p PatchFirst

PatchFirst · Latest vulnerabilities

next vulnerabilities · Page 3

Vulnerabilities published for next in the last 30 days: 11. Listed in the KEV catalogue: 0.

RSS ↗ JSON ↗
Filter vulnerabilities
Clear filters

Vulnerabilities: 77

  1. CVE-2026-27977

    Low · CVSS 2.3EPSS 0.18%Fix available

    Next.js: null origin can bypass dev HMR websocket CSRF checks

    Next.js is a React framework for building full-stack web applications. Starting in version 16.0.1 and prior to version 16.1.7, in `next dev`, cross-site protection for internal websocket endpoints could treat `Origin: null` as a bypass case even if `allowedDevOrigins` is configured, allowing privacy-sensitive/opaque contexts (for example sandboxed documents) to connect unexpectedly. If a dev server is reachable from attacker-controlled content, an attacker may be able to connect to the HMR websocket channel and interact with dev websocket traffic. This affects development mode only. Apps without a configured `allowedDevOrigins` still allow co

    nextNode.js
    • Update to 16.1.7
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  2. GHSA-h25m-26qc-wcjf

    High · CVSS 7.5Fix available

    Next.js HTTP request deserialization can lead to DoS when using insecure React Server Components

    A vulnerability affects certain React Server Components packages for versions 19.0.x, 19.1.x, and 19.2.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. The issue is tracked upstream as [CVE-2026-23864](https://github.com/facebook/react/security/advisories/GHSA-83fc-fqcc-2hmg). A specially crafted HTTP request can be sent to any App Router Server Function endpoint that, when deserialized, may trigger excessive CPU usage, out-of-memory exceptions, or server crashes. This can result in denial of service in unpatched environments.

    next next next next next next next next nextNode.js
    • Update to 15.0.8
    • Update to 15.1.12
    • Update to 15.2.9
    • Update to 15.3.9
    • Update to 15.4.11
    • Update to 15.5.10
    • Update to 15.6.0-canary.61
    • Update to 16.0.11
    • Update to 16.1.5
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  3. CVE-2025-59472

    Medium · CVSS 5.9EPSS 0.43%Fix available

    CVE-2025-59472

    A denial of service vulnerability exists in Next.js versions with Partial Prerendering (PPR) enabled when running in minimal mode. The PPR resume endpoint accepts unauthenticated POST requests with the `Next-Resume: 1` header and processes attacker-controlled postponed state data. Two closely related vulnerabilities allow an attacker to crash the server process through memory exhaustion: 1. **Unbounded request body buffering**: The server buffers the entire POST request body into memory using `Buffer.concat()` without enforcing any size limit, allowing arbitrarily large payloads to exhaust available memory. 2. **Unbounded decompression (zip

    next next next next next next next next next next next nextNode.js
    • Update to 15.6.0-canary.61
    • Update to 16.1.5
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  4. CVE-2025-59471

    Medium · CVSS 5.9EPSS 0.49%Fix available

    CVE-2025-59471

    A denial of service vulnerability exists in self-hosted Next.js applications that have `remotePatterns` configured for the Image Optimizer. The image optimization endpoint (`/_next/image`) loads external images entirely into memory without enforcing a maximum size limit, allowing an attacker to cause out-of-memory conditions by requesting optimization of arbitrarily large images. This vulnerability requires that `remotePatterns` is configured to allow image optimization from external domains and that the attacker can serve or control a large image on an allowed domain. Strongly consider upgrading to 15.5.10 or 16.1.5 to reduce risk and pre

    next nextNode.js
    • Update to 15.5.10
    • Update to 16.1.5
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  5. GHSA-5j59-xgg2-r9c4

