Product by Vercel
Next
59 known vulnerabilities in Next (Vercel), 0 of them actively exploited (CISA KEV).
Key figures
59
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
2
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| High | CVE-2026-44578 | Next.js: Server-side request forgery in applications using WebSocket upgrades | 8.6 | |
| Critical | CVE-2025-29927 | Authorization Bypass in Next.js Middleware | 9.1 | |
| Critical | CVE-2026-75604 | Next.js: Unauthenticated Remote Code Execution on windows-hosted servers | 9.0 | |
| High | CVE-2024-46982 | Cache Poisoning in next.js | 7.5 | |
| High | CVE-2021-43803 | Unexpected server crash in Next.js | 7.5 | |
| High | CVE-2024-34351 | Next.js Server-Side Request Forgery in Server Actions | 7.5 | |
| High | CVE-2024-51479 | Authorization bypass in Next.js | 7.5 | |
| High | CVE-2026-44575 | Next.js: Middleware / Proxy bypass in App Router applications via segment-prefetch routes | 7.5 | |
| Medium | CVE-2026-94545 | Satori-generated SVG has improper escaping | — | |
| High | CVE-2026-64641 | Next.js: Denial of Service in App Router using Server Actions | 7.5 | |
| High | CVE-2023-46298 | Vercel Next.js: Denial of Service | 7.5 | |
| High | CVE-2022-21721 | DOS Vulnerability in next.js | 5.9 | |
| High | CVE-2026-64642 | Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale | 8.2 | |
| High | CVE-2025-49826 | Next.js DoS vulnerability via cache poisoning | 7.5 | |
| High | CVE-2026-44573 | Next.js: Middleware / Proxy bypass in Pages Router applications using i18n | 7.5 | |
| High | CVE-2024-34350 | Next.js Vulnerable to HTTP Request Smuggling | 7.5 | |
| High | CVE-2022-23646 | Improper CSP in Image Optimization API for Next.js | 5.9 | |
| High | CVE-2026-44579 | Next.js: Denial of Service via connection exhaustion in applications using Cache Components | 7.5 | |
| High | CVE-2026-94482 | Next.js: Denial of Service in App Router using Server Actions | — | |
| High | CVE-2026-44574 | Next.js: Middleware / Proxy bypass through dynamic route parameter injection | 8.1 | |
| High | CVE-2026-94483 | Next.js: Server-Side Request Forgery in Image Optimization | 6.5 | |
| Medium | CVE-2026-94543 | Next.js: Cache poisoning of SSG and ISR pages in self-hosted Next.js applications | 5.3 | |
| High | CVE-2026-64649 | Next.js: Server-Side Request Forgery in Server Actions on Custom Servers | 6.5 | |
| High | CVE-2026-27980 | Next.js: Unbounded next/image disk cache growth can exhaust storage | 7.5 | |
| High | CVE-2026-27979 | Next.js: Unbounded postponed resume buffering can lead to DoS | 7.5 |