Known vulnerabilities in Next.js - page 2

Vendor: vercel
Software: Next.js
Software CPE: cpe:2.3:a:vercel:nextjs:*:*:*:*:*:*:*:*
Total vulnerabilities: 64
Public exploits: 8
Known exploited (KEV): 2
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Next.js Next.js is affected by 64 known vulnerabilities: 1 critical, 6 high, 44 medium, 13 low Critical High Medium Low

Vulnerabilities (64)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU130282 - Acceptance of Extraneous Untrusted Data With Trusted Data
CVE-2026-44572
CWE-349 Low
No
No
15.5.16, 16.2.5 06.05.2026 SB2026050696
#VU130281 - Improper Access Control
CVE-2026-44573
CWE-284 Medium
No
No
15.5.16, 16.2.5 06.05.2026 SB2026050696
#VU125546 - Allocation of Resources Without Limits or Throttling
CVE-2026-23869
CWE-770 Medium
Available
No
15.5.15, 16.2.3 09.04.2026 SB2026040920
SB2026040958
#VU124061 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
CVE-2026-29057
CWE-444 Medium
No
No
15.5.13, 16.1.7 17.03.2026 SB2026031727
#VU124060 - Resource Management Errors
CVE-2026-27979
CWE-399 Medium
No
No
16.1.7 17.03.2026 SB2026031727
#VU124059 - Missing Origin Validation in WebSockets
CVE-2026-27977
CWE-1385 Low
No
No
16.1.7 17.03.2026 SB2026031727
#VU124058 - Cross-Site Request Forgery (CSRF)
CVE-2026-27978
CWE-352 Low
No
No
16.1.7 17.03.2026 SB2026031727
#VU124057 - Resource exhaustion
CVE-2026-27980
CWE-400 Medium
No
No
15.5.13, 16.1.7 17.03.2026 SB2026031727
#VU122050 - Resource exhaustion
CVE-2025-59472
CWE-400 Medium
No
No
16.1.5 26.01.2026 SB2026012662
#VU122049 - Resource exhaustion
CVE-2025-59471
CWE-400 Medium
No
No
15.5.10, 16.1.5 26.01.2026 SB2026012662
#VU122048 - Resource exhaustion
CVE-2026-23864
CWE-400 Medium
No
No
15.0.8, 15.1.12, 15.2.9, 15.3.9, 15.4.11, 15.5.10, 16.0.11, 16.1.5 26.01.2026 SB2026012660
SB2026012703
#VU119893 - Deserialization of Untrusted Data
CVE-2025-67779
CWE-502 Medium
No
No
14.2.35, 15.0.7, 15.1.11, 15.2.8, 15.3.8, 15.4.10, 15.5.9, 16.0.10 12.12.2025 SB2025121219
SB2025121222
SB2025122225
and 2 more
#VU119891 - Deserialization of Untrusted Data
CVE-2025-55184
CWE-502 Medium
Available
No
14.2.34, 15.0.6, 15.1.10, 15.2.7, 15.3.7, 15.4.9, 15.5.8, 16.0.9 12.12.2025 SB2025121219
SB2025121220
SB2025122225
and 2 more
#VU119890 - Exposure of sensitive information to an unauthorized actor
CVE-2025-55183
CWE-200 Medium
Available
No
15.0.6, 15.1.10, 15.2.7, 15.3.7, 15.4.9, 15.5.8, 16.0.9 12.12.2025 SB2025121219
SB2025121221
SB2025122225
and 2 more
#VU119104 - Deserialization of Untrusted Data
CVE-2025-66478
CWE-502 Critical
Available
Exploited
15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7, 16.0.7 03.12.2025 SB2025120334
#VU114574 - Use of Cache Containing Sensitive Information
CVE-2025-57752
CWE-524 Medium
No
No
14.2.31, 15.4.5 30.08.2025 SB2025083005
SB2025101766
SB2025120245
and 7 more
#VU114573 - Improper input validation
CVE-2025-55173
CWE-20 Low
No
No
14.2.31, 15.4.5 30.08.2025 SB2025083004
SB2025101766
SB2025120245
and 7 more
#VU114571 - Server-Side Request Forgery (SSRF)
CVE-2025-57822
CWE-918 Medium
No
No
14.2.32, 15.4.7 30.08.2025 SB2025083002
SB2025101766
SB2025120303
and 5 more
#VU112181 - Improper input validation
CVE-2025-49826
CWE-20 Medium
No
No
15.1.8 04.07.2025 SB2025070419
#VU112179 - Improper input validation
CVE-2025-49005
CWE-20 Medium
No
No
15.3.3 04.07.2025 SB2025070417


Showing elements 21 - 40 out of 64