RunAsNode and enableNodeClilnspectArguments sett… |
CVE-2023-46298 | High | 7.5 | 2023-10-22 | Next.js before 13.4.20-canary.13 lacks a cache-control header and thus empty prefetch responses may sometimes be cached by a CDN, causing a denial of service t… |
CVE-2017-20162 | Medium | 4.3 | 2023-01-05 | A vulnerability, which was classified as problematic, has been found in vercel ms up to 1.x. This issue affects the function parse of the file index.js. The ma… |
CVE-2022-36046 | Medium | 5.3 | 2022-08-31 | Next.js is a React framework that can provide building blocks to create web applications. All of the following must be true to be affected by this CVE: Next.js… |
CVE-2022-23646 | Medium | 5.9 | 2022-02-17 | Next.js is a React framework. Starting with version 10.0.0 and prior to version 12.1.0, Next.js is vulnerable to User Interface (UI) Misrepresentation of Criti… |
CVE-2022-21721 | Medium | 5.9 | 2022-01-28 | Next.js is a React framework. Starting with version 12.0.0 and prior to version 12.0.9, vulnerable code could allow a bad actor to trigger a denial of service… |
CVE-2021-43803 | High | 7.5 | 2021-12-10 | Next.js is a React framework. In versions of Next.js prior to 12.0.5 or 11.1.3, invalid or malformed URLs could lead to a server crash. In order to be affected… |
CVE-2021-39178 | High | 7.5 | 2021-08-31 | Next.js is a React framework. Versions of Next.js between 10.0.0 and 11.0.0 contain a cross-site scripting vulnerability. In order for an instance to be affect… |
CVE-2021-37699 | Medium | 6.9 | 2021-08-12 | Next.js is an open source website development framework to be used with the React library. In affected versions specially encoded paths could be used when page… |
CVE-2020-15242 | Medium | 4.7 | 2020-10-08 | Next.js versions >=9.5.0 and <9.5.4 are vulnerable to an Open Redirect. Specially encoded paths could be used with the trailing slash redirect to allow an open… |
CVE-2015-8315 | High | 7.5 | 2017-01-23 | The ms package before 0.7.1 for Node.js allows attackers to cause a denial of service (CPU consumption) via a long version string, aka a "regular expression de… |