Known vulnerabilities in Next.js 15.5.26

Vendor: vercel
Software: Next.js
Version: 15.5.26
Software CPE: cpe:2.3:a:vercel:nextjs:*:*:*:*:*:*:*:*
Total vulnerabilities: 8
Public exploits: 0
Known exploited (KEV): 0

Vulnerabilities by Severity

Severity distribution of vulnerabilities affecting Next.js version 15.5.26 Next.js 15.5.26 is affected by 8 vulnerabilities: 1 high, 5 medium, 2 low Critical High Medium Low

Vulnerabilities (8)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU159262 - Insertion of Sensitive Information Into Sent Data
CVE-2026-119346
CWE-201 Medium
No
No
1.0.0, 1.0.1, 1.0.2, 1.1.0, 1.1.1, 1.1.2, 1.2.0, 1.2.1, 1.2.2, 1.2.3, 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.3.0, 2.3.1, 2.3.2, 2.4.0, 7.0.0.0, 7.0.1.0, 15.5.29, 16.4.5 04.11.2026 SB2026110471
#VU159257 - Improper input validation
CVE-2026-119347
CWE-20 Medium
No
No
1.0.0, 1.0.1, 1.0.2, 1.1.0, 1.1.1, 1.1.2, 1.2.0, 1.2.1, 1.2.2, 1.2.3, 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.3.0, 2.3.1, 2.3.2, 2.4.0, 7.0.0.0, 7.0.1.0, 15.5.29, 16.4.5 04.11.2026 SB2026110471
#VU159254 - Improper input validation
CVE-2026-119350
CWE-20 Medium
No
No
1.0.0, 1.0.1, 1.0.2, 1.1.0, 1.1.1, 1.1.2, 1.2.0, 1.2.1, 1.2.2, 1.2.3, 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.3.0, 2.3.1, 2.3.2, 2.4.0, 7.0.0.0, 7.0.1.0, 15.5.29, 16.4.5 04.11.2026 SB2026110471
#VU159251 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
CVE-2026-119348
CWE-444 Medium
No
No
1.0.0, 1.0.1, 1.0.2, 1.1.0, 1.1.1, 1.1.2, 1.2.0, 1.2.1, 1.2.2, 1.2.3, 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.3.0, 2.3.1, 2.3.2, 2.4.0, 7.0.0.0, 7.0.1.0, 15.5.29, 16.4.5 04.11.2026 SB2026110471
#VU155802 - Resource exhaustion
CVE-2026-94482
CWE-400 Medium
No
No
15.5.28, 16.4.1 15.10.2026 SB2026101507
#VU155800 - Improper input validation
CVE-2026-96889
CWE-20 High
No
No
15.5.28, 16.4.1 15.10.2026 SB2026101507
SB2026101539
SB2026102171
and 12 more
#VU153127 - Acceptance of Extraneous Untrusted Data With Trusted Data
CVE-2026-94484
CWE-349 Low
No
No
15.5.27, 16.3.8 02.10.2026 SB2026100219
#VU153126 - Improper input validation
CVE-2026-94543
CWE-20 Low
No
No
15.5.27, 16.3.8 02.10.2026 SB2026100219