next has 9 CVEs on record. Disclosure cadence is accelerating: 6 in the last 90 days against 3 in the 90 before. The busiest recent month was July 2026 with 3. The median CVSS is 8.6 (high), with 5 rated critical. None have a confirmed exploitation report. The most common weakness class is CWE-1395 (3).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 8.6
- Publish → KEV
- —
- Last 90 days
- 6 prev 3
Weakness classes
Products
- next 9
Worst active — by depth score
CVE-2026-75604Critical· 9.0Next.js is a React framework for building full-stack web applications62GHSA-673q-mjm6-r5xrCriticalNext.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays52GHSA-2464-fhr4-w9xwCriticalNext.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used52GHSA-vcvr-r3jv-pc5jCriticalNext.js: Remote Code Execution in next/og ImageResponse52GHSA-2xp9-vwfh-vxw4CriticalNext.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used52
next vulnerabilities
CVEs affecting next, newest first. Open any entry for full detail, references, and exploit status.
9 CVEsRSS
GHSA-2464-fhr4-w9xwCriticalNext.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used
Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used
CVE-2026-94482High· 8.2Next.js: Denial of Service in App Router using Server Actions
Next.js: Denial of Service in App Router using Server Actions
GHSA-673q-mjm6-r5xrCriticalNext.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays
Next.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays
GHSA-vcvr-r3jv-pc5jCriticalNext.js: Remote Code Execution in next/og ImageResponse
Next.js: Remote Code Execution in next/og ImageResponse
GHSA-2xp9-vwfh-vxw4CriticalNext.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used
Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used
CVE-2026-75604Critical· 9.0PoCNext.js is a React framework for building full-stack web applications
Next.js is a React framework for building full-stack web applications. From 13.4.0 until 15.5.24 and 16.3.3, Next.js applications using Pages Router or App Router without Cache Components on Windows-hosted servers do not consistently esc…
CVE-2026-64643MediumNext.js: Unauthenticated disclosure of internal Server Function endpoints
Next.js: Unauthenticated disclosure of internal Server Function endpoints
CVE-2026-64644MediumNext.js: Denial of Service in the Image Optimization API using SVGs
Next.js: Denial of Service in the Image Optimization API using SVGs
CVE-2026-64647MediumNext.js: Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences
Next.js: Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences