Vercel
Monthly
Crafted HTTP requests sent to Next.js App Router applications that define at least one Server Action can drive excessive CPU consumption and block processing of further requests in the same Node.js process, producing a denial of service rated 8.2 (CWE-770, uncontrolled resource allocation). The affected ranges are 13.0.0 through 15.5.27 and 16.0.0 through 16.4.0; applications on the Pages Router, and App Router applications with no Server Actions defined, are explicitly not vulnerable, which substantially narrows the exposed population. Exploitation requires no authentication and no user interaction, and no public exploit code has been identified at time of analysis, with no CISA KEV entry and no EPSS signal supplied; the vendor states that upgrading to 15.5.28 or 16.4.1 is the only complete fix, with no workaround available.
Server-side request forgery in the Next.js Image Optimization endpoint lets a remote, unauthenticated attacker cause the server to fetch images from private or internal IP addresses, but only in applications that have configured images.remotePatterns. Affected releases are Next.js 16.0.0 through 16.3.7; the flaw is fixed in 16.3.8 by pinning the outbound connection to the DNS addresses that were already validated against the allow-list. Exploitation is not deterministic - the attacker must win a timing race between the allow-list check and the socket's own DNS lookup (DNS rebinding), consistent with the high attack-complexity rating - and no public exploit code has been identified at time of analysis (EPSS/KEV signals were not provided).
Path traversal in Next.js (13.4.0 through 15.5.23 and 16.x before 16.3.3) running on Windows-hosted servers lets a remote unauthenticated attacker escape the incremental-cache root and read private build artifacts, most critically the server-reference-manifest encryption key, which can be leveraged for remote code execution in the application. The flaw stems from route segments not escaping backslashes before cache-path construction, so encoded Windows path separators (e.g. %5c) bypass the sanitizer. Publicly available exploit code exists in the form of the e2e regression test shipped with the fix; no CISA KEV listing or EPSS score was provided.
Command injection in the Turborepo LSP VS Code extension before version 2.9.14000 allows arbitrary code execution when opening malicious workspaces. The vulnerability stems from unsafe string interpolation in shell commands, enabling attackers to inject commands through workspace settings or task names that execute with the user's VS Code process privileges. The CVSS 4.0 score of 8.4 indicates high severity with local access and user interaction required.
React Server Components in React 19.x contain a critical pre-authentication remote code execution vulnerability (CVE-2025-55182, CVSS 10.0) through unsafe deserialization of HTTP request payloads. With EPSS 71.1% and KEV listing, this vulnerability affects any application using React Server Components with react-server-dom-webpack, react-server-dom-turbopack, or react-server-dom-parcel — enabling complete server compromise through a single HTTP request.
Next.js versions 15.0.0 through 15.5.26 and 16.0.0 through 16.3.7 can be coerced into poisoning a shared response cache entry, allowing cross-user content substitution or a persistent denial of service until the poisoned entry is revalidated. The flaw only manifests in applications that combine a root-level catch-all page (for example a top-level [[...slug]] route) with statically generated or Incremental Static Regeneration routes, where the response cache key is not scoped tightly enough to the source route; a single unauthenticated crafted request can collide on that key. Exploitation is real but narrow and gated by high attack complexity and an attack prerequisite (CVSS:3.1/AV:N/AC:H/PR:N/UI:N), so this is assessed as a genuine but moderate-priority issue rather than an emergency; no public exploit code or confirmed active exploitation has been identified at time of analysis. An independent assessment rates impact as low integrity and low availability with scope change (S:C/I:L/A:L), and the supplier CVSS 4.0 vector scores 6.3.
The `next dev` development server in Next.js 16.0.0 through 16.3.7 improperly restricts cross-site requests to its Model Context Protocol (MCP) endpoint at `/_next/mcp`, allowing a malicious website visited by a developer to read sensitive local project data including disk paths, source code snippets from error reports, route inventories, and development logs. The vulnerability is limited to development environments - production deployments do not serve this endpoint - and exploitation requires an active `next dev` session plus the developer navigating to attacker-controlled content (CVSS 4.0 AT:P prerequisite). Unauthenticated (PR:N) but requiring user interaction; no public exploit identified at time of analysis. CVSS 4.0 base score 6.3 (Medium), fixed in Next.js 16.3.8.
Response-cache confusion in self-hosted Next.js (15.0.0 up to but not including 15.5.27, and 16.x up to but not including 16.3.8) lets an unauthenticated remote request key a cached Pages Router response without sufficiently binding it to the originating source route, so one page's cache entry can be overwritten with content from a different route and every subsequent visitor to the affected page is served the wrong content until the entry revalidates. Scope is narrow: only self-hosted apps using the Pages Router with statically generated (SSG) or Incremental Static Regeneration (ISR) pages are exposed - applications deployed on Vercel are explicitly not affected, and App Router-only or uncached/dynamic setups are out of scope. The assessed vector (AV:N/AC:H, PR:N, UI:N, integrity-only impact) and the fact that no public exploit code has been identified at time of analysis keep this a moderate-severity correctness/integrity problem rather than an urgent one; vendor patches are available as 15.5.27 and 16.3.8.
Unpublished draft content can leak to unauthenticated visitors of Next.js sites running versions 16.3.0 through 16.3.7 when Cache Components or the experimental.useCache flag is enabled: pending 'use cache' fills for the same key are shared without isolating Draft Mode requests from regular ones, so an overlapping regular request can be served an editor's unpublished content, and that draft-dependent content can then persist in a prerendered page until revalidation. Exploitation is a narrow timing race that additionally requires an editor to be concurrently using Draft Mode for the same cache key, which is reflected in the high attack-complexity rating (CVSS 4.0 base 6.3, AV:N/AC:H/AT:P/PR:N/UI:N/VC:L); there is no public exploit identified at time of analysis and no evidence of active exploitation. The issue is fixed in Next.js 16.3.8.
Cross-site request validation weakness in the Next.js `next dev` development server (versions 16.0.0 through 16.3.7) allows a malicious website, when visited by a developer who is simultaneously running the dev server, to reach the Model Context Protocol endpoint at /_next/mcp and read development-only metadata: the project's disk location, source-code snippets embedded in error reports, the application's route inventory, and development logs. The CVSS 4.0 score is only 2.3 (assessed as CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N by our review) because exploitation requires the victim to actively run the affected dev server and browse to an attacker-controlled page during that session, and because the impact is limited to read-only disclosure with no code execution or data modification. Production and built deployments do not serve this endpoint at all, so only developer workstations during active local development are exposed; no public exploit code was identified at time of analysis and the issue is not known to be actively exploited. A vendor-released patch is available in Next.js 16.3.8.
Information disclosure in Next.js 16.3.0 through 16.3.7 is a modest-severity cache-correctness flaw that can serve cached content for one root-param value to requests for a different root-param value when the opt-in Cache Components feature is enabled, allowing remote unauthenticated requests to receive content intended for another tenant, locale, or region. The flaw requires nested use cache functions where an inner function reads next/root-params; the leaked content is not attacker-controlled and depends on which invocation first populates the shared cache entry. Vendor-released patch: 16.3.8; no public exploit identified at time of analysis.
Improper output escaping in Satori (an HTML/CSS-to-SVG rendering library) allows crafted values to be interpreted as SVG markup, and when those values are routed through the Node.js ImageResponse implementation from Next.js's next/og, the same flaw escalates to remote code execution. Affected are Satori versions 0.0.27 through 0.33.4 and Next.js versions 16.2.0 through 16.3.5 that pass attacker-controlled data into SVG content, attributes, or styles; the Edge ImageResponse path and applications that never feed untrusted values into SVG are not affected. Exploitation is unauthenticated per the CVSS vector (PR:N) but hinges on that deployment prerequisite, and no public exploit identified at time of analysis. Vendor-released patches exist in Satori 0.33.5 and Next.js 16.3.6.
Incorrect authorization in Vercel's @ai-sdk/harness-codex package (prior to 1.0.29) allows untrusted code executing inside a Codex CLI sandbox to invoke arbitrary host-exposed tools - including secret lookups, deployment operations, and cloud API calls - without a corresponding model-authorized tool-call event. The relay server validates incoming requests solely by checking whether the requesting process's command line contains the Codex CLI shim path via Linux /proc, a condition any sandbox process can trivially forge by including the shim path in its own argv. No public exploit has been identified and the vulnerability is not listed in CISA KEV, but the supply-chain threat vector via malicious npm lifecycle hooks or build scripts is realistic for developer environments processing untrusted repositories.
Sandbox authorization bypass in Vercel's `@ai-sdk/harness-opencode` (all versions prior to 1.0.28) permits untrusted code executing inside the OpenCode sandbox to invoke arbitrary host-exposed tools — including secret lookups, deployment operations, and cloud API calls — without a corresponding model-authorized tool-call event. The flawed process-path fallback reads `/proc/<pid>/cmdline` on Linux to verify the requesting process's command line contains the `host-tool-mcp.mjs` script path, a check that sandboxed attacker-controlled code can satisfy or spoof. No public exploit code has been identified at time of analysis, and the issue is remediated in v1.0.28 by replacing the path check with short-lived one-time authorization tokens bound to bridge-observed model events.
Resource exhaustion in Vercel AI SDK's provider-utils package (versions ≤3.0.97) allows authenticated remote attackers to consume excessive system resources via specially crafted requests to JSON response handlers. Public proof-of-concept exists. EPSS data not available. Not listed in CISA KEV. CVSS 4.0 score of 2.1 reflects low availability impact (VA:L) with authenticated network access (PR:L). Vendor non-responsive to initial disclosure.
Server-side request forgery in Vercel AI SDK versions up to 3.0.97 allows remote unauthenticated attackers to forge requests from the server to arbitrary internal or external resources via the validateDownloadUrl function in provider-utils. Publicly available exploit code exists (CVSS E:P). EPSS data not available, not listed in CISA KEV. Vendor unresponsive to disclosure, indicating no official patch or advisory at time of analysis. Organizations using affected versions for AI model downloads or blob handling should implement immediate compensating controls.
OS command injection in Vercel AI SDK versions up to 3.0.97 allows authenticated remote attackers with pull request creation privileges to execute arbitrary commands on CI/CD runners through malicious branch names. The vulnerability resides in the prettier-on-automerge GitHub Actions workflow, which insecurely interpolates PR branch names into shell commands. A public proof-of-concept exploit exists (disclosed via GitHub Gist), demonstrating feasibility despite CVSS 4.0 rating the complexity as high (AC:H) and exploitability as difficult. The vendor (Vercel) was notified but has not responded, and no patch availability is confirmed from vendor sources at time of analysis.
CSRF vulnerability in Turborepo's self-hosted authentication flow allows credential injection attacks when users authenticate the CLI against self-hosted remote cache endpoints. An attacker-controlled web page can send a malicious token to the localhost callback server during the login process. If the malicious callback arrives before the legitimate OAuth response, the CLI completes authentication with attacker-supplied credentials, leading to high integrity impact on subsequent build operations. This affects users of self-hosted Turborepo deployments only - Vercel's hosted device authorization flows are not vulnerable. Fixed in version 2.9.14.
Vercel CLI leaks authentication tokens in JSON output when running in non-interactive mode with credentials passed via command-line arguments. Affected versions 50.16.0 through 52.0.0 expose plaintext tokens in suggested follow-up commands when operations cannot complete autonomously, allowing token capture in CI/CD logs and automation transcripts. Information disclosure risk is elevated in automated deployment pipelines where CLI output is logged.
A denial of service vulnerability exists in Next.js versions with Partial Prerendering (PPR) enabled when running in minimal mode. The PPR resume endpoint accepts unauthenticated POST requests with the `Next-Resume: 1` header and processes attacker-controlled postponed state data. [CVSS 5.9 MEDIUM]
A denial of service vulnerability exists in self-hosted Next.js applications that have `remotePatterns` configured for the Image Optimizer. [CVSS 5.9 MEDIUM]
A vulnerability in Vercel’s AI SDK has been fixed in versions 5.0.52, 5.1.0-beta.9, and 6.0.0-beta. Rated low severity (CVSS 3.7), this vulnerability is remotely exploitable, no authentication required.
