Next Js
Monthly
Crafted HTTP requests sent to Next.js App Router applications that define at least one Server Action can drive excessive CPU consumption and block processing of further requests in the same Node.js process, producing a denial of service rated 8.2 (CWE-770, uncontrolled resource allocation). The affected ranges are 13.0.0 through 15.5.27 and 16.0.0 through 16.4.0; applications on the Pages Router, and App Router applications with no Server Actions defined, are explicitly not vulnerable, which substantially narrows the exposed population. Exploitation requires no authentication and no user interaction, and no public exploit code has been identified at time of analysis, with no CISA KEV entry and no EPSS signal supplied; the vendor states that upgrading to 15.5.28 or 16.4.1 is the only complete fix, with no workaround available.
Server-side request forgery in the Next.js Image Optimization endpoint lets a remote, unauthenticated attacker cause the server to fetch images from private or internal IP addresses, but only in applications that have configured images.remotePatterns. Affected releases are Next.js 16.0.0 through 16.3.7; the flaw is fixed in 16.3.8 by pinning the outbound connection to the DNS addresses that were already validated against the allow-list. Exploitation is not deterministic - the attacker must win a timing race between the allow-list check and the socket's own DNS lookup (DNS rebinding), consistent with the high attack-complexity rating - and no public exploit code has been identified at time of analysis (EPSS/KEV signals were not provided).
Path traversal in Next.js (13.4.0 through 15.5.23 and 16.x before 16.3.3) running on Windows-hosted servers lets a remote unauthenticated attacker escape the incremental-cache root and read private build artifacts, most critically the server-reference-manifest encryption key, which can be leveraged for remote code execution in the application. The flaw stems from route segments not escaping backslashes before cache-path construction, so encoded Windows path separators (e.g. %5c) bypass the sanitizer. Publicly available exploit code exists in the form of the e2e regression test shipped with the fix; no CISA KEV listing or EPSS score was provided.
React Server Components in React 19.x contain a critical pre-authentication remote code execution vulnerability (CVE-2025-55182, CVSS 10.0) through unsafe deserialization of HTTP request payloads. With EPSS 71.1% and KEV listing, this vulnerability affects any application using React Server Components with react-server-dom-webpack, react-server-dom-turbopack, or react-server-dom-parcel — enabling complete server compromise through a single HTTP request.
Next.js versions 15.0.0 through 15.5.26 and 16.0.0 through 16.3.7 can be coerced into poisoning a shared response cache entry, allowing cross-user content substitution or a persistent denial of service until the poisoned entry is revalidated. The flaw only manifests in applications that combine a root-level catch-all page (for example a top-level [[...slug]] route) with statically generated or Incremental Static Regeneration routes, where the response cache key is not scoped tightly enough to the source route; a single unauthenticated crafted request can collide on that key. Exploitation is real but narrow and gated by high attack complexity and an attack prerequisite (CVSS:3.1/AV:N/AC:H/PR:N/UI:N), so this is assessed as a genuine but moderate-priority issue rather than an emergency; no public exploit code or confirmed active exploitation has been identified at time of analysis. An independent assessment rates impact as low integrity and low availability with scope change (S:C/I:L/A:L), and the supplier CVSS 4.0 vector scores 6.3.
The `next dev` development server in Next.js 16.0.0 through 16.3.7 improperly restricts cross-site requests to its Model Context Protocol (MCP) endpoint at `/_next/mcp`, allowing a malicious website visited by a developer to read sensitive local project data including disk paths, source code snippets from error reports, route inventories, and development logs. The vulnerability is limited to development environments - production deployments do not serve this endpoint - and exploitation requires an active `next dev` session plus the developer navigating to attacker-controlled content (CVSS 4.0 AT:P prerequisite). Unauthenticated (PR:N) but requiring user interaction; no public exploit identified at time of analysis. CVSS 4.0 base score 6.3 (Medium), fixed in Next.js 16.3.8.
Response-cache confusion in self-hosted Next.js (15.0.0 up to but not including 15.5.27, and 16.x up to but not including 16.3.8) lets an unauthenticated remote request key a cached Pages Router response without sufficiently binding it to the originating source route, so one page's cache entry can be overwritten with content from a different route and every subsequent visitor to the affected page is served the wrong content until the entry revalidates. Scope is narrow: only self-hosted apps using the Pages Router with statically generated (SSG) or Incremental Static Regeneration (ISR) pages are exposed - applications deployed on Vercel are explicitly not affected, and App Router-only or uncached/dynamic setups are out of scope. The assessed vector (AV:N/AC:H, PR:N, UI:N, integrity-only impact) and the fact that no public exploit code has been identified at time of analysis keep this a moderate-severity correctness/integrity problem rather than an urgent one; vendor patches are available as 15.5.27 and 16.3.8.
Unpublished draft content can leak to unauthenticated visitors of Next.js sites running versions 16.3.0 through 16.3.7 when Cache Components or the experimental.useCache flag is enabled: pending 'use cache' fills for the same key are shared without isolating Draft Mode requests from regular ones, so an overlapping regular request can be served an editor's unpublished content, and that draft-dependent content can then persist in a prerendered page until revalidation. Exploitation is a narrow timing race that additionally requires an editor to be concurrently using Draft Mode for the same cache key, which is reflected in the high attack-complexity rating (CVSS 4.0 base 6.3, AV:N/AC:H/AT:P/PR:N/UI:N/VC:L); there is no public exploit identified at time of analysis and no evidence of active exploitation. The issue is fixed in Next.js 16.3.8.
Cross-site request validation weakness in the Next.js `next dev` development server (versions 16.0.0 through 16.3.7) allows a malicious website, when visited by a developer who is simultaneously running the dev server, to reach the Model Context Protocol endpoint at /_next/mcp and read development-only metadata: the project's disk location, source-code snippets embedded in error reports, the application's route inventory, and development logs. The CVSS 4.0 score is only 2.3 (assessed as CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N by our review) because exploitation requires the victim to actively run the affected dev server and browse to an attacker-controlled page during that session, and because the impact is limited to read-only disclosure with no code execution or data modification. Production and built deployments do not serve this endpoint at all, so only developer workstations during active local development are exposed; no public exploit code was identified at time of analysis and the issue is not known to be actively exploited. A vendor-released patch is available in Next.js 16.3.8.
Information disclosure in Next.js 16.3.0 through 16.3.7 is a modest-severity cache-correctness flaw that can serve cached content for one root-param value to requests for a different root-param value when the opt-in Cache Components feature is enabled, allowing remote unauthenticated requests to receive content intended for another tenant, locale, or region. The flaw requires nested use cache functions where an inner function reads next/root-params; the leaked content is not attacker-controlled and depends on which invocation first populates the shared cache entry. Vendor-released patch: 16.3.8; no public exploit identified at time of analysis.
Permissive Cross-domain Security Policy with Untrusted Domains vulnerability in Drupal Next.Js allows Cross-Site Scripting (XSS).This issue affects Next.Js: from 0.0.0 before 1.6.4, from 2.0.0 before 2.0.1. [CVSS 6.1 MEDIUM]
Unsafe deserialization in React Server Components Server Function endpoints allows remote unauthenticated attackers to trigger an infinite loop that hangs the server process and can prevent subsequent HTTP requests from being served. The flaw affects React 19.0.2, 19.1.3, and 19.2.2 - including Next.js applications on Node.js that expose Server Functions (Server Actions) - and it represents an incomplete fix for CVE-2025-55184. EPSS is 19.99% (97th percentile), and no public exploit identified at time of analysis; CISA KEV does not list it as confirmed actively exploited.
Pre-authentication denial of service in React Server Components (versions 19.0.0 through 19.2.1) allows unauthenticated remote attackers to hang the server process by sending specially crafted payloads to Server Function endpoints, causing an infinite loop that prevents further HTTP requests from being served. This affects applications using the react-server-dom-parcel, react-server-dom-turbopack, or react-server-dom-webpack packages, commonly seen in Next.js App Router deployments. Publicly available exploit code exists (e.g., GitHub repository referenced), and the EPSS score is 66.88% (99th percentile), indicating a high likelihood of exploitation; however, there is no confirmation of active exploitation in CISA KEV.
Information disclosure in React Server Components 19.x, distributed as react-server-dom-webpack, react-server-dom-turbopack and react-server-dom-parcel, lets remote unauthenticated attackers retrieve the source code of a Server Function with a single crafted HTTP request and no user interaction. The flaw is not universal: it requires the application to define a Server Function that explicitly or implicitly exposes a stringified argument, and its impact is limited to source-code disclosure, with no code execution, data modification or availability effect (CVSS 5.3, C:L with I:N/A:N). Exploitation priority is driven by the intelligence picture rather than the score itself - publicly available exploit code exists and EPSS stands at 64.23% (99th percentile) - while there is no confirmed active exploitation (CISA KEV) at time of analysis.