    High · CVSS 7.5Fix available

    Next has a Denial of Service with Server Components - Incomplete Fix Follow-Up

    It was discovered that the fix for [CVE-2025-55184](https://github.com/advisories/GHSA-2m3v-v2m8-q956) in React Server Components was incomplete and did not fully mitigate denial-of-service conditions across all payload types. As a result, certain crafted inputs could still trigger excessive resource consumption. This vulnerability affects React versions 19.0.2, 19.1.3, and 19.2.2, as well as frameworks that bundle or depend on these versions, including Next.js 13.x, 14.x, 15.x, and 16.x when using the App Router. The issue is tracked upstream as [CVE-2025-67779](https://www.cve.org/CVERecord?id=CVE-2025-67779). A malicious actor can send

    next next next next next next next next next nextNode.js
    • Update to 14.2.35
    • Update to 15.0.7
    • Update to 15.1.11
    • Update to 15.2.8
    • Update to 15.3.8
    • Update to 15.4.10
    • Update to 15.5.9
    • Update to 15.6.0-canary.60
    • Update to 16.0.10
    • Update to 16.1.0-canary.19
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  6. GHSA-w37m-7fhw-fmv9

    Medium · CVSS 5.3Fix available

    Next Server Actions Source Code Exposure

    A vulnerability affects certain React packages for versions 19.0.0, 19.0.1, 19.1.0, 19.1.1, 19.1.2, 19.2.0, and 19.2.1 and frameworks that use the affected packages, including Next.js 15.x and 16.x using the App Router. The issue is tracked upstream as [CVE-2025-55183](https://www.cve.org/CVERecord?id=CVE-2025-55183). A malicious HTTP request can be crafted and sent to any App Router endpoint that can return the compiled source code of [Server Functions](https://react.dev/reference/rsc/server-functions). This could reveal business logic, but would not expose secrets unless they were hardcoded directly into [Server Function](https://react.dev

    next next next next next next next next nextNode.js
    • Update to 15.0.6
    • Update to 15.1.10
    • Update to 15.2.7
    • Update to 15.3.7
    • Update to 15.4.9
    • Update to 15.5.8
    • Update to 15.6.0-canary.59
    • Update to 16.0.9
    • Update to 16.1.0-canary.17
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  7. GHSA-mwv6-3258-q52c

    High · CVSS 7.5Fix available

    Next Vulnerable to Denial of Service with Server Components

    A vulnerability affects certain React packages for versions 19.0.0, 19.0.1, 19.1.0, 19.1.1, 19.1.2, 19.2.0, and 19.2.1 and frameworks that use the affected packages, including Next.js 15.x and 16.x using the App Router. The issue is tracked upstream as [CVE-2025-55184](https://www.cve.org/CVERecord?id=CVE-2025-55184). A malicious HTTP request can be crafted and sent to any App Router endpoint that, when deserialized, can cause the server process to hang and consume CPU. This can result in denial of service in unpatched environments.

    next next next next next next next next next nextNode.js
    • Update to 14.2.34
    • Update to 15.0.6
    • Update to 15.1.10
    • Update to 15.2.7
    • Update to 15.3.7
    • Update to 15.4.9
    • Update to 15.5.8
    • Update to 15.6.0-canary.59
    • Update to 16.0.9
    • Update to 16.1.0-canary.17
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  8. GHSA-9qr9-h5gf-34mp

    Critical · CVSS 10Fix available

    Next.js is vulnerable to RCE in React flight protocol

    A vulnerability affects certain React packages<sup>1</sup> for versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 and frameworks that use the affected packages, including Next.js 15.x and 16.x using the App Router. The issue is tracked upstream as [CVE-2025-55182](https://www.cve.org/CVERecord?id=CVE-2025-55182). Fixed in: React: 19.0.1, 19.1.2, 19.2.1 Next.js: 15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7, 16.0.7, 15.6.0-canary.58, 16.1.0-canary.12+ The vulnerability also affects experimental canary releases starting with 14.3.0-canary.77. Users on any of the 14.3 canary builds should either downgrade to a 14.x stable release or 14.3.0-canary.7

    next next next next next next nextNode.js
    • Update to 15.0.5
    • Update to 15.1.9
    • Update to 15.2.6
    • Update to 15.3.6
    • Update to 15.4.8
    • Update to 15.5.7
    • Update to 16.0.7
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  9. CVE-2025-57752

    Medium · CVSS 6.2EPSS 0.35%Fix available

    Next.js Affected by Cache Key Confusion for Image Optimization API Routes

    Next.js is a React framework for building full-stack web applications. In versions before 14.2.31 and from 15.0.0 to before 15.4.5, Next.js Image Optimization API routes are affected by cache key confusion. When images returned from API routes vary based on request headers (such as Cookie or Authorization), these responses could be incorrectly cached and served to unauthorized users due to a cache key confusion bug. This vulnerability has been fixed in Next.js versions 14.2.31 and 15.4.5. All users are encouraged to upgrade if they use API routes to serve images that depend on request headers and have image optimization enabled.

