Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
75 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
npm next >= 13.4.6, < 15.5.16; >= 16.0.0, < 16.2.5
Fixed in
16.2.515.5.16· Vendor fix available
Issue
Impact React Server Component responses can be vulnerable to cache poisoning in deployments that rely on shared caches with insufficient response partitioning. In affected conditions, collisions in the rsc cache-busting value can allow an attacker to poison cache entries so users receive the wrong response variant for a given URL. Fix We strengthened the rsc cache-busting mechanism to make practical collisions significantly harder and to better separate response variants that should not share cache entries. Workarounds If you cannot upgrade immediately, ensure intermediary caches correctly honor Vary for RSC-related request headers, or disable shared caching for affected RSC responses until you can deploy a patched release.
Recommended action: Upgrade to 16.2.5 or 15.5.16 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
npm next >= 13.0.0, < 15.5.16; >= 16.0.0, < 16.2.5
Fixed in
16.2.515.5.16· Vendor fix available
Issue
Impact Applications that use beforeInteractive scripts together with untrusted content can be vulnerable to cross-site scripting. In affected versions, serialized script content was not escaped safely before being embedded into the document, which could allow attacker-controlled input to break out of the intended script context and execute arbitrary JavaScript in a visitor's browser. Fix We now HTML-escape serialized beforeInteractive script content before embedding it into the page, preventing attacker-controlled content from breaking out of the inline script boundary. Workarounds If you cannot upgrade immediately, do not pass untrusted data into beforeInteractive scripts. If that pattern is unavoidable, sanitize or escape the content before embedding it.
Recommended action: Upgrade to 16.2.5 or 15.5.16 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
npm next >= 15.0.0, < 15.5.16; >= 16.0.0, < 16.2.5
Fixed in
16.2.515.5.16· Vendor fix available
Issue
Impact Applications using Partial Prerendering through the Cache Components feature can be vulnerable to connection exhaustion through crafted POST requests to a server action. In affected configurations, a malicious request can trigger a request-body handling deadlock that leaves connections open for an extended period, consuming file descriptors and server capacity until legitimate users are denied service. Fix We now treat the header used for resuming Partial Prerendered requests as an internal-only header and strip it from untrusted incoming requests. This header should never be accepted directly from external clients. Workarounds If you cannot upgrade immediately, block requests that would be handled by Next.js if they contain the Next-Resume header at the edge.
Recommended action: Upgrade to 16.2.5 or 15.5.16 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
npm next >= 10.0.0, < 15.5.16; >= 16.0.0, < 16.2.5
Fixed in
16.2.515.5.16· Vendor fix available
Issue
Impact When self-hosting Next.js with the default image loader, the Image Optimization API fetches local images entirely into memory without enforcing a maximum size limit. An attacker could cause out-of-memory conditions by requesting large local assets from the /next/image endpoint that match the images.localPatterns configuration (by default, all patterns are allowed). - If you are using images.localPatterns, only the patterns in that array are impacted. - If you are using images.unoptimized: true, you are NOT impacted. - If you are using images.loader: 'custom', you are NOT impacted. - If you are using Vercel, you are NOT impacted. Fix We now apply response size limits consistently to internal image fetches, not just external ones, and fail oversized responses before they can exhaust process memory. This can be adjusted using the images.maximumResponseBody configuration. Workarounds If you cannot upgrade immediately, avoid routing large local assets through /next/image, disable…
Recommended action: Upgrade to 16.2.5 or 15.5.16 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
npm next >= 13.4.13, < 15.5.16; >= 16.0.0, < 16.2.5
Fixed in
16.2.515.5.16· Vendor fix available
Issue
Impact Self-hosted applications using the built-in Node.js server can be vulnerable to server-side request forgery through crafted WebSocket upgrade requests. An attacker can cause the server to proxy requests to arbitrary internal or external destinations, which may expose internal services or cloud metadata endpoints. Vercel-hosted deployments are not affected. Fix We now apply the same safety checks to WebSocket upgrade handling that already existed for normal HTTP requests, so upgrade requests are only proxied when routing has explicitly marked them as safe external rewrites. Workarounds If you cannot upgrade immediately, do not expose the origin server directly to untrusted networks. If WebSocket upgrades are not required, block them at your reverse proxy or load balancer, and restrict origin egress to internal networks and metadata services where possible.
Recommended action: Upgrade to 16.2.5 or 15.5.16 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
npm next >= 14.2.0, < 15.5.16; >= 16.0.0, < 16.2.5
Fixed in
16.2.515.5.16· Vendor fix available
Issue
Impact Applications using React Server Components can be vulnerable to cache poisoning when shared caches do not correctly partition response variants. Under affected conditions, an attacker can cause an RSC response to be served from the original URL and poison shared cache entries so later visitors receive component payloads instead of the expected HTML. Fix We now validate and interpret RSC request headers consistently across request classification and rendering, and we enforce the intended cache-busting behavior so RSC payloads are not unexpectedly served from the original URL. Workarounds If you cannot upgrade immediately, ensure your CDN or reverse proxy keys on the relevant RSC request headers and honors Vary, or disable shared caching for affected App Router and RSC responses.
Recommended action: Upgrade to 16.2.5 or 15.5.16 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
npm next >= 15.2.0, < 15.5.16; >= 16.0.0, < 16.2.5
Fixed in
16.2.515.5.16· Vendor fix available
Issue
Impact App Router applications that rely on middleware or proxy-based checks for authorization can allow unauthorized access through transport-specific route variants used for segment prefetching. In affected configurations, specially crafted .rsc and segment-prefetch URLs can resolve to the same page without being matched by the intended middleware rule, which can allow protected content to be reached without the expected authorization check. Fix We now include App Router transport variants when generating middleware matchers, so middleware protections are applied consistently to those requests as well as to the normal page URL. Workarounds If you cannot upgrade immediately, enforce authorization in the underlying route or page logic instead of relying solely on middleware.
Recommended action: Upgrade to 16.2.5 or 15.5.16 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
npm next >= 15.4.0, < 15.5.16; >= 16.0.0, < 16.2.5
Fixed in
16.2.515.5.16· Vendor fix available
Issue
Impact Applications that rely on middleware to protect dynamic routes can be vulnerable to authorization bypass. In affected deployments, specially crafted query parameters can alter the dynamic route value seen by the page while leaving the visible path unchanged, which can allow protected content to be rendered without passing the expected middleware check. Fix We now only honor internal route-parameter normalization in trusted routing flows and ignore externally supplied parameter encodings that should never have been accepted from ordinary requests. Workarounds If you cannot upgrade immediately, enforce authorization in route or page logic instead of relying solely on middleware path matching.
Recommended action: Upgrade to 16.2.5 or 15.5.16 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
npm next >= 12.2.0, < 15.5.16; >= 16.0.0, < 16.2.5
Fixed in
16.2.515.5.16· Vendor fix available
Issue
Impact Applications using the Pages Router with i18n configured and middleware/proxy-based authorization can allow unauthorized access to protected page data through locale-less /next/data/<buildId/<page.json requests. In affected configurations, middleware does not run for the unprefixed data route, allowing an attacker to retrieve SSR JSON for protected pages without passing the intended authorization checks. Fix The matcher logic was updated to perform the same match as it would on a non-i18n data route. Workarounds If you cannot upgrade immediately, enforce authorization in the page's server-side data path instead of relying solely on middleware.
Recommended action: Upgrade to 16.2.5 or 15.5.16 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
npm next >= 13.0.0, < 15.5.16; >= 16.0.0, < 16.2.5
Fixed in
16.2.515.5.16· Vendor fix available
Issue
A vulnerability affects certain React Server Components packages for versions 19.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. The issue is tracked upstream as CVE-2026-23870. A specially crafted HTTP request can be sent to any App Router Server Function endpoint that, when deserialized, may trigger excessive CPU usage. This can result in denial of service in unpatched environments.
