# Vercel Next.js


- [CVE-2025-55182](https://insights.sbomify.com/CVE-2025-55182/): Meta React Server Components Remote Code Execution (critical 10.0, exploited in the wild)
- [CVE-2025-29927](https://insights.sbomify.com/CVE-2025-29927/): Authorization Bypass in Next.js Middleware (critical 9.1)
- [CVE-2026-44578](https://insights.sbomify.com/CVE-2026-44578/): Next.js: Server-side request forgery in applications using WebSocket upgrades (high 8.6)
- [CVE-2026-94483](https://insights.sbomify.com/CVE-2026-94483/): Next.js: Server-Side Request Forgery in Image Optimization (high 8.3)
- [CVE-2026-64642](https://insights.sbomify.com/CVE-2026-64642/): Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale (high 8.3)
- [CVE-2026-64645](https://insights.sbomify.com/CVE-2026-64645/): Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname (high 8.3)
- [CVE-2026-64649](https://insights.sbomify.com/CVE-2026-64649/): Next.js: Server-Side Request Forgery in Server Actions on Custom Servers (high 8.3)
- [CVE-2026-64641](https://insights.sbomify.com/CVE-2026-64641/): Next.js: Denial of Service in App Router using Server Actions (high 8.2)
- [CVE-2026-44574](https://insights.sbomify.com/CVE-2026-44574/): Next.js: Middleware / Proxy bypass through dynamic route parameter injection (high 8.1)
- [CVE-2026-44573](https://insights.sbomify.com/CVE-2026-44573/): Next.js: Middleware / Proxy bypass in Pages Router applications using i18n (high 7.5)
- [CVE-2026-44575](https://insights.sbomify.com/CVE-2026-44575/): Next.js: Middleware / Proxy bypass in App Router applications via segment-prefetch routes (high 7.5)
- [CVE-2026-44579](https://insights.sbomify.com/CVE-2026-44579/): Next.js: Denial of Service via connection exhaustion in applications using Cache Components (high 7.5)

---
From sbomify Insights: https://insights.sbomify.com/products/vercel/next.js/