next vulnerabilities
CVEs whose affected-version data names the next package (npm). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
10 CVEsRSS
GHSA-2464-fhr4-w9xwCriticalNext.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used
Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used
CVE-2026-94482High· 8.2Next.js: Denial of Service in App Router using Server Actions
Next.js: Denial of Service in App Router using Server Actions
GHSA-673q-mjm6-r5xrCriticalNext.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays
Next.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays
CVE-2026-94545Medium· 5.3PoCSatori is a library to convert HTML and CSS to SVG
Satori is a library to convert HTML and CSS to SVG. Starting in version 0.0.27 and prior to version 0.33.5, Satori does not properly escape certain values before including them in generated SVG output. This can allow crafted values to be…
GHSA-vcvr-r3jv-pc5jCriticalNext.js: Remote Code Execution in next/og ImageResponse
Next.js: Remote Code Execution in next/og ImageResponse
GHSA-2xp9-vwfh-vxw4CriticalNext.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used
Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used
CVE-2026-75604Critical· 9.0PoCNext.js is a React framework for building full-stack web applications
Next.js is a React framework for building full-stack web applications. From 13.4.0 until 15.5.24 and 16.3.3, Next.js applications using Pages Router or App Router without Cache Components on Windows-hosted servers do not consistently esc…
CVE-2026-64643MediumNext.js: Unauthenticated disclosure of internal Server Function endpoints
Next.js: Unauthenticated disclosure of internal Server Function endpoints
CVE-2026-64644MediumNext.js: Denial of Service in the Image Optimization API using SVGs
Next.js: Denial of Service in the Image Optimization API using SVGs
CVE-2026-64647MediumNext.js: Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences
Next.js: Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences