Next.js güvenlik açıklarıNext.js: bilinen açıklar ve güvenli sürümler

Dallara göre açıklar ve güvenli sürüm

Güvenli sürüm: o dalda bu sürüm ve sonrası (dalın son sürümü biliniyorsa ona kadar) bilinen hiçbir kaydın aralığına girmez. Adaylar yalnızca kayıtların kendi düzeltme sürümleri ve dalın son sürümüdür; "Düzeltme yok" dalı terk etmek gerektiği anlamına gelir.

Kayıtlar

En yeniden eskiye. Aralık kaydın kendi verisidir; birden çok aralık dal başına ayrı düzeltmeyi gösterir.

• GHSA-673q-mjm6-r5xr2026-10-22

  Next.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays

  Etkilenen sürümler: >= 16.0.0, < 16.4.1

  kritik

  Düzeltme: 16.4.1

• GHSA-2464-fhr4-w9xw2026-10-22

  Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used

  Etkilenen sürümler: >= 10.0.0, < 15.5.28 · >= 16.0.0, < 16.4.1

  kritik

  Düzeltme: 15.5.28, 16.4.1

• CVE-2026-944822026-10-22

  Next.js: Denial of Service in App Router using Server Actions

  Etkilenen sürümler: >= 13.0.0, < 15.5.28 · >= 16.0.0, < 16.4.1

  yüksek 8.2

  Düzeltme: 15.5.28, 16.4.1

• CVE-2026-945442026-10-02

  Next.js: Pending `use cache` fill can leak Draft Mode content into regular responses and persisted pages

  Etkilenen sürümler: >= 16.3.0, < 16.3.8

  orta 6.3

  Düzeltme: 16.3.8

• CVE-2026-945432026-10-02

  Next.js: Cache poisoning of SSG and ISR pages in self-hosted Next.js applications

  Etkilenen sürümler: >= 15.0.0, < 15.5.27 · >= 16.0.0, < 16.3.8

  orta 6.3

  Düzeltme: 15.5.27, 16.3.8

• CVE-2026-944862026-10-02

  Next.js: Information disclosure in the Next.js development server's Model Context Protocol endpoint

  Etkilenen sürümler: >= 16.0.0, < 16.3.8

  düşük 2.3

  Düzeltme: 16.3.8

• CVE-2026-944852026-10-02

  Next.js: Information disclosure in Next.js App Router metadata image routes via dynamicParams bypass

  Etkilenen sürümler: >= 16.0.0, < 16.3.8

  orta 6.3

  Düzeltme: 16.3.8

• CVE-2026-944842026-10-02

  Next.js: Cache poisoning in Next.js SSG/ISR rendering leads to cross-user content substitution and persistent denial of service

