Known vulnerabilities in Next.js 15.5.19

Vendor: vercel
Software: Next.js
Version: 15.5.19
Software CPE: cpe:2.3:a:vercel:nextjs:*:*:*:*:*:*:*:*
Total vulnerabilities: 8
Public exploits: 0
Known exploited (KEV): 0
Highest CVSSv4 Score: 8.8

Vulnerabilities by Severity

Severity distribution of vulnerabilities affecting Next.js version 15.5.19 Next.js 15.5.19 is affected by 8 vulnerabilities: 2 high, 6 medium Critical High Medium Low

Vulnerabilities (8)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU139036 - Insertion of Sensitive Information Into Sent Data
CVE-2026-64643
CWE-201 Medium
No
No
16.2.11 22.07.2026 SB2026072202
#VU139035 - Resource exhaustion
CVE-2026-64644
CWE-400 Medium
No
No
15.5.21, 16.2.11 22.07.2026 SB2026072202
#VU139034 - Improper Encoding or Escaping of Output
CVE-2026-64647
CWE-116 Medium
No
No
15.5.21, 16.2.11 22.07.2026 SB2026072202
#VU139033 - Excessive Iteration
CVE-2026-64641
CWE-834 Medium
No
No
15.5.21, 16.2.11 22.07.2026 SB2026072202
#VU139031 - Use of Cache Containing Sensitive Information
CVE-2026-64648
CWE-524 Medium
No
No
15.5.21, 16.2.11 22.07.2026 SB2026072202
#VU139030 - Server-Side Request Forgery (SSRF)
CVE-2026-64649
CWE-918 High
No
No
15.5.21, 16.2.11 22.07.2026 SB2026072202
#VU139029 - Allocation of Resources Without Limits or Throttling
CVE-2026-64646
CWE-770 Medium
No
No
15.5.21, 16.2.11 22.07.2026 SB2026072202
#VU139028 - Server-Side Request Forgery (SSRF)
CVE-2026-64645
CWE-918 High
No
No
15.5.21, 16.2.11 22.07.2026 SB2026072202