Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
75 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
npm next >= 15.0.0-canary.0, < 15.4.7; >= 0.9.9, < 14.2.32
Fixed in
14.2.3215.4.7· Vendor fix available
Issue
A vulnerability in Next.js Middleware has been fixed in v14.2.32 and v15.4.7. The issue occurred when request headers were directly passed into NextResponse.next(). In self-hosted applications, this could allow Server-Side Request Forgery (SSRF) if certain sensitive headers from the incoming request were reflected back into the response. All users implementing custom middleware logic in self-hosted environments are strongly encouraged to upgrade and verify correct usage of the next() function. More details at Vercel Changelog
Recommended action: Upgrade to 15.4.7 or 14.2.32 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A vulnerability affecting Next.js has been addressed. It impacted versions 15.0.4 through 15.1.8 and involved a cache poisoning bug leading to a Denial of Service (DoS) condition. Under certain conditions, this issue may allow a HTTP 204 response to be cached for static pages, leading to the 204 response being served to all users attempting to access the page More details: CVE-2025-49826 Credits - Allam Rachid zhero; - Allam Yasser (inzo)
Recommended action: Upgrade to 15.1.8 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A cache poisoning issue in Next.js App Router =15.3.0 and < 15.3.3 may have allowed RSC payloads to be cached and served in place of HTML, under specific conditions involving middleware and redirects. This issue has been fixed in Next.js 15.3.3. Users on affected versions should upgrade immediately and redeploy to ensure proper caching behavior. More details: CVE-2025-49005
Recommended action: Upgrade to 15.3.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
We received a responsible disclosure from Allam Rachid (zhero) for a low-severity race-condition vulnerability in Next.js. This issue only affects the Pages Router under certain misconfigurations, causing normal endpoints to serve pageProps data instead of standard HTML. Learn more here Credit Thank you to Allam Rachid (zhero) for the responsible disclosure. This research was rewarded as part of our bug bounty program.
Recommended action: Upgrade to 15.1.6 or 14.2.24 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In the process of remediating CVE-2025-29927, we looked at other possible exploits of Middleware. We independently verified this low severity vulnerability in parallel with two reports from independent researchers. Learn more here. Credit Thank you to Jinseo Kim kjsman and RyotaK (GMO Flatt Security Inc.) with takumi-san.ai for the responsible disclosure. These researchers were awarded as part of our bug bounty program.
Recommended action: Upgrade to 15.2.4, 14.2.26, 13.5.10 or 12.3.6 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact It is possible to bypass authorization checks within a Next.js application, if the authorization check occurs in middleware. Patches For Next.js 15.x, this issue is fixed in 15.2.3 For Next.js 14.x, this issue is fixed in 14.2.25 For Next.js 13.x, this issue is fixed in 13.5.9 For Next.js 12.x, this issue is fixed in 12.3.5 For Next.js 11.x, consult the below workaround. Note: Next.js deployments hosted on Vercel are automatically protected against this vulnerability. Workaround If patching to a safe version is infeasible, we recommend that you prevent external user requests which contain the x-middleware-subrequest header from reaching your Next.js application. Credits - Allam Rachid (zhero;) - Allam Yasser (inzo)
Recommended action: Upgrade to 15.2.3, 14.2.25, 13.5.9 or 12.3.5 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact A Denial of Service (DoS) attack allows attackers to construct requests that leaves requests to Server Actions hanging until the hosting provider cancels the function execution. Note: Next.js server is idle during that time and only keeps the connection open. CPU and memory footprint are low during that time. Deployments without any protection against long running Server Action invocations are especially vulnerable. Hosting providers like Vercel or Netlify set a default maximum duration on function execution to reduce the risk of excessive billing. This is the same issue as if the incoming HTTP request has an invalid Content-Length header or never closes. If the host has no other mitigations to those then this vulnerability is novel. This vulnerability affects only Next.js deployments using Server Actions. Patches This vulnerability was resolved in Next.js 14.2.21, 15.1.2, and 13.5.8. We recommend that users upgrade to a safe version. Workarounds There are no official…
Recommended action: Upgrade to 15.1.2, 14.2.21 or 13.5.8 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact If a Next.js application is performing authorization in middleware based on pathname, it was possible for this authorization to be bypassed. Patches This issue was patched in Next.js 14.2.15 and later. If your Next.js application is hosted on Vercel, this vulnerability has been automatically mitigated, regardless of Next.js version. Workarounds There are no official workarounds for this vulnerability. Credits We'd like to thank tyage (GMO CyberSecurity by IERAE) for responsible disclosure of this issue.