  Etkilenen sürümler: >= 16.0.0, < 16.3.8 · >= 15.0.0, < 15.5.27

  orta 6.3

  Düzeltme: 15.5.27, 16.3.8

• CVE-2026-944832026-10-02

  Next.js: Server-Side Request Forgery in Image Optimization

  Etkilenen sürümler: >= 16.0.0, < 16.3.8

  yüksek 8.3

  Düzeltme: 16.3.8

• CVE-2026-1030042026-10-01

  next.js cache leak on warm `use cache` handlers accessing root param

  Etkilenen sürümler: >= 16.3.0, < 16.3.8

  orta 6.3

  Düzeltme: 16.3.8

• CVE-2026-94545istismar kodu var2026-09-30

  Satori-generated SVG has improper escaping

  Etkilenen sürümler: >= 16.2.0, < 16.3.6

  orta 5.3

  Düzeltme: 16.3.6

  EPSS %1

• GHSA-2xp9-vwfh-vxw42026-09-08

  Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used

  Etkilenen sürümler: >= 10.0.0, < 15.5.24 · >= 16.0.0, < 16.3.3

  kritik

  Düzeltme: 15.5.24, 16.3.3

• CVE-2026-75604silahlaştırılmış2026-09-01

  Next.js: Unauthenticated Remote Code Execution on windows-hosted servers

  Etkilenen sürümler: >= 13.4.0, < 15.5.24 · >= 16.0.0, < 16.3.3

  kritik 9.0

  Düzeltme: 15.5.24, 16.3.3

  EPSS %2,1

• CVE-2026-646492026-07-27

  Next.js: Server-Side Request Forgery in Server Actions on Custom Servers

  Etkilenen sürümler: >= 14.1.1, < 15.5.21 · >= 16.0.0, < 16.2.11

  yüksek 8.3

  Düzeltme: 15.5.21, 16.2.11

• CVE-2026-646482026-07-27

  Next.js: Response Body Cache Confusion for Requests Containing Bodies

  Etkilenen sürümler: >= 13.0.0, < 15.5.21 · >= 16.0.0, < 16.2.11

  orta 6.0

  Düzeltme: 15.5.21, 16.2.11

• CVE-2026-646472026-07-27

  Next.js: Response Body Cache Confusion with Invalid UTF-8 Request Bodies

  Etkilenen sürümler: >= 13.0.0, < 15.5.21 · >= 16.0.0, < 16.2.11

  orta 6.3

  Düzeltme: 15.5.21, 16.2.11

• CVE-2026-646462026-07-27

  Next.js: Unbounded Server Action payload in Edge runtime

  Etkilenen sürümler: >= 13.0.0, < 15.5.21 · >= 16.0.0, < 16.2.11

  orta 6.3

  Düzeltme: 15.5.21, 16.2.11

• CVE-2026-646452026-07-27

  Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname

  Etkilenen sürümler: >= 12.0.0, < 15.5.21 · >= 16.0.0, < 16.2.11

  yüksek 8.3

  Düzeltme: 15.5.21, 16.2.11

• CVE-2026-646442026-07-27

  Next.js: Denial of Service in the Image Optimization API using SVGs

  Etkilenen sürümler: >= 15.5.0, < 15.5.21 · >= 16.0.0, < 16.2.11

  orta 6.3

  Düzeltme: 15.5.21, 16.2.11

• CVE-2026-646432026-07-27

  Next.js: Unauthenticated Disclosure of Internal Server Function endpoints

  Etkilenen sürümler: >= 13.0.0, < 15.5.21 · >= 16.0.0, < 16.2.11

  orta 6.3

  Düzeltme: 15.5.21, 16.2.11

• CVE-2026-646422026-07-27

  Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale

  Etkilenen sürümler: >= 16.0.0, < 16.2.11

  yüksek 8.3

  Düzeltme: 16.2.11

• CVE-2026-646412026-07-27

  Next.js: Denial of Service in App Router using Server Actions

  Etkilenen sürümler: >= 13.0.0, < 15.5.21 · >= 16.0.0, < 16.2.11

  yüksek 8.2

  Düzeltme: 15.5.21, 16.2.11

• CVE-2025-71389istismar kodu var2026-07-23

  Cal.com before 5.9.9 Remote Code Execution via RSC

  Etkilenen sürümler: >= 14.3.0-canary.77, < 15.0.5 · >= 15.1.0-canary.0, < 15.1.9 · >= 15.2.0-canary.0, < 15.2.6 · >= 15.3.0-canary.0, < 15.3.6 · >= 15.4.0-canary.0, < 15.4.8 · >= 15.5.0-canary.0, < 15.5.7 · >= 16.0.0-canary.0, < 16.0.7

  kritik 10.0

  Düzeltme: 15.0.5, 15.1.9, 15.2.6, 15.3.6

  EPSS %1,3

• CVE-2026-451092026-05-13

  Next.js: Middleware / Proxy bypass in App Router applications via segment-prefetch routes