Server-side request forgery in Vercel Next.js affects self-hosted deployments whose custom middleware calls next()/NextResponse.next() without explicitly passing the request object and forwards user-controlled headers into the response. An unauthenticated remote attacker can supply crafted headers, notably a Location header with a non-redirect status, causing affected middleware routing to treat it as a redirect/rewrite and make server-side requests to attacker-chosen destinations, with high confidentiality and limited integrity impact. Public exploit code exists and EPSS is 5.63% (90th percentile), but CISA KEV does not list it; exploitation is conditional on the non-default middleware pattern, and fixes are available in 14.2.32 and 15.4.7.
Next.js is a React framework for building full-stack web applications. Rated medium severity (CVSS 6.2), this vulnerability is no authentication required, low attack complexity.
Next.js is a React framework for building full-stack web applications. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Next.js is a React framework for building full-stack web applications. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Next.js is a React Framework for the Web. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Next.js is a React framework for building full-stack web applications. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Next.js is a React framework. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Next.js is a React framework that can provide building blocks to create web applications. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Server-Side Request Forgery (SSRF) vulnerability could allow attackers to make the server perform requests to unintended internal or external resources.
Next.js is a React framework that can provide building blocks to create web applications. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Next.js before 13.4.20-canary.13 lacks a cache-control header and thus empty prefetch responses may sometimes be cached by a CDN, causing a denial of service to all users requesting the same URL via. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Next.js is a React framework that can provide building blocks to create web applications. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable. No vendor patch available.
Next.js is a React framework. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Next.js is a React framework. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Next.js is a React framework. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Next.js is an open source website development framework to be used with the React library. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Next.js versions >=9.5.0 and <9.5.4 are vulnerable to an Open Redirect. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Next.js versions before 9.3.2 have a directory traversal vulnerability. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Next.js 7.0.0 and 7.0.1 has XSS via the 404 or 500 /_error page. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
ZEIT Next.js 4 before 4.2.3 has Directory Traversal under the /_next request namespace. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
ZEIT Next.js before 2.4.1 has directory traversal under the /_next and /static request namespace, allowing attackers to obtain sensitive information. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 80.8%.
Crafted HTTP requests sent to Next.js App Router applications that define at least one Server Action can drive excessive CPU consumption and block processing of further requests in the same Node.js process, producing a denial of service rated 8.2 (CWE-770, uncontrolled resource allocation). The affected ranges are 13.0.0 through 15.5.27 and 16.0.0 through 16.4.0; applications on the Pages Router, and App Router applications with no Server Actions defined, are explicitly not vulnerable, which substantially narrows the exposed population. Exploitation requires no authentication and no user interaction, and no public exploit code has been identified at time of analysis, with no CISA KEV entry and no EPSS signal supplied; the vendor states that upgrading to 15.5.28 or 16.4.1 is the only complete fix, with no workaround available.
Server-side request forgery in the Next.js Image Optimization endpoint lets a remote, unauthenticated attacker cause the server to fetch images from private or internal IP addresses, but only in applications that have configured images.remotePatterns. Affected releases are Next.js 16.0.0 through 16.3.7; the flaw is fixed in 16.3.8 by pinning the outbound connection to the DNS addresses that were already validated against the allow-list. Exploitation is not deterministic - the attacker must win a timing race between the allow-list check and the socket's own DNS lookup (DNS rebinding), consistent with the high attack-complexity rating - and no public exploit code has been identified at time of analysis (EPSS/KEV signals were not provided).
Path traversal in Next.js (13.4.0 through 15.5.23 and 16.x before 16.3.3) running on Windows-hosted servers lets a remote unauthenticated attacker escape the incremental-cache root and read private build artifacts, most critically the server-reference-manifest encryption key, which can be leveraged for remote code execution in the application. The flaw stems from route segments not escaping backslashes before cache-path construction, so encoded Windows path separators (e.g. %5c) bypass the sanitizer. Publicly available exploit code exists in the form of the e2e regression test shipped with the fix; no CISA KEV listing or EPSS score was provided.
React Server Components in React 19.x contain a critical pre-authentication remote code execution vulnerability (CVE-2025-55182, CVSS 10.0) through unsafe deserialization of HTTP request payloads. With EPSS 71.1% and KEV listing, this vulnerability affects any application using React Server Components with react-server-dom-webpack, react-server-dom-turbopack, or react-server-dom-parcel — enabling complete server compromise through a single HTTP request.