Recommended action: Upgrade to 14.2.15 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The image optimization feature of Next.js contained a vulnerability which allowed for a potential Denial of Service (DoS) condition which could lead to excessive CPU consumption. Not affected: - The next.config.js file is configured with images.unoptimized set to true or images.loader set to a non-default value. - The Next.js application is hosted on Vercel. Patches This issue was fully patched in Next.js 14.2.7. We recommend that users upgrade to at least this version. Workarounds Ensure that the next.config.js file has either images.unoptimized, images.loader or images.loaderFile assigned. Credits Brandon Dahler (brandondahler), AWS Dimitrios Vlastaras
Recommended action: Upgrade to 14.2.7 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
npm next >= 13.5.1, < 13.5.7; >= 14.0.0, < 14.2.10
Fixed in
14.2.1013.5.7· Vendor fix available
Issue
Impact By sending a crafted HTTP request, it is possible to poison the cache of a non-dynamic server-side rendered route in the pages router (this does not affect the app router). When this crafted request is sent it could coerce Next.js to cache a route that is meant to not be cached and send a Cache-Control: s-maxage=1, stale-while-revalidate header which some upstream CDNs may cache as well. To be potentially affected all of the following must apply: - Next.js between 13.5.1 and 14.2.9 - Using pages router - Using non-dynamic server-side rendered routes e.g. pages/dashboard.tsx not pages/blog/[slug].tsx The below configurations are unaffected: - Deployments using only app router - Deployments on Vercel are not affected Patches This vulnerability was resolved in Next.js v13.5.7, v14.2.10, and later. We recommend upgrading regardless of whether you can reproduce the issue or not. Workarounds There are no official or recommended workarounds for this issue, we recommend that users…
Recommended action: Upgrade to 14.2.10 or 13.5.7 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact A Denial of Service (DoS) condition was identified in Next.js. Exploitation of the bug can trigger a crash, affecting the availability of the server. This vulnerability can affect all Next.js deployments on the affected versions. Patches This vulnerability was resolved in Next.js 13.5 and later. We recommend that users upgrade to a safe version. Workarounds There are no official workarounds for this vulnerability. Credit Thai Vu of flyseccorp.com Aonan Guan (@0dd), Senior Cloud Security Engineer
Recommended action: Upgrade to 13.5.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact A Server-Side Request Forgery (SSRF) vulnerability was identified in Next.js Server Actions by security researchers at Assetnote. If the Host header is modified, and the below conditions are also met, an attacker may be able to make requests that appear to be originating from the Next.js application server itself. Prerequisites Next.js (<14.1.1) is running in a self-hosted manner. The Next.js application makes use of Server Actions. The Server Action performs a redirect to a relative path which starts with a /. \ Many hosting providers (including Vercel) route requests based on the Host header, so we do not believe that this vulnerability affects any Next.js applications where routing is done in this manner. Patches This vulnerability was patched in #62561 and fixed in Next.js 14.1.1. Workarounds There are no official workarounds for this vulnerability. We recommend upgrading to Next.js 14.1.1. Credit Vercel and the Next.js team thank Assetnote for responsibly disclosing this…
Recommended action: Upgrade to 14.1.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Inconsistent interpretation of a crafted HTTP request meant that requests are treated as both a single request, and two separate requests by Next.js, leading to desynchronized responses. This led to a response queue poisoning vulnerability in the affected Next.js versions. For a request to be exploitable, the affected route also had to be making use of the rewrites feature in Next.js. Patches The vulnerability is resolved in Next.js 13.5.1 and newer. This includes Next.js 14.x. Workarounds There are no official workarounds for this vulnerability. We recommend that you upgrade to a safe version. References https://portswigger.net/web-security/request-smuggling/advanced/response-queue-poisoning
Recommended action: Upgrade to 13.5.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Next.js before 13.4.20-canary.13 lacks a cache-control header and thus empty prefetch responses may sometimes be cached by a CDN, causing a denial of service to all users requesting the same URL via that CDN. Cloudflare considers these requests cacheable assets.