  Etkilenen sürümler: >= 15.2.0, < 15.5.18 · >= 16.0.0, < 16.2.6

  yüksek 7.5

  Düzeltme: 15.5.18, 16.2.6

• CVE-2026-445822026-05-13

  Next.js: Cache poisoning via collisions in React Server Component cache-busting

  Etkilenen sürümler: >= 13.4.6, < 15.5.16 · >= 16.0.0, < 16.2.5

  düşük 3.7

  Düzeltme: 15.5.16, 16.2.5

• CVE-2026-445812026-05-13

  Next.js: Cross-site scripting in App Router applications using CSP nonces

  Etkilenen sürümler: >= 13.4.0, < 15.5.16 · >= 16.0.0, < 16.2.5

  orta 4.7

  Düzeltme: 15.5.16, 16.2.5

• CVE-2026-445802026-05-13

  Next.js: Cross-site scripting in beforeInteractive scripts with untrusted input

  Etkilenen sürümler: >= 13.0.0, < 15.5.16 · >= 16.0.0, < 16.2.5

  orta 6.1

  Düzeltme: 15.5.16, 16.2.5

• CVE-2026-44579istismar kodu var2026-05-13

  Next.js: Denial of Service via connection exhaustion in applications using Cache Components

  Etkilenen sürümler: >= 15.0.0, < 15.5.16 · >= 16.0.0, < 16.2.5

  yüksek 7.5

  Düzeltme: 15.5.16, 16.2.5

• CVE-2026-44578istismar kodu var2026-05-13

  Next.js: Server-side request forgery in applications using WebSocket upgrades

  Etkilenen sürümler: >= 13.4.13, < 15.5.16 · >= 16.0.0, < 16.2.5

  yüksek 8.6

  Düzeltme: 15.5.16, 16.2.5

  EPSS %1,8

• CVE-2026-445772026-05-13

  Next.js: Denial of Service in the Image Optimization API

  Etkilenen sürümler: >= 10.0.0, < 15.5.16 · >= 16.0.0, < 16.2.5

  orta 5.9

  Düzeltme: 15.5.16, 16.2.5

• CVE-2026-445762026-05-13

  Next.js: Cache poisoning in React Server Component responses

  Etkilenen sürümler: >= 14.2.0, < 15.5.16 · >= 16.0.0, < 16.2.5

  orta 5.4

  Düzeltme: 15.5.16, 16.2.5

• CVE-2026-445752026-05-13

  Next.js: Middleware / Proxy bypass in App Router applications via segment-prefetch routes