Recommended action: Upgrade to 16.2.5 or 15.5.16 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
npm next >= 13.0.0, < 15.5.15; >= 16.0.0-beta.0, < 16.2.3
Fixed in
16.2.315.5.15· Vendor fix available
Issue
A vulnerability affects certain React Server Components packages for versions 19.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. The issue is tracked upstream as CVE-2026-23869. You can read more about this advisory our this changelog. A specially crafted HTTP request can be sent to any App Router Server Function endpoint that, when deserialized, may trigger excessive CPU usage. This can result in denial of service in unpatched environments.
Recommended action: Upgrade to 16.2.3 or 15.5.15 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
npm next >= 16.0.0-beta.0, < 16.1.7; >= 9.5.0, < 15.5.13
Fixed in
15.5.1316.1.7· Vendor fix available
Issue
When Next.js rewrites proxy traffic to an external backend, a crafted DELETE/OPTIONS request using Transfer-Encoding: chunked could trigger request boundary disagreement between the proxy and backend. This could allow request smuggling through rewritten routes. Impact An attacker could smuggle a second request to unintended backend routes (for example, internal/admin endpoints), bypassing assumptions that only the configured rewrite destination/path is reachable. This does not impact applications hosted on providers that handle rewrites at the CDN level, such as Vercel. Patches The vulnerability originated in an upstream library vendored by Next.js. It is fixed by updating that dependency’s behavior so content-length: 0 is added only when both content-length and transfer-encoding are absent, and transfer-encoding is no longer removed in that code path. Workarounds If upgrade is not immediately possible: - Block chunked DELETE/OPTIONS requests on rewritten routes at your…
Recommended action: Upgrade to 16.1.7 or 15.5.13 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
npm next >= 16.0.0-beta.0, < 16.1.7; >= 10.0.0, < 15.5.14
Fixed in
15.5.1416.1.7· Vendor fix available
Issue
The default Next.js image optimization disk cache (/next/image) did not have a configurable upper bound, allowing unbounded cache growth. Impact An attacker could generate many unique image-optimization variants and exhaust disk space, causing denial of service. Note that this does not impact platforms that have their own image optimization capabilities, such as Vercel. Patches Fixed by adding an LRU-backed disk cache with images.maximumDiskCacheSize, including eviction of least-recently-used entries when the limit is exceeded. Setting maximumDiskCacheSize: 0 disables disk caching. Workarounds If upgrade is not immediately possible: - Periodically clean .next/cache/images. - Reduce variant cardinality (e.g., tighten values for images.localPatterns, images.remotePatterns, and images.qualities)
Recommended action: Upgrade to 16.1.7 or 15.5.14 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A request containing the next-resume: 1 header (corresponding with a PPR resume request) would buffer request bodies without consistently enforcing maxPostponedStateSize in certain setups. The previous mitigation protected minimal-mode deployments, but equivalent non-minimal deployments remained vulnerable to the same unbounded postponed resume-body buffering behavior. Impact In applications using the App Router with Partial Prerendering capability enabled (via experimental.ppr or cacheComponents), an attacker could send oversized next-resume POST payloads that were buffered without consistent size enforcement in non-minimal deployments, causing excessive memory usage and potential denial of service. Patches Fixed by enforcing size limits across all postponed-body buffering paths and erroring when limits are exceeded. Workarounds If upgrade is not immediately possible: - Block requests containing the next-resume header, as this is never valid to be sent from an untrusted…
Recommended action: Upgrade to 16.1.7 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
origin: null was treated as a "missing" origin during Server Action CSRF validation. As a result, requests from opaque contexts (such as sandboxed iframes) could bypass origin verification instead of being validated as cross-origin requests. Impact An attacker could induce a victim browser to submit Server Actions from a sandboxed context, potentially executing state-changing actions with victim credentials (CSRF). Patches Fixed by treating 'null' as an explicit origin value and enforcing host/origin checks unless 'null' is explicitly allowlisted in experimental.serverActions.allowedOrigins. Workarounds If upgrade is not immediately possible: - Add CSRF tokens for sensitive Server Actions. - Prefer SameSite=Strict on sensitive auth cookies. - Do not allow 'null' in serverActions.allowedOrigins unless intentionally required and additionally protected.