Server-side request forgery in Vercel Next.js affects self-hosted deployments whose custom middleware calls next()/NextResponse.next() without explicitly passing the request object and forwards user-controlled headers into the response. An unauthenticated remote attacker can supply crafted headers, notably a Location header with a non-redirect status, causing affected middleware routing to treat it as a redirect/rewrite and make server-side requests to attacker-chosen destinations, with high confidentiality and limited integrity impact. Public exploit code exists and EPSS is 5.63% (90th percentile), but CISA KEV does not list it; exploitation is conditional on the non-default middleware pattern, and fixes are available in 14.2.32 and 15.4.7.
Next.js is a React framework for building full-stack web applications. Rated medium severity (CVSS 6.2), this vulnerability is no authentication required, low attack complexity.
Next.js is a React framework for building full-stack web applications. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Inefficient regular expression complexity in Vercel Hyper up to 3.4.1 allows remote attackers with low privileges to cause denial of service via specially crafted input to the brace expansion logic. The vulnerability resides in the expand/braceExpand/ignoreMap function within the rimraf-standalone.js script. Public exploit code is available, but no evidence of active exploitation exists and EPSS indicates a low probability (0.17%) of widespread exploitation.
Next.js is a React framework for building full-stack web applications. From versions 15.0.4-canary.51 to before 15.1.8, a cache poisoning bug leading to a Denial of Service (DoS) condition was found in Next.js. This issue does not impact customers hosted on Vercel. Under certain conditions, this issue may allow a HTTP 204 response to be cached for static pages, leading to the 204 response being served to all users attempting to access the page. This issue has been addressed in version 15.1.8.
Next.js is a React framework for building full-stack web applications. In Next.js App Router from 15.3.0 to before 15.3.3 and Vercel CLI from 41.4.1 to 42.2.0, a cache poisoning vulnerability was found. The issue allowed page requests for HTML content to return a React Server Component (RSC) payload instead under certain conditions. When deployed to Vercel, this would only impact the browser cache, and would not lead to the CDN being poisoned. When self-hosted and deployed externally, this could lead to cache poisoning if the CDN does not properly distinguish between RSC / HTML in the cache keys. This issue has been resolved in Next.js 15.3.3.
Next.js is a React framework for building full-stack web applications. Rated low severity (CVSS 2.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Next.js is a React framework for building full-stack web applications. Rated low severity (CVSS 3.7), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Next.js is a React framework for building full-stack web applications. Rated low severity (CVSS 1.7), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Next.js versions 1.11.4 through 15.2.2 contain a critical middleware authorization bypass via the x-middleware-subrequest header. Attackers can send crafted requests that skip middleware entirely, bypassing authentication, authorization, and security headers enforced at the middleware layer.
Next.js is a React framework for building full-stack web applications. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Next.js is a React framework for building full-stack web applications. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Next.js is a React Framework for the Web. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Next.js is a React framework for building full-stack web applications. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Next.js is a React framework. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Next.js is a React framework that can provide building blocks to create web applications. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Server-Side Request Forgery (SSRF) vulnerability could allow attackers to make the server perform requests to unintended internal or external resources.
Next.js is a React framework that can provide building blocks to create web applications. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
pkg is tool design to bundle Node.js projects into an executables. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
An issue in Hyper on macOS version 3.4.1 and before, allows remote attackers to execute arbitrary code via the RunAsNode and enableNodeClilnspectArguments settings. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Next.js before 13.4.20-canary.13 lacks a cache-control header and thus empty prefetch responses may sometimes be cached by a CDN, causing a denial of service to all users requesting the same URL via. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Next.js is a React framework that can provide building blocks to create web applications. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable. No vendor patch available.