  Etkilenen sürümler: >= 15.2.0, < 15.5.16 · >= 16.0.0, < 16.2.5

  yüksek 7.5

  Düzeltme: 15.5.16, 16.2.5

• CVE-2026-445742026-05-13

  Next.js: Middleware / Proxy bypass through dynamic route parameter injection

  Etkilenen sürümler: >= 15.4.0, < 15.5.16 · >= 16.0.0, < 16.2.5

  yüksek 8.1

  Düzeltme: 15.5.16, 16.2.5

• CVE-2026-445732026-05-13

  Next.js: Middleware / Proxy bypass in Pages Router applications using i18n

  Etkilenen sürümler: >= 12.2.0, < 15.5.16 · >= 16.0.0, < 16.2.5

  yüksek 7.5

  Düzeltme: 15.5.16, 16.2.5

• CVE-2026-445722026-05-13

  Next.js: Middleware / Proxy redirects can be cache-poisoned

  Etkilenen sürümler: >= 12.2.0, < 15.5.16 · >= 16.0.0, < 16.2.5

  orta 5.9

  Düzeltme: 15.5.16, 16.2.5

• GHSA-8h8q-6873-q5fj2026-05-11

  Next.js Vulnerable to Denial of Service with Server Components

  Etkilenen sürümler: >= 13.0.0, < 15.5.16 · >= 16.0.0, < 16.2.5

  yüksek 7.5

  Düzeltme: 15.5.16, 16.2.5

• GHSA-q4gf-8mx6-v5v32026-04-10

  Next.js has a Denial of Service with Server Components

  Etkilenen sürümler: >= 13.0.0, < 15.5.15 · >= 16.0.0-beta.0, < 16.2.3

  yüksek 7.5

  Düzeltme: 15.5.15, 16.2.3

• CVE-2026-29057istismar kodu var2026-03-17

  Next.js: HTTP request smuggling in rewrites

  Etkilenen sürümler: >= 16.0.0-beta.0, < 16.1.7 · >= 9.5.0, < 15.5.13

  orta 6.3

  Düzeltme: 15.5.13, 16.1.7

• CVE-2026-279802026-03-17

  Next.js: Unbounded next/image disk cache growth can exhaust storage

  Etkilenen sürümler: >= 16.0.0-beta.0, < 16.1.7 · >= 10.0.0, < 15.5.14

  orta 6.9

  Düzeltme: 15.5.14, 16.1.7

• CVE-2026-279792026-03-17

  Next.js: Unbounded postponed resume buffering can lead to DoS

  Etkilenen sürümler: >= 16.0.1, < 16.1.7

  orta 6.9

  Düzeltme: 16.1.7

• CVE-2026-27978istismar kodu var2026-03-17

  Next.js: null origin can bypass Server Actions CSRF checks

  Etkilenen sürümler: >= 16.0.1, < 16.1.7

  orta 5.3

  Düzeltme: 16.1.7

• CVE-2026-279772026-03-17

  Next.js: null origin can bypass dev HMR websocket CSRF checks

  Etkilenen sürümler: >= 16.0.1, < 16.1.7

  düşük 2.3

  Düzeltme: 16.1.7

• GHSA-h25m-26qc-wcjf2026-01-28

  Next.js HTTP request deserialization can lead to DoS when using insecure React Server Components

  Etkilenen sürümler: >= 13.0.0, < 15.0.8 · >= 15.1.1-canary.0, < 15.1.12 · >= 15.2.0-canary.0, < 15.2.9 · >= 15.3.0-canary.0, < 15.3.9 · >= 15.4.0-canary.0, < 15.4.11 · >= 15.5.1-canary.0, < 15.5.10 · >= 15.6.0-canary.0, < 15.6.0-canary.61 · >= 16.0.0-beta.0, < 16.0.11 · >= 16.1.0-canary.0, < 16.1.5

  yüksek 7.5

  Düzeltme: 15.0.8, 15.1.12, 15.2.9, 15.3.9

• CVE-2025-594722026-01-26

  A denial of service vulnerability exists in Next.js versions with Partial Prerendering (PPR) enabled when running in minimal mode.

  Etkilenen sürümler: >= 16.0.0-beta.0, < 16.1.5 · >= 15.0.0-canary.0, <= 15.0.0-canary.205 · >= 15.0.1-canary.0, <= 15.0.1-canary.3 · >= 15.0.2-canary.0, <= 15.0.2-canary.11 · >= 15.0.3-canary.0, <= 15.0.3-canary.9 · >= 15.0.4-canary.0, <= 15.0.4-canary.52 · >= 15.1.1-canary.0, <= 15.1.1-canary.27 · >= 15.2.0-canary.0, <= 15.2.0-canary.77 · >= 15.2.1-canary.0, <= 15.2.1-canary.6 · >= 15.2.2-canary.0, <= 15.2.2-canary.7 · >= 15.3.0-canary.0, <= 15.3.0-canary.46 · >= 15.3.1-canary.0, <= 15.3.1-canary.15 · >= 15.4.0-canary.0, <= 15.4.0-canary.130 · >= 15.4.2-canary.0, <= 15.4.2-canary.56 · >= 15.5.1-canary.0, <= 15.5.1-canary.39 · >= 15.6.0-canary.0, < 15.6.0-canary.61 · >= 15.0.0-canary.0, < 15.0.0-canary.206 · >= 15.0.1-canary.0, < 15.0.1-canary.4 · >= 15.0.2-canary.0, < 15.0.2-canary.12 · >= 15.0.3-canary.0, < 15.0.3-canary.10 · >= 15.0.4-canary.0, < 15.0.4-canary.53 · >= 15.1.1-canary.0, < 15.1.1-canary.28 · >= 15.2.0-canary.0, < 15.2.0-canary.78 · >= 15.2.1-canary.0, < 15.2.1-canary.7 · >= 15.2.2-canary.0, < 15.2.2-canary.8 · >= 15.3.0-canary.0, < 15.3.0-canary.47 · >= 15.3.1-canary.0, < 15.3.1-canary.16 · >= 15.4.0-canary.0, < 15.4.0-canary.131 · >= 15.4.2-canary.0, < 15.4.2-canary.57 · >= 15.5.1-canary.0, < 15.5.1-canary.40

  yüksek 7.5

  Düzeltme: 16.1.5

• CVE-2025-594712026-01-26

  A denial of service vulnerability exists in self-hosted Next.js applications that have `remotePatterns` configured for the Image Optimizer.

  Etkilenen sürümler: >= 10.0.0, < 15.5.10 · >= 15.6.0-canary.0, < 16.1.5

  yüksek 7.5

  Düzeltme: 15.5.10, 16.1.5

• GHSA-5j59-xgg2-r9c42025-12-12

  Next has a Denial of Service with Server Components - Incomplete Fix Follow-Up

  Etkilenen sürümler: >= 13.3.1-canary.0, < 14.2.35 · >= 15.0.6, < 15.0.7 · >= 15.1.10, < 15.1.11 · >= 15.2.7, < 15.2.8 · >= 15.3.7, < 15.3.8 · >= 15.4.9, < 15.4.10 · >= 15.5.8, < 15.5.9 · >= 15.6.0-canary.59, < 15.6.0-canary.60 · >= 16.0.9, < 16.0.10 · >= 16.1.0-canary.17, < 16.1.0-canary.19

  yüksek 7.5

  Düzeltme: 14.2.35, 15.0.7, 15.1.11, 15.2.8

• GHSA-w37m-7fhw-fmv92025-12-11

  Next Server Actions Source Code Exposure

  Etkilenen sürümler: >= 15.0.0-canary.0, < 15.0.6 · >= 15.1.1-canary.0, < 15.1.10 · >= 15.2.0-canary.0, < 15.2.7 · >= 15.3.0-canary.0, < 15.3.7 · >= 15.4.0-canary.0, < 15.4.9 · >= 15.5.1-canary.0, < 15.5.8 · >= 15.6.0-canary.0, < 15.6.0-canary.59 · >= 16.0.0-beta.0, < 16.0.9 · >= 16.1.0-canary.0, < 16.1.0-canary.17

  orta 5.3

  Düzeltme: 15.0.6, 15.1.10, 15.2.7, 15.3.7

• GHSA-mwv6-3258-q52c2025-12-11

  Next Vulnerable to Denial of Service with Server Components

  Etkilenen sürümler: >= 13.3.0, < 14.2.34 · >= 15.0.0-canary.0, < 15.0.6 · >= 15.1.1-canary.0, < 15.1.10 · >= 15.2.0-canary.0, < 15.2.7 · >= 15.3.0-canary.0, < 15.3.7 · >= 15.4.0-canary.0, < 15.4.9 · >= 15.5.1-canary.0, < 15.5.8 · >= 15.6.0-canary.0, < 15.6.0-canary.59 · >= 16.0.0-beta.0, < 16.0.9 · >= 16.1.0-canary.0, < 16.1.0-canary.17