Recommended action: Upgrade to 13.4.20-canary.13 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Next.js is a React framework. Starting with version 10.0.0 and prior to version 12.1.0, Next.js is vulnerable to User Interface (UI) Misrepresentation of Critical Information. In order to be affected, the next.config.js file must have an images.domains array assigned and the image host assigned in images.domains must allow user-provided SVG. If the next.config.js file has images.loader assigned to something other than default, the instance is not affected. Version 12.1.0 contains a patch for this issue. As a workaround, change next.config.js to use a different loader configuration other than the default. Impact - Affected: All of the following must be true to be affected - Next.js between version 10.0.0 and 12.0.10 - The next.config.js file has images.domains array assigned - The image host assigned in images.domains allows user-provided SVG - Not affected: The next.config.js file has images.loader assigned to something other than default Patches Next.js 12.1.0 Workarounds Change…
Recommended action: Upgrade to 12.1.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Vulnerable code could allow a bad actor to trigger a denial of service attack for anyone running a Next.js app at version = 12.0.0, and using i18n functionality. - Affected: All of the following must be true to be affected by this CVE - Next.js versions above v12.0.0 - Using next start or a custom server - Using the built-in i18n support - Not affected: - Deployments on Vercel (vercel.com) are not affected along with similar environments where invalid requests are filtered before reaching Next.js. Patches A patch has been released, next@12.0.9, that mitigates this issue. We recommend all affected users upgrade as soon as possible. Workarounds We recommend upgrading whether you can reproduce or not although you can ensure /${locale}/next/ is blocked from reaching the Next.js instance until you upgrade. For more information If you have any questions or comments about this advisory: Open an issue in next Email us at security@vercel.com
Recommended action: Upgrade to 12.0.9 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Next.js is a React framework. In versions of Next.js prior to 12.0.5 or 11.1.3, invalid or malformed URLs could lead to a server crash. In order to be affected by this issue, the deployment must use Next.js versions above 11.1.0 and below 12.0.5, Node.js above 15.0.0, and next start or a custom server. Deployments on Vercel are not affected, along with similar environments where invalid requests are filtered before reaching Next.js. Versions 12.0.5 and 11.1.3 contain patches for this issue. Note that prior version 0.9.9 package next hosted a different utility (0.4.1 being the latest version of that codebase), and this advisory does not apply to those versions.
Recommended action: Upgrade to 12.0.5 or 11.1.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact - Affected: All of the following must be true to be affected - Next.js between version 10.0.0 and 11.1.0 - The next.config.js file has images.domains array assigned - The image host assigned in images.domains allows user-provided SVG - Not affected: The next.config.js file has images.loader assigned to something other than default - Not affected: Deployments on Vercel are not affected Patches Next.js v11.1.1
Recommended action: Upgrade to 11.1.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Next.js is an open source website development framework to be used with the React library. In affected versions specially encoded paths could be used when pages/error.js was statically generated, allowing an open redirect to occur to an external site. In general, this redirect does not directly harm users although it can allow for phishing attacks by redirecting to an attacker's domain from a trusted domain. Impact - Affected: Users of Next.js between 10.0.5 and 10.2.0 - Affected: Users of Next.js between 11.0.0 and 11.0.1 using pages/error.js without getInitialProps - Affected: Users of Next.js between 11.0.0 and 11.0.1 using pages/error.js and next export - Not affected: Deployments on Vercel (vercel.com) are not affected - Not affected: Deployments with pages/404.js - Note that versions prior to 0.9.9 package next npm package hosted a different utility (0.4.1 being the latest version of that codebase), and this advisory does not apply to those versions. We recommend upgrading to…
Recommended action: Upgrade to 11.1.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact - Affected: Users of Next.js between 9.5.0 and 9.5.3 - Not affected: Deployments on Vercel (https://vercel.com) are not affected - Not affected: Deployments using next export We recommend everyone to upgrade regardless of whether you can reproduce the issue or not. Patches https://github.com/vercel/next.js/releases/tag/v9.5.4 References https://github.com/vercel/next.js/releases/tag/v9.5.4
Recommended action: Upgrade to 9.5.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Versions of next prior to 5.1.0 are vulnerable to Remote Code Execution. The /path: route fails to properly sanitize input and passes it to a require() call. This allows attackers to execute JavaScript code on the server. Note that prior version 0.9.9 package next npm package hosted a different utility (0.4.1 being the latest version of that codebase), and this advisory does not apply to those versions. Recommendation Upgrade to version 5.1.0.
Recommended action: Upgrade to 5.1.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact - Not affected: Deployments on ZEIT Now v2 (https://zeit.co) are not affected - Not affected: Deployments using the serverless target - Not affected: Deployments using next export - Affected: Users of Next.js below 9.3.2 We recommend everyone to upgrade regardless of whether you can reproduce the issue or not. Patches https://github.com/zeit/next.js/releases/tag/v9.3.2 References https://github.com/zeit/next.js/releases/tag/v9.3.2
Recommended action: Upgrade to 9.3.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Next.js 7.0.0 and 7.0.1 has XSS via the 404 or 500 /error page.
Recommended action: Upgrade to 7.0.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Next.js 4 before 4.2.3 has Directory Traversal under the /next request namespace.
Recommended action: Upgrade to 4.2.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Next.js before 2.4.1 has directory traversal under the /next and /static request namespace, allowing attackers to obtain sensitive information.
Recommended action: Upgrade to 2.4.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.