    next nextNode.js
    • Update to 14.2.31
    • Update to 15.4.5
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  10. CVE-2025-55173

    Medium · CVSS 4.3EPSS 0.6%Fix available

    Next.js Content Injection Vulnerability for Image Optimization

    Next.js is a React framework for building full-stack web applications. In versions before 14.2.31 and from 15.0.0 to before 15.4.5, Next.js Image Optimization is vulnerable to content injection. The issue allowed attacker-controlled external image sources to trigger file downloads with arbitrary content and filenames under specific configurations. This behavior could be abused for phishing or malicious file delivery. This vulnerability has been fixed in Next.js versions 14.2.31 and 15.4.5.

    next nextNode.js
    • Update to 14.2.31
    • Update to 15.4.5
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  11. CVE-2025-57822

    Medium · CVSS 6.5EPSS 2.58%Public exploitFix available

    Next.js Improper Middleware Redirect Handling Leads to SSRF

    Next.js is a React framework for building full-stack web applications. Prior to versions 14.2.32 and 15.4.7, when next() was used without explicitly passing the request object, it could lead to SSRF in self-hosted applications that incorrectly forwarded user-supplied headers. This vulnerability has been fixed in Next.js versions 14.2.32 and 15.4.7. All users implementing custom middleware logic in self-hosted environments are strongly encouraged to upgrade and verify correct usage of the next() function.

    next nextNode.js
    • Update to 14.2.32
    • Update to 15.4.7
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  12. CVE-2025-49826

    High · CVSS 7.5EPSS 1.13%Fix available

    Next.js DoS vulnerability via cache poisoning

    Next.js is a React framework for building full-stack web applications. From versions 15.0.4-canary.51 to before 15.1.8, a cache poisoning bug leading to a Denial of Service (DoS) condition was found in Next.js. This issue does not impact customers hosted on Vercel. Under certain conditions, this issue may allow a HTTP 204 response to be cached for static pages, leading to the 204 response being served to all users attempting to access the page. This issue has been addressed in version 15.1.8.

    nextNode.js
    • Update to 15.1.8
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  13. CVE-2025-49005

    Low · CVSS 3.7EPSS 0.49%Fix available

    Next.js cache poisoning due to omission of Vary header

    Next.js is a React framework for building full-stack web applications. In Next.js App Router from 15.3.0 to before 15.3.3 and Vercel CLI from 41.4.1 to 42.2.0, a cache poisoning vulnerability was found. The issue allowed page requests for HTML content to return a React Server Component (RSC) payload instead under certain conditions. When deployed to Vercel, this would only impact the browser cache, and would not lead to the CDN being poisoned. When self-hosted and deployed externally, this could lead to cache poisoning if the CDN does not properly distinguish between RSC / HTML in the cache keys. This issue has been resolved in Next.js 15.3.3

    nextNode.js
    • Update to 15.3.3
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  14. CVE-2025-48068

    Low · CVSS 2.3EPSS 0.19%Fix available

    Information exposure in Next.js dev server due to lack of origin verification

    Next.js is a React framework for building full-stack web applications. In versions starting from 13.0 to before 14.2.30 and 15.0.0 to before 15.2.2, Next.js may have allowed limited source code exposure when the dev server was running with the App Router enabled. The vulnerability only affects local development environments and requires the user to visit a malicious webpage while npm run dev is active. This issue has been patched in versions 14.2.30 and 15.2.2.

    next nextNode.js
    • Update to 14.2.30
    • Update to 15.2.2
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  15. CVE-2025-32421

    Low · CVSS 3.7EPSS 0.8%Fix available

    Next.js Race Condition to Cache Poisoning

    Next.js is a React framework for building full-stack web applications. Versions prior to 14.2.24 and 15.1.6 have a race-condition vulnerability. This issue only affects the Pages Router under certain misconfigurations, causing normal endpoints to serve `pageProps` data instead of standard HTML. This issue was patched in versions 15.1.6 and 14.2.24 by stripping the `x-now-route-matches` header from incoming requests. Applications hosted on Vercel's platform are not affected by this issue, as the platform does not cache responses based solely on `200 OK` status without explicit `cache-control` headers. Those who self-host Next.js deployments an

    next nextNode.js
    • Update to 14.2.24
    • Update to 15.1.6
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  16. CVE-2025-30218

    Low · CVSS 1.7EPSS 0.42%Fix available

    Next.js may leak x-middleware-subrequest-id to external hosts

    Next.js is a React framework for building full-stack web applications. To mitigate CVE-2025-29927, Next.js validated the x-middleware-subrequest-id which persisted across multiple incoming requests. However, this subrequest ID is sent to all requests, even if the destination is not the same host as the Next.js application. Initiating a fetch request to a third-party within Middleware will send the x-middleware-subrequest-id to that third party. This vulnerability is fixed in 12.3.6, 13.5.10, 14.2.26, and 15.2.4.

    next next next nextNode.js
    • Update to 12.3.6
    • Update to 13.5.10
    • Update to 14.2.26
    • Update to 15.2.4
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  17. CVE-2025-29927

    Critical · CVSS 9.1EPSS 99.22%Public exploitFix available

    Authorization Bypass in Next.js Middleware

    Next.js is a React framework for building full-stack web applications. Starting in version 1.11.4 and prior to versions 12.3.5, 13.5.9, 14.2.25, and 15.2.3, it is possible to bypass authorization checks within a Next.js application, if the authorization check occurs in middleware. If patching to a safe version is infeasible, it is recommend that you prevent external user requests which contain the x-middleware-subrequest header from reaching your Next.js application. This vulnerability is fixed in 12.3.5, 13.5.9, 14.2.25, and 15.2.3.

    next next next nextNode.js
    • Update to 12.3.5
    • Update to 13.5.9
    • Update to 14.2.25
    • Update to 15.2.3
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  18. CVE-2024-56332

    Medium · CVSS 5.3EPSS 0.8%Fix available

    Next.js Vulnerable to Denial of Service (DoS) with Server Actions

    Next.js is a React framework for building full-stack web applications. Starting in version 13.0.0 and prior to versions 13.5.8, 14.2.21, and 15.1.2, Next.js is vulnerable to a Denial of Service (DoS) attack that allows attackers to construct requests that leaves requests to Server Actions hanging until the hosting provider cancels the function execution. This vulnerability can also be used as a Denial of Wallet (DoW) attack when deployed in providers billing by response times. (Note: Next.js server is idle during that time and only keeps the connection open. CPU and memory footprint are low during that time.). Deployments without any protecti

    next next nextNode.js
    • Update to 13.5.8
    • Update to 14.2.21
    • Update to 15.1.2
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  19. CVE-2024-51479

    High · CVSS 7.5EPSS 4%Fix available

    Authorization bypass in Next.js

    Next.js is a React framework for building full-stack web applications. In affected versions if a Next.js application is performing authorization in middleware based on pathname, it was possible for this authorization to be bypassed for pages directly under the application's root directory. For example: * [Not affected] `https://example.com/` * [Affected] `https://example.com/foo` * [Not affected] `https://example.com/foo/bar`. This issue is patched in Next.js `14.2.15` and later. If your Next.js application is hosted on Vercel, this vulnerability has been automatically mitigated, regardless of Next.js version. There are no official workaround

    nextNode.js
    • Update to 14.2.15
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  20. CVE-2024-47831

    Medium · CVSS 5.9EPSS 0.73%Fix available

    Next.js image optimization has Denial of Service condition

    Next.js is a React Framework for the Web. Cersions on the 10.x, 11.x, 12.x, 13.x, and 14.x branches before version 14.2.7 contain a vulnerability in the image optimization feature which allows for a potential Denial of Service (DoS) condition which could lead to excessive CPU consumption. Neither the `next.config.js` file that is configured with `images.unoptimized` set to `true` or `images.loader` set to a non-default value nor the Next.js application that is hosted on Vercel are affected. This issue was fully patched in Next.js `14.2.7`. As a workaround, ensure that the `next.config.js` file has either `images.unoptimized`, `images.loader`

    nextNode.js
    • Update to 14.2.7
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →