CVE Tools
Track your stack

Vercel

30 CVEs tracked since 2026. Since May 2026, none of them reached CISA KEV.

Vercel CVEs per month

May 2026 to Jul 2026. Point at a month, or focus the strip and use the arrow keys.
Vercel CVEs per month, with the share now in CISA KEV
MonthCVEsIn CISA KEV
2026-05190
2026-06null or fewer
2026-07110

Products

The products that kept showing up in Vercel's monthly top three, with their CVEs summed over those months.

  1. Next.js212 months
  2. AI31 month
  3. Turborepo31 month
  4. @ai-sdk/harness-codex11 month
  5. @ai-sdk/harness-opencode11 month

Latest CVEs

The 15 most recently published vulnerabilities affecting Vercel.

  1. CVE-2026-75604Next.js: Unauthenticated Remote Code Execution on windows-hosted servers9.0
  2. CVE-2026-64649Next.js: Server-Side Request Forgery in Server Actions on Custom Servers6.5
  3. CVE-2026-64648Next.js: Response Body Cache Confusion for Requests Containing Bodies5.4
  4. CVE-2026-64647Next.js: Response Body Cache Confusion with Invalid UTF-8 Request Bodies5.4
  5. CVE-2026-64646Next.js: Unbounded Server Action payload in Edge runtime5.3
  6. CVE-2026-64644Next.js: Denial of Service in the Image Optimization API using SVGs5.3
  7. CVE-2026-64643Next.js: Unauthenticated Disclosure of Internal Server Function endpoints5.3
  8. CVE-2026-64642Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale8.2
  9. CVE-2026-64641Next.js: Denial of Service in App Router using Server Actions7.5
  10. CVE-2026-64645Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname6.1
  11. CVE-2026-64650AI SDK Codex Harness Tool Relay Authorization Bypass—
  12. CVE-2026-64651AI SDK OpenCode Harness Tool Relay Authorization Bypass—
  13. CVE-2026-8769vercel ai provider-utils response-handler.ts createJsonErrorResponseHandler resource consumption4.3
  14. CVE-2026-8768vercel ai provider-utils download-blob.ts validateDownloadUrl server-side request forgery7.3
  15. CVE-2026-8767vercel ai PR Branch Name Interpolation prettier-on-automerge.yml run os command injection5.0

The record

Peak rank
#64 in May 2026
Busiest month shown
May 2026, 19 CVEs
Months with a KEV entry
0 since May 2026
Monthly snapshots
2 since 2026
Vercel's full record, month by month

We use analytics cookies to see which pages and articles actually help people. Decline and none of them run — the site works the same. What we store