Known vulnerabilities in Next.js 16.4.0

Vendor: vercel
Software: Next.js
Version: 16.4.0
Software CPE: cpe:2.3:a:vercel:nextjs:*:*:*:*:*:*:*:*
Total vulnerabilities: 9
Public exploits: 0
Known exploited (KEV): 0

Vulnerabilities by Severity

Severity distribution of vulnerabilities affecting Next.js version 16.4.0 Next.js 16.4.0 is affected by 9 vulnerabilities: 2 high, 6 medium, 1 low Critical High Medium Low

Vulnerabilities (9)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU159262 - Insertion of Sensitive Information Into Sent Data
CVE-2026-119346
CWE-201 Medium
No
No
1.0.0, 1.0.1, 1.0.2, 1.1.0, 1.1.1, 1.1.2, 1.2.0, 1.2.1, 1.2.2, 1.2.3, 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.3.0, 2.3.1, 2.3.2, 2.4.0, 7.0.0.0, 7.0.1.0, 15.5.29, 16.4.5 04.11.2026 SB2026110471
#VU159260 - Use of Cache Containing Sensitive Information
CVE-2026-119351
CWE-524 Low
No
No
16.4.2 04.11.2026 SB2026110474
#VU159257 - Improper input validation
CVE-2026-119347
CWE-20 Medium
No
No
1.0.0, 1.0.1, 1.0.2, 1.1.0, 1.1.1, 1.1.2, 1.2.0, 1.2.1, 1.2.2, 1.2.3, 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.3.0, 2.3.1, 2.3.2, 2.4.0, 7.0.0.0, 7.0.1.0, 15.5.29, 16.4.5 04.11.2026 SB2026110471
#VU159254 - Improper input validation
CVE-2026-119350
CWE-20 Medium
No
No
1.0.0, 1.0.1, 1.0.2, 1.1.0, 1.1.1, 1.1.2, 1.2.0, 1.2.1, 1.2.2, 1.2.3, 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.3.0, 2.3.1, 2.3.2, 2.4.0, 7.0.0.0, 7.0.1.0, 15.5.29, 16.4.5 04.11.2026 SB2026110471
#VU159253 - Use of Cache Containing Sensitive Information
CVE-2026-119349
CWE-524 Medium
No
No
1.0.0, 1.0.1, 1.0.2, 1.1.0, 1.1.1, 1.1.2, 1.2.0, 1.2.1, 1.2.2, 1.2.3, 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.3.0, 2.3.1, 2.3.2, 2.4.0, 7.0.0.0, 7.0.1.0, 15.5.29, 16.4.5 04.11.2026 SB2026110471
#VU159251 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
CVE-2026-119348
CWE-444 Medium
No
No
1.0.0, 1.0.1, 1.0.2, 1.1.0, 1.1.1, 1.1.2, 1.2.0, 1.2.1, 1.2.2, 1.2.3, 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.3.0, 2.3.1, 2.3.2, 2.4.0, 7.0.0.0, 7.0.1.0, 15.5.29, 16.4.5 04.11.2026 SB2026110471
#VU155802 - Resource exhaustion
CVE-2026-94482
CWE-400 Medium
No
No
15.5.28, 16.4.1 15.10.2026 SB2026101507
#VU155801 - Improper input validation
CWE-20 High
No
No
16.4.1 15.10.2026 SB2026101507
#VU155800 - Improper input validation
CVE-2026-96889
CWE-20 High
No
No
15.5.28, 16.4.1 15.10.2026 SB2026101507
SB2026101539
SB2026102171
and 12 more