Recommended action: Upgrade to 16.1.7 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In next dev, cross-site protections for internal development endpoints could treat Origin: null as a bypass case even when allowedDevOrigins is configured. This could allow privacy-sensitive or opaque browser contexts, such as sandboxed documents, to access privileged internal dev-server functionality unexpectedly. Impact If a developer visits attacker-controlled content while running an affected next dev server with allowedDevOrigins configured, attacker-controlled browser code may be able to connect to internal development endpoints and interact with sensitive dev-server functionality that should have remained blocked. This issue affects development mode only. It does not affect next start, and it does not expose internal debugging functionality to the network by default. Patches Fixed by validating Origin: null through the same cross-site origin-allowance checks used for other origins on internal development endpoints. Workarounds If upgrade is not immediately possible: -…
Recommended action: Upgrade to 16.1.7 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
15.5.1016.1.515.0.815.1.1215.2.916.0.1115.4.1115.6.0-canary.6115.3.9· Vendor fix available
Issue
A vulnerability affects certain React Server Components packages for versions 19.0.x, 19.1.x, and 19.2.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. The issue is tracked upstream as CVE-2026-23864. A specially crafted HTTP request can be sent to any App Router Server Function endpoint that, when deserialized, may trigger excessive CPU usage, out-of-memory exceptions, or server crashes. This can result in denial of service in unpatched environments.
Recommended action: Upgrade to 16.1.5, 16.0.11, 15.6.0-canary.61 (pre-release) or 6 more by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A denial of service vulnerability exists in Next.js versions with Partial Prerendering (PPR) enabled when running in minimal mode. The PPR resume endpoint accepts unauthenticated POST requests with the Next-Resume: 1 header and processes attacker-controlled postponed state data. Two closely related vulnerabilities allow an attacker to crash the server process through memory exhaustion: 1. Unbounded request body buffering: The server buffers the entire POST request body into memory using Buffer.concat() without enforcing any size limit, allowing arbitrarily large payloads to exhaust available memory. 2. Unbounded decompression (zipbomb): The resume data cache is decompressed using inflateSync() without limiting the decompressed output size. A small compressed payload can expand to hundreds of megabytes or gigabytes, causing memory exhaustion. Both attack vectors result in a fatal V8 out-of-memory error (FATAL ERROR: Reached heap limit Allocation failed - JavaScript heap out of memory)…
Recommended action: Upgrade to 16.1.5 or 15.6.0-canary.61 (pre-release) by release line; some affected versions have no fix yet, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
npm next >= 10.0.0, < 15.5.10; >= 15.6.0-canary.0, < 16.1.5
Fixed in
15.5.1016.1.5· Vendor fix available
Issue
A DoS vulnerability exists in self-hosted Next.js applications that have remotePatterns configured for the Image Optimizer. The image optimization endpoint (/next/image) loads external images entirely into memory without enforcing a maximum size limit, allowing an attacker to cause out-of-memory conditions by requesting optimization of arbitrarily large images. This vulnerability requires that remotePatterns is configured to allow image optimization from external domains and that the attacker can serve or control a large image on an allowed domain. Strongly consider upgrading to 15.5.10 and 16.1.5 to reduce risk and prevent availability issues in Next applications.
Recommended action: Upgrade to 16.1.5 or 15.5.10 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
15.2.815.5.915.4.1014.2.3516.1.0-canary.1915.1.1115.3.816.0.1015.6.0-canary.6015.0.7· Vendor fix available
Issue
It was discovered that the fix for CVE-2025-55184 in React Server Components was incomplete and did not fully mitigate denial-of-service conditions across all payload types. As a result, certain crafted inputs could still trigger excessive resource consumption. This vulnerability affects React versions 19.0.2, 19.1.3, and 19.2.2, as well as frameworks that bundle or depend on these versions, including Next.js 13.x, 14.x, 15.x, and 16.x when using the App Router. The issue is tracked upstream as CVE-2025-67779. A malicious actor can send a specially crafted HTTP request to a Server Function endpoint that, when deserialized, causes the React Server Components runtime to enter an infinite loop. This can lead to sustained CPU consumption and cause the affected server process to become unresponsive, resulting in a denial-of-service condition in unpatched environments.