Next.js versions 15.0.0 through 15.5.26 and 16.0.0 through 16.3.7 can be coerced into poisoning a shared response cache entry, allowing cross-user content substitution or a persistent denial of service until the poisoned entry is revalidated. The flaw only manifests in applications that combine a root-level catch-all page (for example a top-level [[...slug]] route) with statically generated or Incremental Static Regeneration routes, where the response cache key is not scoped tightly enough to the source route; a single unauthenticated crafted request can collide on that key. Exploitation is real but narrow and gated by high attack complexity and an attack prerequisite (CVSS:3.1/AV:N/AC:H/PR:N/UI:N), so this is assessed as a genuine but moderate-priority issue rather than an emergency; no public exploit code or confirmed active exploitation has been identified at time of analysis. An independent assessment rates impact as low integrity and low availability with scope change (S:C/I:L/A:L), and the supplier CVSS 4.0 vector scores 6.3.
The `next dev` development server in Next.js 16.0.0 through 16.3.7 improperly restricts cross-site requests to its Model Context Protocol (MCP) endpoint at `/_next/mcp`, allowing a malicious website visited by a developer to read sensitive local project data including disk paths, source code snippets from error reports, route inventories, and development logs. The vulnerability is limited to development environments - production deployments do not serve this endpoint - and exploitation requires an active `next dev` session plus the developer navigating to attacker-controlled content (CVSS 4.0 AT:P prerequisite). Unauthenticated (PR:N) but requiring user interaction; no public exploit identified at time of analysis. CVSS 4.0 base score 6.3 (Medium), fixed in Next.js 16.3.8.
Response-cache confusion in self-hosted Next.js (15.0.0 up to but not including 15.5.27, and 16.x up to but not including 16.3.8) lets an unauthenticated remote request key a cached Pages Router response without sufficiently binding it to the originating source route, so one page's cache entry can be overwritten with content from a different route and every subsequent visitor to the affected page is served the wrong content until the entry revalidates. Scope is narrow: only self-hosted apps using the Pages Router with statically generated (SSG) or Incremental Static Regeneration (ISR) pages are exposed - applications deployed on Vercel are explicitly not affected, and App Router-only or uncached/dynamic setups are out of scope. The assessed vector (AV:N/AC:H, PR:N, UI:N, integrity-only impact) and the fact that no public exploit code has been identified at time of analysis keep this a moderate-severity correctness/integrity problem rather than an urgent one; vendor patches are available as 15.5.27 and 16.3.8.
Unpublished draft content can leak to unauthenticated visitors of Next.js sites running versions 16.3.0 through 16.3.7 when Cache Components or the experimental.useCache flag is enabled: pending 'use cache' fills for the same key are shared without isolating Draft Mode requests from regular ones, so an overlapping regular request can be served an editor's unpublished content, and that draft-dependent content can then persist in a prerendered page until revalidation. Exploitation is a narrow timing race that additionally requires an editor to be concurrently using Draft Mode for the same cache key, which is reflected in the high attack-complexity rating (CVSS 4.0 base 6.3, AV:N/AC:H/AT:P/PR:N/UI:N/VC:L); there is no public exploit identified at time of analysis and no evidence of active exploitation. The issue is fixed in Next.js 16.3.8.
Cross-site request validation weakness in the Next.js `next dev` development server (versions 16.0.0 through 16.3.7) allows a malicious website, when visited by a developer who is simultaneously running the dev server, to reach the Model Context Protocol endpoint at /_next/mcp and read development-only metadata: the project's disk location, source-code snippets embedded in error reports, the application's route inventory, and development logs. The CVSS 4.0 score is only 2.3 (assessed as CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N by our review) because exploitation requires the victim to actively run the affected dev server and browse to an attacker-controlled page during that session, and because the impact is limited to read-only disclosure with no code execution or data modification. Production and built deployments do not serve this endpoint at all, so only developer workstations during active local development are exposed; no public exploit code was identified at time of analysis and the issue is not known to be actively exploited. A vendor-released patch is available in Next.js 16.3.8.
Information disclosure in Next.js 16.3.0 through 16.3.7 is a modest-severity cache-correctness flaw that can serve cached content for one root-param value to requests for a different root-param value when the opt-in Cache Components feature is enabled, allowing remote unauthenticated requests to receive content intended for another tenant, locale, or region. The flaw requires nested use cache functions where an inner function reads next/root-params; the leaked content is not attacker-controlled and depends on which invocation first populates the shared cache entry. Vendor-released patch: 16.3.8; no public exploit identified at time of analysis.
