vulnwire

All · Next.js

Newest first. Every filter here is also a feed: see the subscribe box.

  1. critno cvss
    GHSA-673q-mjm6-r5xrNext.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays
    Next.jsnpm
    15 d ago
  2. critno cvss
    GHSA-2464-fhr4-w9xwNext.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used
    Next.jsnpm
    15 d ago
  3. 8.2high
    CVE-2026-94482Next.js: Denial of Service in App Router using Server Actions
    Next.jsnpm
    15 d ago
  4. 6.1med
    CVE-2026-107369Improper Validation of Post-Login Redirect URL in nextjs-auth0
    Next.js
    24 d ago
  5. 8.8high
    CVE-2026-92931CWE-918: Server-Side Request Forgery in the Progress Sitefinity Next.js Renderer SDK
    Next.js
    32 d ago
  6. 4.8med
    CVE-2026-94484Next.js: Cache poisoning in Next.js SSG/ISR rendering leads to cross-user content substitution and persistent denial of service
    Next.jsnpm
    35 d ago
  7. 5.3med
    CVE-2026-94485Next.js: Information disclosure in Next.js App Router metadata image routes via dynamicParams bypass
    Next.jsnpm
    35 d ago
  8. 6.5med
    CVE-2026-94483Next.js: Server-Side Request Forgery in Image Optimization
    Next.jsnpm
    35 d ago
  9. 5.3med
    CVE-2026-94543Next.js: Cache poisoning of SSG and ISR pages in self-hosted Next.js applications
    Next.jsnpm
    35 d ago
  10. 4.2med
    CVE-2026-94544Next.js: Pending `use cache` fill can leak Draft Mode content into regular responses and persisted pages
    Next.jsnpm
    35 d ago
  11. 5.4med
    CVE-2026-94486Next.js: Information disclosure in the Next.js development server's Model Context Protocol endpoint
    Next.jsnpm
    35 d ago
  12. 5.3med
    CVE-2026-103004next.js cache leak on warm `use cache` handlers accessing root param
    Next.jsnpm
    36 d ago
  13. critno cvss
    GHSA-vcvr-r3jv-pc5jNext.js: Remote Code Execution in next/og ImageResponse
    Next.jsnpm
    37 d ago
  14. 6.3med
    CVE-2026-92781Builder.io Gen2 SDKs through 5.2.11 Prototype Pollution via builder.userAttributes
    Next.js
    51 d ago
  15. 7.6high
    CVE-2026-92779Builder.io Gen2 SDKs through 5.2.11 Prototype Pollution via Bindings
    Next.js
    51 d ago
  16. critno cvss
    GHSA-2xp9-vwfh-vxw4Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used
    Next.jsnpm
    59 d ago
  17. 9.0crit
    CVE-2026-75604Next.js: Unauthenticated Remote Code Execution on windows-hosted servers
    Next.jsnpm
    2 mo ago
  18. 6.5med
    CVE-2026-64649Next.js: Server-Side Request Forgery in Server Actions on Custom Servers
    Next.jsnpm
    3 mo ago
  19. 5.4med
    CVE-2026-64648Next.js: Response Body Cache Confusion for Requests Containing Bodies
    Next.jsnpm
    3 mo ago
  20. 5.4med
    CVE-2026-64647Next.js: Response Body Cache Confusion with Invalid UTF-8 Request Bodies
    Next.jsnpm
    3 mo ago
  21. 5.3med
    CVE-2026-64646Next.js: Unbounded Server Action payload in Edge runtime
    Next.jsnpm
    3 mo ago
  22. 6.1med
    CVE-2026-64645Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname
    Next.jsnpm
    3 mo ago
  23. 5.3med
    CVE-2026-64644Next.js: Denial of Service in the Image Optimization API using SVGs
    Next.jsnpm
    3 mo ago
  24. 5.3med
    CVE-2026-64643Next.js: Unauthenticated Disclosure of Internal Server Function endpoints
    Next.jsnpm
    3 mo ago
  25. 8.2high
    CVE-2026-64642Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale
    Next.jsnpm
    3 mo ago
  26. 7.5high
    CVE-2026-64641Next.js: Denial of Service in App Router using Server Actions
    Next.jsnpm
    3 mo ago
  27. 7.5high
    CVE-2026-45109Next.js: Middleware / Proxy bypass in App Router applications via segment-prefetch routes
    Next.jsnpm
    5 mo ago
  28. 3.7low
    CVE-2026-44572Next.js: Middleware / Proxy redirects can be cache-poisoned
    Next.jsnpm
    5 mo ago
  29. 4.7med
    CVE-2026-44581Next.js: Cross-site scripting in App Router applications using CSP nonces
    Next.jsnpm
    5 mo ago
  30. 3.7low
    CVE-2026-44582Next.js: Cache poisoning via collisions in React Server Component cache-busting
    Next.jsnpm
    5 mo ago