Next.js is a React framework. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Next.js is a React framework. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Next.js is a React framework. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Next.js is an open source website development framework to be used with the React library. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Next.js versions >=9.5.0 and <9.5.4 are vulnerable to an Open Redirect. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
The ms package before 0.7.1 for Node.js allows attackers to cause a denial of service (CPU consumption) via a long version string, aka a "regular expression denial of service (ReDoS).". Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Crafted HTTP requests sent to Next.js App Router applications that define at least one Server Action can drive excessive CPU consumption and block processing of further requests in the same Node.js process, producing a denial of service rated 8.2 (CWE-770, uncontrolled resource allocation). The affected ranges are 13.0.0 through 15.5.27 and 16.0.0 through 16.4.0; applications on the Pages Router, and App Router applications with no Server Actions defined, are explicitly not vulnerable, which substantially narrows the exposed population. Exploitation requires no authentication and no user interaction, and no public exploit code has been identified at time of analysis, with no CISA KEV entry and no EPSS signal supplied; the vendor states that upgrading to 15.5.28 or 16.4.1 is the only complete fix, with no workaround available.
Server-side request forgery in the Next.js Image Optimization endpoint lets a remote, unauthenticated attacker cause the server to fetch images from private or internal IP addresses, but only in applications that have configured images.remotePatterns. Affected releases are Next.js 16.0.0 through 16.3.7; the flaw is fixed in 16.3.8 by pinning the outbound connection to the DNS addresses that were already validated against the allow-list. Exploitation is not deterministic - the attacker must win a timing race between the allow-list check and the socket's own DNS lookup (DNS rebinding), consistent with the high attack-complexity rating - and no public exploit code has been identified at time of analysis (EPSS/KEV signals were not provided).
Path traversal in Next.js (13.4.0 through 15.5.23 and 16.x before 16.3.3) running on Windows-hosted servers lets a remote unauthenticated attacker escape the incremental-cache root and read private build artifacts, most critically the server-reference-manifest encryption key, which can be leveraged for remote code execution in the application. The flaw stems from route segments not escaping backslashes before cache-path construction, so encoded Windows path separators (e.g. %5c) bypass the sanitizer. Publicly available exploit code exists in the form of the e2e regression test shipped with the fix; no CISA KEV listing or EPSS score was provided.
Command injection in the Turborepo LSP VS Code extension before version 2.9.14000 allows arbitrary code execution when opening malicious workspaces. The vulnerability stems from unsafe string interpolation in shell commands, enabling attackers to inject commands through workspace settings or task names that execute with the user's VS Code process privileges. The CVSS 4.0 score of 8.4 indicates high severity with local access and user interaction required.
React Server Components in React 19.x contain a critical pre-authentication remote code execution vulnerability (CVE-2025-55182, CVSS 10.0) through unsafe deserialization of HTTP request payloads. With EPSS 71.1% and KEV listing, this vulnerability affects any application using React Server Components with react-server-dom-webpack, react-server-dom-turbopack, or react-server-dom-parcel — enabling complete server compromise through a single HTTP request.
Next.js versions 15.0.0 through 15.5.26 and 16.0.0 through 16.3.7 can be coerced into poisoning a shared response cache entry, allowing cross-user content substitution or a persistent denial of service until the poisoned entry is revalidated. The flaw only manifests in applications that combine a root-level catch-all page (for example a top-level [[...slug]] route) with statically generated or Incremental Static Regeneration routes, where the response cache key is not scoped tightly enough to the source route; a single unauthenticated crafted request can collide on that key. Exploitation is real but narrow and gated by high attack complexity and an attack prerequisite (CVSS:3.1/AV:N/AC:H/PR:N/UI:N), so this is assessed as a genuine but moderate-priority issue rather than an emergency; no public exploit code or confirmed active exploitation has been identified at time of analysis. An independent assessment rates impact as low integrity and low availability with scope change (S:C/I:L/A:L), and the supplier CVSS 4.0 vector scores 6.3.
The `next dev` development server in Next.js 16.0.0 through 16.3.7 improperly restricts cross-site requests to its Model Context Protocol (MCP) endpoint at `/_next/mcp`, allowing a malicious website visited by a developer to read sensitive local project data including disk paths, source code snippets from error reports, route inventories, and development logs. The vulnerability is limited to development environments - production deployments do not serve this endpoint - and exploitation requires an active `next dev` session plus the developer navigating to attacker-controlled content (CVSS 4.0 AT:P prerequisite). Unauthenticated (PR:N) but requiring user interaction; no public exploit identified at time of analysis. CVSS 4.0 base score 6.3 (Medium), fixed in Next.js 16.3.8.
Response-cache confusion in self-hosted Next.js (15.0.0 up to but not including 15.5.27, and 16.x up to but not including 16.3.8) lets an unauthenticated remote request key a cached Pages Router response without sufficiently binding it to the originating source route, so one page's cache entry can be overwritten with content from a different route and every subsequent visitor to the affected page is served the wrong content until the entry revalidates. Scope is narrow: only self-hosted apps using the Pages Router with statically generated (SSG) or Incremental Static Regeneration (ISR) pages are exposed - applications deployed on Vercel are explicitly not affected, and App Router-only or uncached/dynamic setups are out of scope. The assessed vector (AV:N/AC:H, PR:N, UI:N, integrity-only impact) and the fact that no public exploit code has been identified at time of analysis keep this a moderate-severity correctness/integrity problem rather than an urgent one; vendor patches are available as 15.5.27 and 16.3.8.
Unpublished draft content can leak to unauthenticated visitors of Next.js sites running versions 16.3.0 through 16.3.7 when Cache Components or the experimental.useCache flag is enabled: pending 'use cache' fills for the same key are shared without isolating Draft Mode requests from regular ones, so an overlapping regular request can be served an editor's unpublished content, and that draft-dependent content can then persist in a prerendered page until revalidation. Exploitation is a narrow timing race that additionally requires an editor to be concurrently using Draft Mode for the same cache key, which is reflected in the high attack-complexity rating (CVSS 4.0 base 6.3, AV:N/AC:H/AT:P/PR:N/UI:N/VC:L); there is no public exploit identified at time of analysis and no evidence of active exploitation. The issue is fixed in Next.js 16.3.8.
Cross-site request validation weakness in the Next.js `next dev` development server (versions 16.0.0 through 16.3.7) allows a malicious website, when visited by a developer who is simultaneously running the dev server, to reach the Model Context Protocol endpoint at /_next/mcp and read development-only metadata: the project's disk location, source-code snippets embedded in error reports, the application's route inventory, and development logs. The CVSS 4.0 score is only 2.3 (assessed as CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N by our review) because exploitation requires the victim to actively run the affected dev server and browse to an attacker-controlled page during that session, and because the impact is limited to read-only disclosure with no code execution or data modification. Production and built deployments do not serve this endpoint at all, so only developer workstations during active local development are exposed; no public exploit code was identified at time of analysis and the issue is not known to be actively exploited. A vendor-released patch is available in Next.js 16.3.8.
Information disclosure in Next.js 16.3.0 through 16.3.7 is a modest-severity cache-correctness flaw that can serve cached content for one root-param value to requests for a different root-param value when the opt-in Cache Components feature is enabled, allowing remote unauthenticated requests to receive content intended for another tenant, locale, or region. The flaw requires nested use cache functions where an inner function reads next/root-params; the leaked content is not attacker-controlled and depends on which invocation first populates the shared cache entry. Vendor-released patch: 16.3.8; no public exploit identified at time of analysis.
Improper output escaping in Satori (an HTML/CSS-to-SVG rendering library) allows crafted values to be interpreted as SVG markup, and when those values are routed through the Node.js ImageResponse implementation from Next.js's next/og, the same flaw escalates to remote code execution. Affected are Satori versions 0.0.27 through 0.33.4 and Next.js versions 16.2.0 through 16.3.5 that pass attacker-controlled data into SVG content, attributes, or styles; the Edge ImageResponse path and applications that never feed untrusted values into SVG are not affected. Exploitation is unauthenticated per the CVSS vector (PR:N) but hinges on that deployment prerequisite, and no public exploit identified at time of analysis. Vendor-released patches exist in Satori 0.33.5 and Next.js 16.3.6.
Incorrect authorization in Vercel's @ai-sdk/harness-codex package (prior to 1.0.29) allows untrusted code executing inside a Codex CLI sandbox to invoke arbitrary host-exposed tools - including secret lookups, deployment operations, and cloud API calls - without a corresponding model-authorized tool-call event. The relay server validates incoming requests solely by checking whether the requesting process's command line contains the Codex CLI shim path via Linux /proc, a condition any sandbox process can trivially forge by including the shim path in its own argv. No public exploit has been identified and the vulnerability is not listed in CISA KEV, but the supply-chain threat vector via malicious npm lifecycle hooks or build scripts is realistic for developer environments processing untrusted repositories.
Sandbox authorization bypass in Vercel's `@ai-sdk/harness-opencode` (all versions prior to 1.0.28) permits untrusted code executing inside the OpenCode sandbox to invoke arbitrary host-exposed tools — including secret lookups, deployment operations, and cloud API calls — without a corresponding model-authorized tool-call event. The flawed process-path fallback reads `/proc/<pid>/cmdline` on Linux to verify the requesting process's command line contains the `host-tool-mcp.mjs` script path, a check that sandboxed attacker-controlled code can satisfy or spoof. No public exploit code has been identified at time of analysis, and the issue is remediated in v1.0.28 by replacing the path check with short-lived one-time authorization tokens bound to bridge-observed model events.
Resource exhaustion in Vercel AI SDK's provider-utils package (versions ≤3.0.97) allows authenticated remote attackers to consume excessive system resources via specially crafted requests to JSON response handlers. Public proof-of-concept exists. EPSS data not available. Not listed in CISA KEV. CVSS 4.0 score of 2.1 reflects low availability impact (VA:L) with authenticated network access (PR:L). Vendor non-responsive to initial disclosure.
Server-side request forgery in Vercel AI SDK versions up to 3.0.97 allows remote unauthenticated attackers to forge requests from the server to arbitrary internal or external resources via the validateDownloadUrl function in provider-utils. Publicly available exploit code exists (CVSS E:P). EPSS data not available, not listed in CISA KEV. Vendor unresponsive to disclosure, indicating no official patch or advisory at time of analysis. Organizations using affected versions for AI model downloads or blob handling should implement immediate compensating controls.
OS command injection in Vercel AI SDK versions up to 3.0.97 allows authenticated remote attackers with pull request creation privileges to execute arbitrary commands on CI/CD runners through malicious branch names. The vulnerability resides in the prettier-on-automerge GitHub Actions workflow, which insecurely interpolates PR branch names into shell commands. A public proof-of-concept exploit exists (disclosed via GitHub Gist), demonstrating feasibility despite CVSS 4.0 rating the complexity as high (AC:H) and exploitability as difficult. The vendor (Vercel) was notified but has not responded, and no patch availability is confirmed from vendor sources at time of analysis.
CSRF vulnerability in Turborepo's self-hosted authentication flow allows credential injection attacks when users authenticate the CLI against self-hosted remote cache endpoints. An attacker-controlled web page can send a malicious token to the localhost callback server during the login process. If the malicious callback arrives before the legitimate OAuth response, the CLI completes authentication with attacker-supplied credentials, leading to high integrity impact on subsequent build operations. This affects users of self-hosted Turborepo deployments only - Vercel's hosted device authorization flows are not vulnerable. Fixed in version 2.9.14.
Vercel CLI leaks authentication tokens in JSON output when running in non-interactive mode with credentials passed via command-line arguments. Affected versions 50.16.0 through 52.0.0 expose plaintext tokens in suggested follow-up commands when operations cannot complete autonomously, allowing token capture in CI/CD logs and automation transcripts. Information disclosure risk is elevated in automated deployment pipelines where CLI output is logged.
A denial of service vulnerability exists in Next.js versions with Partial Prerendering (PPR) enabled when running in minimal mode. The PPR resume endpoint accepts unauthenticated POST requests with the `Next-Resume: 1` header and processes attacker-controlled postponed state data. [CVSS 5.9 MEDIUM]
A denial of service vulnerability exists in self-hosted Next.js applications that have `remotePatterns` configured for the Image Optimizer. [CVSS 5.9 MEDIUM]
A vulnerability in Vercel’s AI SDK has been fixed in versions 5.0.52, 5.1.0-beta.9, and 6.0.0-beta. Rated low severity (CVSS 3.7), this vulnerability is remotely exploitable, no authentication required.
Server-side request forgery in Vercel Next.js affects self-hosted deployments whose custom middleware calls next()/NextResponse.next() without explicitly passing the request object and forwards user-controlled headers into the response. An unauthenticated remote attacker can supply crafted headers, notably a Location header with a non-redirect status, causing affected middleware routing to treat it as a redirect/rewrite and make server-side requests to attacker-chosen destinations, with high confidentiality and limited integrity impact. Public exploit code exists and EPSS is 5.63% (90th percentile), but CISA KEV does not list it; exploitation is conditional on the non-default middleware pattern, and fixes are available in 14.2.32 and 15.4.7.
Next.js is a React framework for building full-stack web applications. Rated medium severity (CVSS 6.2), this vulnerability is no authentication required, low attack complexity.
Next.js is a React framework for building full-stack web applications. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Inefficient regular expression complexity in Vercel Hyper up to 3.4.1 allows remote attackers with low privileges to cause denial of service via specially crafted input to the brace expansion logic. The vulnerability resides in the expand/braceExpand/ignoreMap function within the rimraf-standalone.js script. Public exploit code is available, but no evidence of active exploitation exists and EPSS indicates a low probability (0.17%) of widespread exploitation.
Next.js is a React framework for building full-stack web applications. From versions 15.0.4-canary.51 to before 15.1.8, a cache poisoning bug leading to a Denial of Service (DoS) condition was found in Next.js. This issue does not impact customers hosted on Vercel. Under certain conditions, this issue may allow a HTTP 204 response to be cached for static pages, leading to the 204 response being served to all users attempting to access the page. This issue has been addressed in version 15.1.8.
Next.js is a React framework for building full-stack web applications. In Next.js App Router from 15.3.0 to before 15.3.3 and Vercel CLI from 41.4.1 to 42.2.0, a cache poisoning vulnerability was found. The issue allowed page requests for HTML content to return a React Server Component (RSC) payload instead under certain conditions. When deployed to Vercel, this would only impact the browser cache, and would not lead to the CDN being poisoned. When self-hosted and deployed externally, this could lead to cache poisoning if the CDN does not properly distinguish between RSC / HTML in the cache keys. This issue has been resolved in Next.js 15.3.3.
Next.js is a React framework for building full-stack web applications. Rated low severity (CVSS 2.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Next.js is a React framework for building full-stack web applications. Rated low severity (CVSS 3.7), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Next.js is a React framework for building full-stack web applications. Rated low severity (CVSS 1.7), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Next.js versions 1.11.4 through 15.2.2 contain a critical middleware authorization bypass via the x-middleware-subrequest header. Attackers can send crafted requests that skip middleware entirely, bypassing authentication, authorization, and security headers enforced at the middleware layer.
Next.js is a React framework for building full-stack web applications. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Next.js is a React framework for building full-stack web applications. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Next.js is a React Framework for the Web. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Next.js is a React framework for building full-stack web applications. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Next.js is a React framework. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Next.js is a React framework that can provide building blocks to create web applications. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Server-Side Request Forgery (SSRF) vulnerability could allow attackers to make the server perform requests to unintended internal or external resources.
Next.js is a React framework that can provide building blocks to create web applications. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
pkg is tool design to bundle Node.js projects into an executables. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
An issue in Hyper on macOS version 3.4.1 and before, allows remote attackers to execute arbitrary code via the RunAsNode and enableNodeClilnspectArguments settings. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Next.js before 13.4.20-canary.13 lacks a cache-control header and thus empty prefetch responses may sometimes be cached by a CDN, causing a denial of service to all users requesting the same URL via. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Next.js is a React framework that can provide building blocks to create web applications. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable. No vendor patch available.
Next.js is a React framework. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Next.js is a React framework. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Next.js is a React framework. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Next.js is an open source website development framework to be used with the React library. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Next.js versions >=9.5.0 and <9.5.4 are vulnerable to an Open Redirect. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
The ms package before 0.7.1 for Node.js allows attackers to cause a denial of service (CPU consumption) via a long version string, aka a "regular expression denial of service (ReDoS).". Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.