Permissive Cross-domain Security Policy with Untrusted Domains vulnerability in Drupal Next.Js allows Cross-Site Scripting (XSS).This issue affects Next.Js: from 0.0.0 before 1.6.4, from 2.0.0 before 2.0.1. [CVSS 6.1 MEDIUM]
Unsafe deserialization in React Server Components Server Function endpoints allows remote unauthenticated attackers to trigger an infinite loop that hangs the server process and can prevent subsequent HTTP requests from being served. The flaw affects React 19.0.2, 19.1.3, and 19.2.2 - including Next.js applications on Node.js that expose Server Functions (Server Actions) - and it represents an incomplete fix for CVE-2025-55184. EPSS is 19.99% (97th percentile), and no public exploit identified at time of analysis; CISA KEV does not list it as confirmed actively exploited.
Pre-authentication denial of service in React Server Components (versions 19.0.0 through 19.2.1) allows unauthenticated remote attackers to hang the server process by sending specially crafted payloads to Server Function endpoints, causing an infinite loop that prevents further HTTP requests from being served. This affects applications using the react-server-dom-parcel, react-server-dom-turbopack, or react-server-dom-webpack packages, commonly seen in Next.js App Router deployments. Publicly available exploit code exists (e.g., GitHub repository referenced), and the EPSS score is 66.88% (99th percentile), indicating a high likelihood of exploitation; however, there is no confirmation of active exploitation in CISA KEV.
Information disclosure in React Server Components 19.x, distributed as react-server-dom-webpack, react-server-dom-turbopack and react-server-dom-parcel, lets remote unauthenticated attackers retrieve the source code of a Server Function with a single crafted HTTP request and no user interaction. The flaw is not universal: it requires the application to define a Server Function that explicitly or implicitly exposes a stringified argument, and its impact is limited to source-code disclosure, with no code execution, data modification or availability effect (CVSS 5.3, C:L with I:N/A:N). Exploitation priority is driven by the intelligence picture rather than the score itself - publicly available exploit code exists and EPSS stands at 64.23% (99th percentile) - while there is no confirmed active exploitation (CISA KEV) at time of analysis.
Server-side request forgery in Vercel Next.js affects self-hosted deployments whose custom middleware calls next()/NextResponse.next() without explicitly passing the request object and forwards user-controlled headers into the response. An unauthenticated remote attacker can supply crafted headers, notably a Location header with a non-redirect status, causing affected middleware routing to treat it as a redirect/rewrite and make server-side requests to attacker-chosen destinations, with high confidentiality and limited integrity impact. Public exploit code exists and EPSS is 5.63% (90th percentile), but CISA KEV does not list it; exploitation is conditional on the non-default middleware pattern, and fixes are available in 14.2.32 and 15.4.7.
Next.js is a React framework for building full-stack web applications. Rated medium severity (CVSS 6.2), this vulnerability is no authentication required, low attack complexity.
Next.js is a React framework for building full-stack web applications. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Next.js is a React framework for building full-stack web applications. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Next.js is a React Framework for the Web. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Next.js is a React framework for building full-stack web applications. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Next.js is a React framework. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Next.js is a React framework that can provide building blocks to create web applications. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Server-Side Request Forgery (SSRF) vulnerability could allow attackers to make the server perform requests to unintended internal or external resources.
Next.js is a React framework that can provide building blocks to create web applications. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Next.js before 13.4.20-canary.13 lacks a cache-control header and thus empty prefetch responses may sometimes be cached by a CDN, causing a denial of service to all users requesting the same URL via. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Next.js is a React framework that can provide building blocks to create web applications. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable. No vendor patch available.
Next.js is a React framework. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Next.js is a React framework. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Next.js is a React framework. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Next.js is an open source website development framework to be used with the React library. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Next.js versions >=9.5.0 and <9.5.4 are vulnerable to an Open Redirect. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Next.js versions before 9.3.2 have a directory traversal vulnerability. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Next.js 7.0.0 and 7.0.1 has XSS via the 404 or 500 /_error page. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
ZEIT Next.js 4 before 4.2.3 has Directory Traversal under the /_next request namespace. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
ZEIT Next.js before 2.4.1 has directory traversal under the /_next and /static request namespace, allowing attackers to obtain sensitive information. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 80.8%.