CVE Tools
Track your stack

Next.js

64 CVEs tracked. 1 of them are in CISA KEV.

This hub aggregates every CVE we track for Next.js, a product in the web cms plugins space. Use it to gauge the current risk picture and drill into individual advisories.

Next.js CVEs per month

Oct 2024 to Sep 2026. Point at a month, or focus the strip and use the arrow keys.
Next.js CVEs per month
MonthCVEs
2024-101
2024-110
2024-121
2025-011
2025-020
2025-031
2025-041
2025-052
2025-060
2025-072
2025-083
2025-090
2025-100
2025-110
2025-124
2026-013
2026-020
2026-035
2026-041
2026-0513
2026-060
2026-079
2026-080
2026-091

Severity

How the 64 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical46%
  • High2438%
  • Medium3250%
  • Low46%

Latest CVEs

The 15 most recently published vulnerabilities affecting Next.js.

  1. CVE-2026-75604Next.js: Unauthenticated Remote Code Execution on windows-hosted servers9.0
  2. CVE-2026-64649Next.js: Server-Side Request Forgery in Server Actions on Custom Servers6.5
  3. CVE-2026-64648Next.js: Response Body Cache Confusion for Requests Containing Bodies5.4
  4. CVE-2026-64647Next.js: Response Body Cache Confusion with Invalid UTF-8 Request Bodies5.4
  5. CVE-2026-64646Next.js: Unbounded Server Action payload in Edge runtime5.3
  6. CVE-2026-64644Next.js: Denial of Service in the Image Optimization API using SVGs5.3
  7. CVE-2026-64643Next.js: Unauthenticated Disclosure of Internal Server Function endpoints5.3
  8. CVE-2026-64642Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale8.2
  9. CVE-2026-64641Next.js: Denial of Service in App Router using Server Actions7.5
  10. CVE-2026-64645Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname6.1
  11. CVE-2026-45109Next.js: Middleware / Proxy bypass in App Router applications via segment-prefetch routes7.5
  12. CVE-2026-44582Next.js: Cache poisoning via collisions in React Server Component cache-busting3.7
  13. CVE-2026-44581Next.js: Cross-site scripting in App Router applications using CSP nonces4.7
  14. CVE-2026-44580Next.js: Cross-site scripting in beforeInteractive scripts with untrusted input6.1
  15. CVE-2026-44579Next.js: Denial of Service via connection exhaustion in applications using Cache Components7.5

Product grouping is registry-driven, with AI assist and human review. How it works

We use analytics cookies to see which pages and articles actually help people. Decline and none of them run — the site works the same. What we store