Known vulnerabilities in Next.js - page 3

Vendor: vercel
Software: Next.js
Software CPE: cpe:2.3:a:vercel:nextjs:*:*:*:*:*:*:*:*
Total vulnerabilities: 64
Public exploits: 8
Known exploited (KEV): 2
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Next.js Next.js is affected by 64 known vulnerabilities: 1 critical, 6 high, 44 medium, 13 low Critical High Medium Low

Vulnerabilities (64)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU109922 - Missing Origin Validation in WebSockets
CVE-2025-48068
CWE-1385 Low
No
No
15.2.2 29.05.2025 SB2025052970
SB2025122227
SB2026010925
and 4 more
#VU109239 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVE-2025-32421
CWE-362 Low
Available
No
14.2.24, 15.1.6 16.05.2025 SB2025051603
SB2026030306
SB2026031635
#VU106922 - Exposure of sensitive information to an unauthorized actor
CVE-2025-30218
CWE-200 Low
No
No
12.3.6, 13.5.10, 14.2.26, 15.2.4 03.04.2025 SB2025040314
SB2026010925
#VU105939 - Improper Authorization
CVE-2025-29927
CWE-285 High
Available
Exploited
13.5.9, 14.2.25, 15.2.3 21.03.2025 SB2025032132
SB2025052304
SB2025061612
and 5 more
#VU105892 - Resource exhaustion
CVE-2023-46298
CWE-400 High
No
No
13.4.20.13 20.03.2025 SB2025032022
SB2025072303
#VU103116 - Improper Authorization
CVE-2024-51479
CWE-285 Medium
No
No
14.2.15 21.01.2025 SB2025012133
SB2025060972
SB2026030306
and 1 more
#VU103115 - Resource Management Errors
CVE-2024-56332
CWE-399 Medium
No
No
13.5.8, 14.2.21, 15.1.2 21.01.2025 SB2025012132
SB2025060529
SB2025060970
and 1 more
#VU98500 - Resource exhaustion
CVE-2024-47831
CWE-400 Medium
No
No
14.2.7 14.10.2024 SB2024101466
SB2024112517
SB2024112818
and 2 more
#VU97476 - Acceptance of Extraneous Untrusted Data With Trusted Data
CVE-2024-46982
CWE-349 Medium
Available
No
13.5.7, 14.2.10 18.09.2024 SB2024091832
SB2024110841
SB2024112517
#VU94100 - Improper input validation
CVE-2024-39693
CWE-20 Medium
No
No
13.5.0 11.07.2024 SB2024071113
#VU94099 - Improper input validation
CVE-2022-21721
CWE-20 Medium
No
No
12.0.9 11.07.2024 SB2022012821
#VU89342 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
CVE-2024-34350
CWE-444 Medium
No
No
13.5.1 10.05.2024 SB2024051025
#VU89341 - Server-Side Request Forgery (SSRF)
CVE-2024-34351
CWE-918 Medium
Available
No
14.1.1 10.05.2024 SB2024051026
SB2024072607
SB2024112517
#VU80774 - URL Redirection to Untrusted Site ('Open Redirect')
CVE-2021-37699
CWE-601 Low
No
No
11.1.0 14.09.2023 SB2023091411
SB2021081127
#VU77519 - User Interface (UI) Misrepresentation of Critical Information (Clickjacking, spoofing)
CVE-2022-23646
CWE-451 Medium
No
No
12.1.0 19.06.2023 SB2023061930
SB2022021744
#VU77518 - Resource exhaustion
CVE-2021-43803
CWE-400 Medium
No
No
11.1.3, 12.0.5 19.06.2023 SB2023061930
SB2023091411
SB2021120643
and 1 more
#VU77517 - Improper Check for Unusual or Exceptional Conditions
CVE-2022-36046
CWE-754 Low
No
No
12.2.4 19.06.2023 SB2023061930
SB2024021505
SB2022082450
#VU56234 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2021-39178
CWE-79 Low
No
No
11.1.1 01.09.2021 SB2021090111
#VU47483 - URL Redirection to Untrusted Site ('Open Redirect')
CVE-2020-15242
CWE-601 Low
No
No
9.5.4 08.10.2020 SB2020100904
#VU26476 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2020-5284
CWE-22 Medium
No
No
9.3.2 31.03.2020 SB2020033113


Showing elements 41 - 60 out of 64