Known vulnerabilities in Next.js

Vendor: vercel
Software: Next.js
Software CPE: cpe:2.3:a:vercel:nextjs:*:*:*:*:*:*:*:*
Total vulnerabilities: 67
Public exploits: 9
Known exploited (KEV): 3
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Next.js Next.js is affected by 67 known vulnerabilities: 1 critical, 9 high, 44 medium, 13 low Critical High Medium Low

Vulnerabilities (67)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU151855 - Improper input validation
CVE-2026-94545
CWE-20 High
No
No
16.3.6 23.09.2026 SB2026092349
#VU145734 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2026-75604
CWE-22 High
Available
Exploited
15.5.24, 16.3.3 26.08.2026 SB2026082633
#VU145733 - Memory corruption
CWE-119 High
No
No
15.5.24, 16.3.3 26.08.2026 SB2026082633
#VU139036 - Insertion of Sensitive Information Into Sent Data
CVE-2026-64643
CWE-201 Medium
No
No
16.2.11 22.07.2026 SB2026072202
SB2026092109
#VU139035 - Resource exhaustion
CVE-2026-64644
CWE-400 Medium
No
No
15.5.21, 16.2.11 22.07.2026 SB2026072202
#VU139034 - Improper Encoding or Escaping of Output
CVE-2026-64647
CWE-116 Medium
No
No
15.5.21, 16.2.11 22.07.2026 SB2026072202
#VU139033 - Excessive Iteration
CVE-2026-64641
CWE-834 Medium
No
No
15.5.21, 16.2.11 22.07.2026 SB2026072202
SB2026092109
#VU139032 - Improper Authorization
CVE-2026-64642
CWE-285 High
No
No
16.2.11 22.07.2026 SB2026072202
#VU139031 - Use of Cache Containing Sensitive Information
CVE-2026-64648
CWE-524 Medium
No
No
15.5.21, 16.2.11 22.07.2026 SB2026072202
#VU139030 - Server-Side Request Forgery (SSRF)
CVE-2026-64649
CWE-918 High
No
No
15.5.21, 16.2.11 22.07.2026 SB2026072202
#VU139029 - Allocation of Resources Without Limits or Throttling
CVE-2026-64646
CWE-770 Medium
No
No
15.5.21, 16.2.11 22.07.2026 SB2026072202
#VU139028 - Server-Side Request Forgery (SSRF)
CVE-2026-64645
CWE-918 High
No
No
15.5.21, 16.2.11 22.07.2026 SB2026072202
SB2026092109
#VU130998 - Authentication Bypass Using an Alternate Path or Channel
CVE-2026-45109
CWE-288 Medium
No
No
15.5.18, 16.2.6 11.05.2026 SB2026051193
SB2026082104
#VU130280 - Interpretation Conflict
CVE-2026-44576
CWE-436 Medium
No
No
15.5.16, 16.2.5 06.05.2026 SB2026050696
SB2026082104
SB2026092109
#VU130276 - Resource exhaustion
CVE-2026-44579
CWE-400 Medium
No
No
15.5.16, 16.2.5 06.05.2026 SB2026050696
SB2026082104
#VU130275 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-44580
CWE-79 Medium
No
No
15.5.16, 16.2.5 06.05.2026 SB2026050696
SB2026082104
SB2026092109
#VU130274 - Use of Weak Hash
CVE-2026-44582
CWE-328 Low
No
No
15.5.16, 16.2.5 06.05.2026 SB2026050696
SB2026082104
SB2026092109
#VU130273 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-44581
CWE-79 Medium
No
No
15.5.16, 16.2.5 06.05.2026 SB2026050696
SB2026082104
SB2026092109
#VU130272 - Authentication Bypass Using an Alternate Path or Channel
CVE-2026-44575
CWE-288 Medium
No
No
15.5.16, 16.2.5 06.05.2026 SB2026050696
SB2026082104
#VU130269 - Allocation of Resources Without Limits or Throttling
CVE-2026-23870
CWE-770 Medium
No
No
15.5.16, 16.2.5 06.05.2026 SB2026050691
SB2026050696


Showing elements 1 - 20 out of 67