Vercel Next.js vulnerabilities
63 published vulnerabilities in Vercel Next.js, 1 of them exploited in the wild. The most were published in 2026 (33), and 33 so far in 2026.
Vercel Next.js vulnerabilities by year
2020
2021
2022
2023
2024
2025
2026
Most exploited Vercel Next.js vulnerabilities
- CVE-2025-55182 Meta React Server Components Remote Code Execution
- CVE-2025-29927 Authorization Bypass in Next.js Middleware
- CVE-2026-44578 Next.js: Server-side request forgery in applications using WebSocket upgrades
- CVE-2026-94483 Next.js: Server-Side Request Forgery in Image Optimization
- CVE-2026-64642 Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale
- CVE-2026-64645 Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname
- CVE-2026-64649 Next.js: Server-Side Request Forgery in Server Actions on Custom Servers
- CVE-2026-64641 Next.js: Denial of Service in App Router using Server Actions
- CVE-2026-44574 Next.js: Middleware / Proxy bypass through dynamic route parameter injection
- CVE-2026-44573 Next.js: Middleware / Proxy bypass in Pages Router applications using i18n
- CVE-2026-44575 Next.js: Middleware / Proxy bypass in App Router applications via segment-prefetch routes
- CVE-2026-44579 Next.js: Denial of Service via connection exhaustion in applications using Cache Components
Find these in your own software.
Upload an SBOM and sbomify checks it against every vulnerability here, every day.