Next
49 CVEs tracked. None of them is in CISA KEV.
This hub aggregates every CVE we track for Next, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.
Next CVEs per month
| Month | CVEs |
|---|---|
| 2024-10 | 1 |
| 2024-11 | 0 |
| 2024-12 | 1 |
| 2025-01 | 1 |
| 2025-02 | 0 |
| 2025-03 | 1 |
| 2025-04 | 1 |
| 2025-05 | 2 |
| 2025-06 | 0 |
| 2025-07 | 2 |
| 2025-08 | 3 |
| 2025-09 | 0 |
| 2025-10 | 0 |
| 2025-11 | 0 |
| 2025-12 | 4 |
| 2026-01 | 3 |
| 2026-02 | 0 |
| 2026-03 | 2 |
| 2026-04 | 1 |
| 2026-05 | 1 |
| 2026-06 | 0 |
| 2026-07 | 0 |
| 2026-08 | 1 |
| 2026-09 | 1 |
Severity
How the 49 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.
- Critical3
- High16
- Medium19
- Low2
Latest CVEs
The 15 most recently published vulnerabilities affecting Next.
- GHSA-2xp9-vwfh-vxw4Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used—
- CVE-2026-78180alibaba-fusion next deepMerge index.tsx ConfigProvider.getContextProps prototype pollution7.3
- GHSA-8h8q-6873-q5fjNext.js Vulnerable to Denial of Service with Server Components—
- GHSA-q4gf-8mx6-v5v3Next.js has a Denial of Service with Server Components—
- CVE-2026-27978Next.js: null origin can bypass Server Actions CSRF checks4.3
- CVE-2026-27977Next.js: null origin can bypass dev HMR websocket CSRF checks5.4
- GHSA-h25m-26qc-wcjfNext.js HTTP request deserialization can lead to DoS when using insecure React Server Components—
- CVE-2025-59471A denial of service vulnerability exists in self-hosted Next.js applications that have `remotePatterns` configured for the Image Optimizer. The image optimization endpoint (`/_next/image`) loads ex...5.9
- CVE-2025-59472A denial of service vulnerability exists in Next.js versions with Partial Prerendering (PPR) enabled when running in minimal mode. The PPR resume endpoint accepts unauthenticated POST requests with...5.9
- GHSA-5j59-xgg2-r9c4Next has a Denial of Service with Server Components - Incomplete Fix Follow-Up—
- GHSA-w37m-7fhw-fmv9Next Server Actions Source Code Exposure —
- GHSA-mwv6-3258-q52cNext Vulnerable to Denial of Service with Server Components—
- GHSA-9qr9-h5gf-34mpNext.js is vulnerable to RCE in React flight protocol—
- CVE-2025-57752Next.js Affected by Cache Key Confusion for Image Optimization API Routes6.2
- CVE-2025-55173Next.js Content Injection Vulnerability for Image Optimization4.3
Product grouping is registry-driven, with AI assist and human review. How it works