Recommended action: Upgrade to 16.1.0-canary.19 (pre-release), 16.0.10, 15.6.0-canary.60 (pre-release) or 7 more by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
16.0.915.0.616.1.0-canary.1715.4.915.1.1015.6.0-canary.5915.2.715.5.815.3.7· Vendor fix available
Issue
A vulnerability affects certain React packages for versions 19.0.0, 19.0.1, 19.1.0, 19.1.1, 19.1.2, 19.2.0, and 19.2.1 and frameworks that use the affected packages, including Next.js 15.x and 16.x using the App Router. The issue is tracked upstream as CVE-2025-55183. A malicious HTTP request can be crafted and sent to any App Router endpoint that can return the compiled source code of Server Functions. This could reveal business logic, but would not expose secrets unless they were hardcoded directly into Server Function code.
Recommended action: Upgrade to 16.1.0-canary.17 (pre-release), 16.0.9, 15.6.0-canary.59 (pre-release) or 6 more by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
16.0.915.0.616.1.0-canary.1715.4.915.1.1015.6.0-canary.5915.2.715.5.815.3.714.2.34· Vendor fix available
Issue
A vulnerability affects certain React packages for versions 19.0.0, 19.0.1, 19.1.0, 19.1.1, 19.1.2, 19.2.0, and 19.2.1 and frameworks that use the affected packages, including Next.js 15.x and 16.x using the App Router. The issue is tracked upstream as CVE-2025-55184. A malicious HTTP request can be crafted and sent to any App Router endpoint that, when deserialized, can cause the server process to hang and consume CPU. This can result in denial of service in unpatched environments.
Recommended action: Upgrade to 16.1.0-canary.17 (pre-release), 16.0.9, 15.6.0-canary.59 (pre-release) or 7 more by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
15.4.815.1.915.3.616.0.715.2.615.5.715.0.5· Vendor fix available
Issue
A vulnerability affects certain React packages<sup1</sup for versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 and frameworks that use the affected packages, including Next.js 15.x and 16.x using the App Router. The issue is tracked upstream as CVE-2025-55182. Fixed in: React: 19.0.1, 19.1.2, 19.2.1 Next.js: 15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7, 16.0.7, 15.6.0-canary.58, 16.1.0-canary.12+ The vulnerability also affects experimental canary releases starting with 14.3.0-canary.77. Users on any of the 14.3 canary builds should either downgrade to a 14.x stable release or 14.3.0-canary.76. All users of stable 15.x or 16.x Next.js versions should upgrade to a patched, stable version immediately. <sup1</sup The affected React packages are: - react-server-dom-parcel - react-server-dom-turbopack - react-server-dom-webpack
Recommended action: Upgrade to 16.0.7, 15.5.7, 15.4.8 or 4 more by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
npm next >= 15.0.0, <= 15.4.4; >= 0.9.9, < 14.2.31
Fixed in
15.4.514.2.31· Vendor fix available
Issue
A vulnerability in Next.js Image Optimization has been fixed in v15.4.5 and v14.2.31. When images returned from API routes vary based on request headers (such as Cookie or Authorization), these responses could be incorrectly cached and served to unauthorized users due to a cache key confusion bug. All users are encouraged to upgrade if they use API routes to serve images that depend on request headers and have image optimization enabled. More details at Vercel Changelog
Recommended action: Upgrade to 15.4.5 or 14.2.31 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
npm next >= 15.0.0, <= 15.4.4; >= 0.9.9, < 14.2.31
Fixed in
15.4.514.2.31· Vendor fix available
Issue
A vulnerability in Next.js Image Optimization has been fixed in v15.4.5 and v14.2.31. The issue allowed attacker-controlled external image sources to trigger file downloads with arbitrary content and filenames under specific configurations. This behavior could be abused for phishing or malicious file delivery. All users relying on images.domains or images.remotePatterns are encouraged to upgrade and verify that external image sources are strictly validated. More details at Vercel Changelog
Recommended action: Upgrade to 15.4.5 or 14.2.31 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.