Known vulnerabilities in Next.js

Vendor: vercel
Software: Next.js
Software CPE: cpe:2.3:a:vercel:nextjs:*:*:*:*:*:*:*:*
Total vulnerabilities: 64
Public exploits: 8
Known exploited (KEV): 2
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Next.js Next.js is affected by 64 known vulnerabilities: 1 critical, 6 high, 44 medium, 13 low Critical High Medium Low

Vulnerabilities (64)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU139036 - Insertion of Sensitive Information Into Sent Data
CVE-2026-64643
CWE-201 Medium
No
No
16.2.11 22.07.2026 SB2026072202
#VU139035 - Resource exhaustion
CVE-2026-64644
CWE-400 Medium
No
No
15.5.21, 16.2.11 22.07.2026 SB2026072202
#VU139034 - Improper Encoding or Escaping of Output
CVE-2026-64647
CWE-116 Medium
No
No
15.5.21, 16.2.11 22.07.2026 SB2026072202
#VU139033 - Excessive Iteration
CVE-2026-64641
CWE-834 Medium
No
No
15.5.21, 16.2.11 22.07.2026 SB2026072202
#VU139032 - Improper Authorization
CVE-2026-64642
CWE-285 High
No
No
16.2.11 22.07.2026 SB2026072202
#VU139031 - Use of Cache Containing Sensitive Information
CVE-2026-64648
CWE-524 Medium
No
No
15.5.21, 16.2.11 22.07.2026 SB2026072202
#VU139030 - Server-Side Request Forgery (SSRF)
CVE-2026-64649
CWE-918 High
No
No
15.5.21, 16.2.11 22.07.2026 SB2026072202
#VU139029 - Allocation of Resources Without Limits or Throttling
CVE-2026-64646
CWE-770 Medium
No
No
15.5.21, 16.2.11 22.07.2026 SB2026072202
#VU139028 - Server-Side Request Forgery (SSRF)
CVE-2026-64645
CWE-918 High
No
No
15.5.21, 16.2.11 22.07.2026 SB2026072202
#VU130998 - Authentication Bypass Using an Alternate Path or Channel
CVE-2026-45109
CWE-288 Medium
No
No
15.5.18, 16.2.6 11.05.2026 SB2026051193
#VU130280 - Interpretation Conflict
CVE-2026-44576
CWE-436 Medium
No
No
15.5.16, 16.2.5 06.05.2026 SB2026050696
#VU130279 - Improper Access Control
CVE-2026-44578
CWE-284 High
No
No
15.5.16, 16.2.5 06.05.2026 SB2026050696
#VU130278 - Allocation of Resources Without Limits or Throttling
CVE-2026-44577
CWE-770 Medium
No
No
15.5.16, 16.2.5 06.05.2026 SB2026050696
#VU130277 - Authentication Bypass Using an Alternate Path or Channel
CVE-2026-44574
CWE-288 Medium
No
No
15.5.16, 16.2.5 06.05.2026 SB2026050696
#VU130276 - Resource exhaustion
CVE-2026-44579
CWE-400 Medium
No
No
15.5.16, 16.2.5 06.05.2026 SB2026050696
#VU130275 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-44580
CWE-79 Medium
No
No
15.5.16, 16.2.5 06.05.2026 SB2026050696
#VU130274 - Use of Weak Hash
CVE-2026-44582
CWE-328 Low
No
No
15.5.16, 16.2.5 06.05.2026 SB2026050696
#VU130273 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-44581
CWE-79 Medium
No
No
15.5.16, 16.2.5 06.05.2026 SB2026050696
#VU130272 - Authentication Bypass Using an Alternate Path or Channel
CVE-2026-44575
CWE-288 Medium
No
No
15.5.16, 16.2.5 06.05.2026 SB2026050696
#VU130269 - Allocation of Resources Without Limits or Throttling
CVE-2026-23870
CWE-770 Medium
No
No
15.5.16, 16.2.5 06.05.2026 SB2026050691
SB2026050696


Showing elements 1 - 20 out of 64