Next.js vulnerabilitiesNext.js: known vulnerabilities and safe versions

Vulnerabilities and safe version by branch

Safe version: on that branch, this release and every later one (up to the branch's latest release, where known) fall outside every known record's range. Candidates are only the records' own fixed versions and the branch's latest release; "No fix" means moving off the branch.

Records

Newest first. Ranges are the record's own data; several ranges mean separate fixes per branch.

• CVE-2026-945442026-10-02

  Next.js: Pending `use cache` fill can leak Draft Mode content into regular responses and persisted pages

  Affected versions: >= 16.3.0, < 16.3.8

  medium 6.3

  Fixed in: 16.3.8

• CVE-2026-945432026-10-02

  Next.js: Cache poisoning of SSG and ISR pages in self-hosted Next.js applications

  Affected versions: >= 15.0.0, < 15.5.27 · >= 16.0.0, < 16.3.8

  medium 6.3

  Fixed in: 15.5.27, 16.3.8

• CVE-2026-944862026-10-02

  Next.js: Information disclosure in the Next.js development server's Model Context Protocol endpoint

  Affected versions: >= 16.0.0, < 16.3.8

  low 2.3

  Fixed in: 16.3.8

• CVE-2026-944852026-10-02

  Next.js: Information disclosure in Next.js App Router metadata image routes via dynamicParams bypass

  Affected versions: >= 16.0.0, < 16.3.8

  medium 6.3

  Fixed in: 16.3.8

• CVE-2026-944842026-10-02

  Next.js: Cache poisoning in Next.js SSG/ISR rendering leads to cross-user content substitution and persistent denial of service

  Affected versions: >= 16.0.0, < 16.3.8 · >= 15.0.0, < 15.5.27

  medium 6.3

  Fixed in: 15.5.27, 16.3.8

• CVE-2026-944832026-10-02

  Next.js: Server-Side Request Forgery in Image Optimization

  Affected versions: >= 16.0.0, < 16.3.8

  high 8.3

  Fixed in: 16.3.8

• CVE-2026-94545exploit code exists2026-09-30

  Satori-generated SVG has improper escaping

  Affected versions: >= 16.2.0, < 16.3.6

  medium 5.3

  Fixed in: 16.3.6

  EPSS 1%

• CVE-2026-75604weaponized2026-09-01

  Next.js: Unauthenticated Remote Code Execution on windows-hosted servers

  Affected versions: >= 13.4.0, < 15.5.24 · >= 16.0.0, < 16.3.3

  critical 9.0

  Fixed in: 15.5.24, 16.3.3

  EPSS 2.1%

• CVE-2026-646492026-07-27

  Next.js: Server-Side Request Forgery in Server Actions on Custom Servers

  Affected versions: >= 14.1.1, < 15.5.21 · >= 16.0.0, < 16.2.11

  high 8.3

  Fixed in: 15.5.21, 16.2.11

• CVE-2026-646482026-07-27

  Next.js: Response Body Cache Confusion for Requests Containing Bodies

  Affected versions: >= 13.0.0, < 15.5.21 · >= 16.0.0, < 16.2.11

  medium 6.0

  Fixed in: 15.5.21, 16.2.11

• CVE-2026-646472026-07-27

  Next.js: Response Body Cache Confusion with Invalid UTF-8 Request Bodies

  Affected versions: >= 13.0.0, < 15.5.21 · >= 16.0.0, < 16.2.11

  medium 6.3

  Fixed in: 15.5.21, 16.2.11

• CVE-2026-646462026-07-27

  Next.js: Unbounded Server Action payload in Edge runtime

  Affected versions: >= 13.0.0, < 15.5.21 · >= 16.0.0, < 16.2.11

  medium 6.3

  Fixed in: 15.5.21, 16.2.11

• CVE-2026-646452026-07-27

  Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname

  Affected versions: >= 12.0.0, < 15.5.21 · >= 16.0.0, < 16.2.11

  high 8.3

  Fixed in: 15.5.21, 16.2.11

• CVE-2026-646442026-07-27

  Next.js: Denial of Service in the Image Optimization API using SVGs

  Affected versions: >= 15.5.0, < 15.5.21 · >= 16.0.0, < 16.2.11

  medium 6.3

  Fixed in: 15.5.21, 16.2.11

• CVE-2026-646432026-07-27

  Next.js: Unauthenticated Disclosure of Internal Server Function endpoints

  Affected versions: >= 13.0.0, < 15.5.21 · >= 16.0.0, < 16.2.11

  medium 6.3

  Fixed in: 15.5.21, 16.2.11

• CVE-2026-646422026-07-27

  Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale

  Affected versions: >= 16.0.0, < 16.2.11

  high 8.3

  Fixed in: 16.2.11

• CVE-2026-646412026-07-27

  Next.js: Denial of Service in App Router using Server Actions

  Affected versions: >= 13.0.0, < 15.5.21 · >= 16.0.0, < 16.2.11

  high 8.2

  Fixed in: 15.5.21, 16.2.11

• CVE-2025-71389exploit code exists2026-07-23

  Cal.com before 5.9.9 Remote Code Execution via RSC

  Affected versions: >= 14.3.0-canary.77, < 15.0.5 · >= 15.1.0-canary.0, < 15.1.9 · >= 15.2.0-canary.0, < 15.2.6 · >= 15.3.0-canary.0, < 15.3.6 · >= 15.4.0-canary.0, < 15.4.8 · >= 15.5.0-canary.0, < 15.5.7 · >= 16.0.0-canary.0, < 16.0.7

  critical 10.0

  Fixed in: 15.0.5, 15.1.9, 15.2.6, 15.3.6

  EPSS 1.3%

• CVE-2026-451092026-05-13

  Next.js: Middleware / Proxy bypass in App Router applications via segment-prefetch routes

  Affected versions: >= 15.2.0, < 15.5.18 · >= 16.0.0, < 16.2.6

  high 7.5

  Fixed in: 15.5.18, 16.2.6

• CVE-2026-445822026-05-13

  Next.js: Cache poisoning via collisions in React Server Component cache-busting

  Affected versions: >= 13.4.6, < 15.5.16 · >= 16.0.0, < 16.2.5

  low 3.7

  Fixed in: 15.5.16, 16.2.5

• CVE-2026-445812026-05-13

  Next.js: Cross-site scripting in App Router applications using CSP nonces

  Affected versions: >= 13.4.0, < 15.5.16 · >= 16.0.0, < 16.2.5

  medium 4.7

  Fixed in: 15.5.16, 16.2.5

• CVE-2026-445802026-05-13

  Next.js: Cross-site scripting in beforeInteractive scripts with untrusted input

  Affected versions: >= 13.0.0, < 15.5.16 · >= 16.0.0, < 16.2.5

  medium 6.1

  Fixed in: 15.5.16, 16.2.5

• CVE-2026-44579exploit code exists2026-05-13

  Next.js: Denial of Service via connection exhaustion in applications using Cache Components

  Affected versions: >= 15.0.0, < 15.5.16 · >= 16.0.0, < 16.2.5

  high 7.5

  Fixed in: 15.5.16, 16.2.5

• CVE-2026-44578exploit code exists2026-05-13

  Next.js: Server-side request forgery in applications using WebSocket upgrades

  Affected versions: >= 13.4.13, < 15.5.16 · >= 16.0.0, < 16.2.5

  high 8.6

  Fixed in: 15.5.16, 16.2.5

  EPSS 1.8%

• CVE-2026-445772026-05-13

  Next.js: Denial of Service in the Image Optimization API

  Affected versions: >= 10.0.0, < 15.5.16 · >= 16.0.0, < 16.2.5

  medium 5.9

  Fixed in: 15.5.16, 16.2.5

• CVE-2026-445762026-05-13

  Next.js: Cache poisoning in React Server Component responses

  Affected versions: >= 14.2.0, < 15.5.16 · >= 16.0.0, < 16.2.5

  medium 5.4

  Fixed in: 15.5.16, 16.2.5

• CVE-2026-445752026-05-13

  Next.js: Middleware / Proxy bypass in App Router applications via segment-prefetch routes

  Affected versions: >= 15.2.0, < 15.5.16 · >= 16.0.0, < 16.2.5

  high 7.5

  Fixed in: 15.5.16, 16.2.5

• CVE-2026-445742026-05-13

  Next.js: Middleware / Proxy bypass through dynamic route parameter injection

  Affected versions: >= 15.4.0, < 15.5.16 · >= 16.0.0, < 16.2.5

  high 8.1

  Fixed in: 15.5.16, 16.2.5

• CVE-2026-445732026-05-13

  Next.js: Middleware / Proxy bypass in Pages Router applications using i18n

  Affected versions: >= 12.2.0, < 15.5.16 · >= 16.0.0, < 16.2.5

  high 7.5

  Fixed in: 15.5.16, 16.2.5

• CVE-2026-445722026-05-13

  Next.js: Middleware / Proxy redirects can be cache-poisoned

  Affected versions: >= 12.2.0, < 15.5.16 · >= 16.0.0, < 16.2.5

  medium 5.9

  Fixed in: 15.5.16, 16.2.5

• CVE-2026-29057exploit code exists2026-03-17

  Next.js: HTTP request smuggling in rewrites

  Affected versions: >= 16.0.0-beta.0, < 16.1.7 · >= 9.5.0, < 15.5.13

  medium 6.3

  Fixed in: 15.5.13, 16.1.7

• CVE-2026-279802026-03-17

  Next.js: Unbounded next/image disk cache growth can exhaust storage

  Affected versions: >= 16.0.0-beta.0, < 16.1.7 · >= 10.0.0, < 15.5.14

  medium 6.9

  Fixed in: 15.5.14, 16.1.7

• CVE-2026-279792026-03-17

  Next.js: Unbounded postponed resume buffering can lead to DoS

  Affected versions: >= 16.0.1, < 16.1.7

  medium 6.9

  Fixed in: 16.1.7

• CVE-2026-27978exploit code exists2026-03-17

  Next.js: null origin can bypass Server Actions CSRF checks

  Affected versions: >= 16.0.1, < 16.1.7

  medium 5.3

  Fixed in: 16.1.7

• CVE-2026-279772026-03-17

  Next.js: null origin can bypass dev HMR websocket CSRF checks

  Affected versions: >= 16.0.1, < 16.1.7

  low 2.3

  Fixed in: 16.1.7

• CVE-2025-594722026-01-26

  A denial of service vulnerability exists in Next.js versions with Partial Prerendering (PPR) enabled when running in minimal mode.

  Affected versions: >= 16.0.0-beta.0, < 16.1.5 · >= 15.0.0-canary.0, <= 15.0.0-canary.205 · >= 15.0.1-canary.0, <= 15.0.1-canary.3 · >= 15.0.2-canary.0, <= 15.0.2-canary.11 · >= 15.0.3-canary.0, <= 15.0.3-canary.9 · >= 15.0.4-canary.0, <= 15.0.4-canary.52 · >= 15.1.1-canary.0, <= 15.1.1-canary.27 · >= 15.2.0-canary.0, <= 15.2.0-canary.77 · >= 15.2.1-canary.0, <= 15.2.1-canary.6 · >= 15.2.2-canary.0, <= 15.2.2-canary.7 · >= 15.3.0-canary.0, <= 15.3.0-canary.46 · >= 15.3.1-canary.0, <= 15.3.1-canary.15 · >= 15.4.0-canary.0, <= 15.4.0-canary.130 · >= 15.4.2-canary.0, <= 15.4.2-canary.56 · >= 15.5.1-canary.0, <= 15.5.1-canary.39 · >= 15.6.0-canary.0, < 15.6.0-canary.61 · >= 15.0.0-canary.0, < 15.0.0-canary.206 · >= 15.0.1-canary.0, < 15.0.1-canary.4 · >= 15.0.2-canary.0, < 15.0.2-canary.12 · >= 15.0.3-canary.0, < 15.0.3-canary.10 · >= 15.0.4-canary.0, < 15.0.4-canary.53 · >= 15.1.1-canary.0, < 15.1.1-canary.28 · >= 15.2.0-canary.0, < 15.2.0-canary.78 · >= 15.2.1-canary.0, < 15.2.1-canary.7 · >= 15.2.2-canary.0, < 15.2.2-canary.8 · >= 15.3.0-canary.0, < 15.3.0-canary.47 · >= 15.3.1-canary.0, < 15.3.1-canary.16 · >= 15.4.0-canary.0, < 15.4.0-canary.131 · >= 15.4.2-canary.0, < 15.4.2-canary.57 · >= 15.5.1-canary.0, < 15.5.1-canary.40

  high 7.5

  Fixed in: 16.1.5

• CVE-2025-594712026-01-26

  A denial of service vulnerability exists in self-hosted Next.js applications that have `remotePatterns` configured for the Image Optimizer.

  Affected versions: >= 10.0.0, < 15.5.10 · >= 15.6.0-canary.0, < 16.1.5

  high 7.5

  Fixed in: 15.5.10, 16.1.5

• CVE-2025-57822exploit code exists2025-08-29

  Next.js Improper Middleware Redirect Handling Leads to SSRF

  Affected versions: >= 0.9.9, < 14.2.32 · >= 15.0.0-canary.0, < 15.4.7

  high 8.2

  Fixed in: 14.2.32, 15.4.7

  EPSS 2.5%

• CVE-2025-577522025-08-29

  Next.js Affected by Cache Key Confusion for Image Optimization API Routes

  Affected versions: >= 0.9.9, < 14.2.31 · >= 15.0.0, < 15.4.5

  medium 6.2

  Fixed in: 14.2.31, 15.4.5

• CVE-2025-551732025-08-29

  Next.js Content Injection Vulnerability for Image Optimization

  Affected versions: >= 0.9.9, < 14.2.31 · >= 15.0.0, < 15.4.5

  medium 4.3

  Fixed in: 14.2.31, 15.4.5

• CVE-2025-498262025-07-03

  Next.js DoS vulnerability via cache poisoning

  Affected versions: >= 15.0.4-canary.51, < 15.1.8

  high 7.5

  Fixed in: 15.1.8

  EPSS 1.1%

• CVE-2025-490052025-07-03

  Next.js cache poisoning due to omission of Vary header

  Affected versions: >= 15.3.0, < 15.3.3

  low 3.7

  Fixed in: 15.3.3

• CVE-2025-480682025-05-30

  Information exposure in Next.js dev server due to lack of origin verification

  Affected versions: >= 15.0.0, < 15.2.2 · >= 13.0, < 14.2.30

  low 2.3

  Fixed in: 14.2.30, 15.2.2

• CVE-2025-32421exploit code exists2025-05-14

  Next.js Race Condition to Cache Poisoning

  Affected versions: >= 0.9.9, < 14.2.24 · >= 15.0.0, < 15.1.6

  low 3.7

  Fixed in: 14.2.24, 15.1.6

• CVE-2025-302182025-04-02

  Next.js may leak x-middleware-subrequest-id to external hosts

  Affected versions: >= 12.3.5, < 12.3.6 · >= 13.5.9, < 13.5.10 · >= 14.2.25, < 14.2.26 · >= 15.2.3, < 15.2.4

  low 1.7

  Fixed in: 12.3.6, 13.5.10, 14.2.26, 15.2.4

• CVE-2025-29927weaponized2025-03-21

  Authorization Bypass in Next.js Middleware

  Affected versions: >= 13.0.0, < 13.5.9 · >= 14.0.0, < 14.2.25 · >= 15.0.0, < 15.2.3 · >= 12.0.0, < 12.3.5

  critical 9.1

  Fixed in: 12.3.5, 13.5.9, 14.2.25, 15.2.3

  EPSS 99.2%

• CVE-2024-563322025-01-03

  Next.js Vulnerable to Denial of Service (DoS) with Server Actions

  Affected versions: >= 13.0.0, < 13.5.8 · >= 14.0.0, < 14.2.21 · >= 15.0.0, < 15.1.2

  medium 5.3

  Fixed in: 13.5.8, 14.2.21, 15.1.2

• CVE-2024-514792024-12-17

  Authorization bypass in Next.js

  Affected versions: >= 9.5.5, < 14.2.15

  high 7.5

  Fixed in: 14.2.15

  EPSS 3.9%

• CVE-2024-478312024-10-14

  Next.js image optimization has Denial of Service condition

  Affected versions: >= 10.0.0, < 14.2.7

  high 7.5

  Fixed in: 14.2.7

• CVE-2024-46982exploit code exists2024-09-17

  Cache Poisoning in next.js

  Affected versions: >= 13.5.1, < 13.5.7 · >= 14.0.0, < 14.2.10

  high 7.5

  Fixed in: 13.5.7, 14.2.10

  EPSS 59.1%

• CVE-2024-396932024-07-10

  Next.js Denial of Service (DoS) condition

  Affected versions: >= 13.3.1, < 13.5.0

  high 7.5

  Fixed in: 13.5.0

• CVE-2024-34351exploit code exists2024-05-14

  Next.js Server-Side Request Forgery in Server Actions

  Affected versions: >= 13.4.0, < 14.1.1

  high 7.5

  Fixed in: 14.1.1

  EPSS 5.4%

• CVE-2024-343502024-05-14

  Next.js Vulnerable to HTTP Request Smuggling

  Affected versions: >= 13.4.0, < 13.5.1

  high 7.5

  Fixed in: 13.5.1

  EPSS 1.1%

• CVE-2023-462982023-10-21

  Next.js before 13.4.20-canary.13 lacks a cache-control header and thus empty prefetch responses may sometimes be cached by a CDN, causing a

  Affected versions: >= 0.9.9, < 13.4.20-canary.13

  high 7.5

  Fixed in: 13.4.20-canary.13

  EPSS 1.2%

• CVE-2022-360462022-08-31

  Unexpected server crash in Next.js version 12.2.3

  Affected versions: >= 12.2.3, < 12.2.4

  medium 5.3

  Fixed in: 12.2.4

  EPSS 1.1%

• CVE-2022-236462022-02-17

  Improper CSP in Image Optimization API for Next.js

  Affected versions: >= 10.0.0, < 12.1.0

  high 7.5

  Fixed in: 12.1.0

  EPSS 1.7%

• CVE-2022-217212022-01-28

  DOS Vulnerability in next.js

  Affected versions: >= 12.0.0, < 12.0.9

  high 7.5

  Fixed in: 12.0.9

  EPSS 2.1%

• CVE-2021-438032021-12-09

  Unexpected server crash in Next.js

  Affected versions: >= 12.0.0, < 12.0.5 · >= 0.9.9, < 11.1.3

  high 7.5

  Fixed in: 11.1.3, 12.0.5

  EPSS 47.2%

• CVE-2021-391782021-08-30

  XSS in Image Optimization API for Next.js versions between 10.0.0 and 11.1.0

  Affected versions: >= 10.0.0, < 11.1.1

  medium 6.1

  Fixed in: 11.1.1

  EPSS 1.1%

• CVE-2021-376992021-08-11

  Open Redirect in Next.js versions below 11.1.0

  Affected versions: >= 0.9.9, < 11.1.0

  medium 6.1

  Fixed in: 11.1.0

  EPSS 1%

• CVE-2020-152422020-10-08

  Open Redirect in Next.js

  Affected versions: >= 9.5.0, < 9.5.4

  medium 6.1

  Fixed in: 9.5.4

• CVE-2020-5284exploit code exists2020-03-30

  Directory Traversal in Next.js versions below 9.3.2

  Affected versions: >= 0.9.9, < 9.3.2

  medium 4.3

  Fixed in: 9.3.2

  EPSS 44.7%

• CVE-2018-182822018-10-12

  Next.js 7.0.0 and 7.0.1 has XSS via the 404 or 500 /_error page.

  Affected versions: >= 7.0.0, < 7.0.2

  medium 6.1

  Fixed in: 7.0.2

  EPSS 1%

• CVE-2018-6184exploit code exists2018-01-24

  ZEIT Next.js 4 before 4.2.3 has Directory Traversal under the /_next request namespace.

  Affected versions: >= 1.0.0, < 4.2.3

  high 7.5

  Fixed in: 4.2.3

  EPSS 9%

• CVE-2017-16877exploit code exists2017-11-17

  ZEIT Next.js before 2.4.1 has directory traversal under the /_next and /static request namespace, allowing attackers to obtain sensitive inf

  Affected versions: >= 1.0.0, < 2.4.1

  high 7.5

  Fixed in: 2.4.1

  EPSS 14.1%

• GHSA-w37m-7fhw-fmv9

  A vulnerability in React Server Components (versions 19.0.0-19.2.1) and Next.js 15.x/16.x App Router allows a malicious HTTP request to retrieve the compiled source code of Server Functions, potentially exposing business logic.

  Affected versions: >= 15.0.0-canary.0, < 15.0.6 · >= 15.1.1-canary.0, < 15.1.10 · >= 15.2.0-canary.0, < 15.2.7 · >= 15.3.0-canary.0, < 15.3.7 · >= 15.4.0-canary.0, < 15.4.9 · >= 15.5.1-canary.0, < 15.5.8 · >= 15.6.0-canary.0, < 15.6.0-canary.59 · >= 16.0.0-beta.0, < 16.0.9 · >= 16.1.0-canary.0, < 16.1.0-canary.17

  medium

  Fixed in: 15.0.6, 15.1.10, 15.2.7, 15.3.7

• GHSA-vcvr-r3jv-pc5j

  Next.js: Remote Code Execution in next/og ImageResponse

  Affected versions: >= 16.2.0, < 16.3.6

  critical

  Fixed in: 16.3.6

• GHSA-q4gf-8mx6-v5v3

  A vulnerability in React Server Components (version 19.x) and Next.js 13.x-16.x App Router allows a specially crafted HTTP request to Server Function endpoints to trigger excessive CPU usage, resulting in Denial of Service.

  Affected versions: >= 13.0.0, < 15.5.15 · >= 16.0.0-beta.0, < 16.2.3

  high

  Fixed in: 15.5.15, 16.2.3

• GHSA-mwv6-3258-q52c

  A vulnerability in React Server Components (versions 19.0.0-19.2.1) and Next.js 15.x/16.x App Router allows a specially crafted HTTP request to cause the server process to hang and consume CPU during deserialization, resulting in Denial of

  Affected versions: >= 13.3.0, < 14.2.34 · >= 15.0.0-canary.0, < 15.0.6 · >= 15.1.1-canary.0, < 15.1.10 · >= 15.2.0-canary.0, < 15.2.7 · >= 15.3.0-canary.0, < 15.3.7 · >= 15.4.0-canary.0, < 15.4.9 · >= 15.5.1-canary.0, < 15.5.8 · >= 15.6.0-canary.0, < 15.6.0-canary.59 · >= 16.0.0-beta.0, < 16.0.9 · >= 16.1.0-canary.0, < 16.1.0-canary.17

  high

  Fixed in: 14.2.34, 15.0.6, 15.1.10, 15.2.7

• GHSA-h25m-26qc-wcjf

  A vulnerability in React Server Components packages (versions 19.0.x-19.2.x) and Next.js 13.x-16.x App Router allows a specially crafted HTTP request to Server Function endpoints to trigger excessive CPU usage, out-of-memory exceptions, or

  Affected versions: >= 13.0.0, < 15.0.8 · >= 15.1.1-canary.0, < 15.1.12 · >= 15.2.0-canary.0, < 15.2.9 · >= 15.3.0-canary.0, < 15.3.9 · >= 15.4.0-canary.0, < 15.4.11 · >= 15.5.1-canary.0, < 15.5.10 · >= 15.6.0-canary.0, < 15.6.0-canary.61 · >= 16.0.0-beta.0, < 16.0.11 · >= 16.1.0-canary.0, < 16.1.5

  high

  Fixed in: 15.0.8, 15.1.12, 15.2.9, 15.3.9

• GHSA-9qr9-h5gf-34mp

  A vulnerability in React Server Components packages (versions 19.0.0, 19.1.0, 19.1.1, 19.2.0) and Next.js 15.x/16.x App Router allows a malicious HTTP request to cause server-side issues. The affected packages are react-server-dom-parcel, r

  Affected versions: >= 14.3.0-canary.77, < 15.0.5 · >= 15.1.0-canary.0, < 15.1.9 · >= 15.2.0-canary.0, < 15.2.6 · >= 15.3.0-canary.0, < 15.3.6 · >= 15.4.0-canary.0, < 15.4.8 · >= 15.5.0-canary.0, < 15.5.7 · >= 16.0.0-canary.0, < 16.0.7

  critical

  Fixed in: 15.0.5, 15.1.9, 15.2.6, 15.3.6

• GHSA-8h8q-6873-q5fj

  A vulnerability in React Server Components (version 19.x) and Next.js 13.x-16.x App Router allows a specially crafted HTTP request to Server Function endpoints to trigger excessive CPU usage, resulting in Denial of Service.

  Affected versions: >= 13.0.0, < 15.5.16 · >= 16.0.0, < 16.2.5

  high

  Fixed in: 15.5.16, 16.2.5

• GHSA-5vj8-3v2h-h38v

  Remote Code Execution in next

  Affected versions: >= 0.9.9, < 5.1.0

  high

  Fixed in: 5.1.0

• GHSA-5j59-xgg2-r9c4

  The fix for CVE-2025-55184 in React Server Components was incomplete. An incomplete patch in React 19.0.2, 19.1.3, and 19.2.2 and Next.js 13.x-16.x App Router allows a specially crafted HTTP request to Server Function endpoints to trigger a

  Affected versions: >= 13.3.1-canary.0, < 14.2.35 · >= 15.0.6, < 15.0.7 · >= 15.1.10, < 15.1.11 · >= 15.2.7, < 15.2.8 · >= 15.3.7, < 15.3.8 · >= 15.4.9, < 15.4.10 · >= 15.5.8, < 15.5.9 · >= 15.6.0-canary.59, < 15.6.0-canary.60 · >= 16.0.9, < 16.0.10 · >= 16.1.0-canary.17, < 16.1.0-canary.19

  high

  Fixed in: 14.2.35, 15.0.7, 15.1.11, 15.2.8

• GHSA-2xp9-vwfh-vxw4

  Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used

  Affected versions: >= 10.0.0, < 15.5.24 · >= 16.0.0, < 16.3.3

  critical

  Fixed in: 15.5.24, 16.3.3