  yüksek 7.5

  Düzeltme: 14.2.34, 15.0.6, 15.1.10, 15.2.7

• CVE-2025-57822istismar kodu var2025-08-29

  Next.js Improper Middleware Redirect Handling Leads to SSRF

  Etkilenen sürümler: >= 0.9.9, < 14.2.32 · >= 15.0.0-canary.0, < 15.4.7

  yüksek 8.2

  Düzeltme: 14.2.32, 15.4.7

  EPSS %2,5

• CVE-2025-577522025-08-29

  Next.js Affected by Cache Key Confusion for Image Optimization API Routes

  Etkilenen sürümler: >= 0.9.9, < 14.2.31 · >= 15.0.0, < 15.4.5

  orta 6.2

  Düzeltme: 14.2.31, 15.4.5

• CVE-2025-551732025-08-29

  Next.js Content Injection Vulnerability for Image Optimization

  Etkilenen sürümler: >= 0.9.9, < 14.2.31 · >= 15.0.0, < 15.4.5

  orta 4.3

  Düzeltme: 14.2.31, 15.4.5

• CVE-2025-498262025-07-03

  Next.js DoS vulnerability via cache poisoning

  Etkilenen sürümler: >= 15.0.4-canary.51, < 15.1.8

  yüksek 7.5

  Düzeltme: 15.1.8

  EPSS %1,1

• CVE-2025-490052025-07-03

  Next.js cache poisoning due to omission of Vary header

  Etkilenen sürümler: >= 15.3.0, < 15.3.3

  düşük 3.7

  Düzeltme: 15.3.3

• CVE-2025-480682025-05-30

  Information exposure in Next.js dev server due to lack of origin verification

  Etkilenen sürümler: >= 15.0.0, < 15.2.2 · >= 13.0, < 14.2.30

  düşük 2.3

  Düzeltme: 14.2.30, 15.2.2

• CVE-2025-32421istismar kodu var2025-05-14

  Next.js Race Condition to Cache Poisoning

  Etkilenen sürümler: >= 0.9.9, < 14.2.24 · >= 15.0.0, < 15.1.6

  düşük 3.7

  Düzeltme: 14.2.24, 15.1.6

• CVE-2025-302182025-04-02

  Next.js may leak x-middleware-subrequest-id to external hosts

  Etkilenen sürümler: >= 12.3.5, < 12.3.6 · >= 13.5.9, < 13.5.10 · >= 14.2.25, < 14.2.26 · >= 15.2.3, < 15.2.4

  düşük 1.7

  Düzeltme: 12.3.6, 13.5.10, 14.2.26, 15.2.4

• CVE-2025-29927silahlaştırılmış2025-03-21

  Authorization Bypass in Next.js Middleware

  Etkilenen sürümler: >= 13.0.0, < 13.5.9 · >= 14.0.0, < 14.2.25 · >= 15.0.0, < 15.2.3 · >= 12.0.0, < 12.3.5

  kritik 9.1

  Düzeltme: 12.3.5, 13.5.9, 14.2.25, 15.2.3

  EPSS %99,2

• CVE-2024-563322025-01-03

  Next.js Vulnerable to Denial of Service (DoS) with Server Actions

  Etkilenen sürümler: >= 13.0.0, < 13.5.8 · >= 14.0.0, < 14.2.21 · >= 15.0.0, < 15.1.2

  orta 5.3

  Düzeltme: 13.5.8, 14.2.21, 15.1.2

• CVE-2024-514792024-12-17

  Authorization bypass in Next.js

  Etkilenen sürümler: >= 9.5.5, < 14.2.15

  yüksek 7.5

  Düzeltme: 14.2.15

  EPSS %3,9

• CVE-2024-478312024-10-14

  Next.js image optimization has Denial of Service condition

  Etkilenen sürümler: >= 10.0.0, < 14.2.7

  yüksek 7.5

  Düzeltme: 14.2.7

• CVE-2024-46982istismar kodu var2024-09-17

  Cache Poisoning in next.js

  Etkilenen sürümler: >= 13.5.1, < 13.5.7 · >= 14.0.0, < 14.2.10

  yüksek 7.5

  Düzeltme: 13.5.7, 14.2.10

  EPSS %59,1

• CVE-2024-396932024-07-10

  Next.js Denial of Service (DoS) condition

  Etkilenen sürümler: >= 13.3.1, < 13.5.0

  yüksek 7.5

  Düzeltme: 13.5.0

• CVE-2024-34351istismar kodu var2024-05-14

  Next.js Server-Side Request Forgery in Server Actions

  Etkilenen sürümler: >= 13.4.0, < 14.1.1

  yüksek 7.5

  Düzeltme: 14.1.1

  EPSS %5,4

• CVE-2024-343502024-05-14

  Next.js Vulnerable to HTTP Request Smuggling

  Etkilenen sürümler: >= 13.4.0, < 13.5.1

  yüksek 7.5

  Düzeltme: 13.5.1

  EPSS %1,1

• CVE-2023-462982023-10-21

  Next.js before 13.4.20-canary.13 lacks a cache-control header and thus empty prefetch responses may sometimes be cached by a CDN, causing a

  Etkilenen sürümler: >= 0.9.9, < 13.4.20-canary.13

  yüksek 7.5

  Düzeltme: 13.4.20-canary.13

  EPSS %1,2

• CVE-2022-360462022-08-31

  Unexpected server crash in Next.js version 12.2.3

  Etkilenen sürümler: >= 12.2.3, < 12.2.4

  orta 5.3

  Düzeltme: 12.2.4

  EPSS %1,1

• CVE-2022-236462022-02-17

  Improper CSP in Image Optimization API for Next.js

  Etkilenen sürümler: >= 10.0.0, < 12.1.0

  yüksek 7.5

  Düzeltme: 12.1.0

  EPSS %1,7

• CVE-2022-217212022-01-28

  DOS Vulnerability in next.js

  Etkilenen sürümler: >= 12.0.0, < 12.0.9

  yüksek 7.5

  Düzeltme: 12.0.9

  EPSS %2,1

• CVE-2021-438032021-12-09

  Unexpected server crash in Next.js

  Etkilenen sürümler: >= 12.0.0, < 12.0.5 · >= 0.9.9, < 11.1.3

  yüksek 7.5

  Düzeltme: 11.1.3, 12.0.5

  EPSS %47,2

• CVE-2021-391782021-08-30

  XSS in Image Optimization API for Next.js versions between 10.0.0 and 11.1.0

  Etkilenen sürümler: >= 10.0.0, < 11.1.1

  orta 6.1

  Düzeltme: 11.1.1

  EPSS %1,1

• CVE-2021-376992021-08-11

  Open Redirect in Next.js versions below 11.1.0

  Etkilenen sürümler: >= 0.9.9, < 11.1.0

  orta 6.1

  Düzeltme: 11.1.0

  EPSS %1

• CVE-2020-152422020-10-08

  Open Redirect in Next.js

  Etkilenen sürümler: >= 9.5.0, < 9.5.4

  orta 6.1

  Düzeltme: 9.5.4

• GHSA-5vj8-3v2h-h38v2020-09-04

  Remote Code Execution in next

  Etkilenen sürümler: >= 0.9.9, < 5.1.0

  yüksek

  Düzeltme: 5.1.0

• CVE-2020-5284istismar kodu var2020-03-30

  Directory Traversal in Next.js versions below 9.3.2

  Etkilenen sürümler: >= 0.9.9, < 9.3.2

  orta 4.3

  Düzeltme: 9.3.2

  EPSS %44,7

• CVE-2018-182822018-10-12

  Next.js 7.0.0 and 7.0.1 has XSS via the 404 or 500 /_error page.

  Etkilenen sürümler: >= 7.0.0, < 7.0.2

  orta 6.1

  Düzeltme: 7.0.2

  EPSS %1

• CVE-2018-6184istismar kodu var2018-01-24

  ZEIT Next.js 4 before 4.2.3 has Directory Traversal under the /_next request namespace.

  Etkilenen sürümler: >= 1.0.0, < 4.2.3

  yüksek 7.5

  Düzeltme: 4.2.3

  EPSS %9

• CVE-2017-16877istismar kodu var2017-11-17

  ZEIT Next.js before 2.4.1 has directory traversal under the /_next and /static request namespace, allowing attackers to obtain sensitive inf

  Etkilenen sürümler: >= 1.0.0, < 2.4.1

  yüksek 7.5

  Düzeltme: 2.4.1

  EPSS %14,1

• GHSA-vcvr-r3jv-pc5j

  Next.js: Remote Code Execution in next/og ImageResponse

  Etkilenen sürümler: >= 16.2.0, < 16.3.6

  kritik

  Düzeltme: 16.3.6