nextjs.vnEnglish

Lỗ hổng bảo mật Next.js

65 cảnh báo chạm tới Next.js 13 trở lên, mới nhất trước. Cập nhật 29/10/2026.

Tóm tắt giữ nguyên tiếng Anh như trong cảnh báo gốc.

Ngày công bốMức độCảnh báoTóm tắtBản bị ảnh hưởng → bản vá
22/10/2026Nghiêm trọngCVSS 9.5GHSA-2464-fhr4-w9xwNext.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used
  • >= 10.0.0, <= 15.5.27 → 15.5.28
  • >= 16.0.0, <= 16.4.0 → 16.4.1
22/10/2026Nghiêm trọngCVSS 9.5GHSA-673q-mjm6-r5xrNext.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays
  • >= 16.0.0, <= 16.4.0 → 16.4.1
22/10/2026Trung bìnhCVSS 6.3GHSA-h694-7cp9-m8p3CVE-2026-103004next.js cache leak across root param values in nested 'use cache' functions
  • >= 16.3.0, < 16.3.8 → 16.3.8
22/10/2026CaoCVSS 8.2GHSA-p3m5-59mp-jv5rCVE-2026-94482Next.js: Denial of Service in App Router using Server Actions
  • >= 13.0.0, <= 15.5.27 → 15.5.28
  • >= 16.0.0, <= 16.4.0 → 16.4.1
07/10/2026ThấpCVSS 2.3GHSA-39w2-rjm5-chcvCVE-2026-94486Next.js has information disclosure in development server's Model Context Protocol endpoint
  • >= 16.0.0, < 16.3.8 → 16.3.8
07/10/2026Trung bìnhCVSS 6.3GHSA-3w37-wq28-93x7CVE-2026-94544Next.js: Pending `use cache` fill can leak Draft Mode content into regular responses and persisted pages
  • >= 16.3.0, < 16.3.8 → 16.3.8
07/10/2026Trung bìnhCVSS 6.3GHSA-4jqv-mc3x-m676CVE-2026-94543Next.js has cache poisoning of SSG and ISR pages in self-hosted applications
  • >= 15.0.0, < 15.5.27 → 15.5.27
  • >= 16.0.0, < 16.3.8 → 16.3.8
07/10/2026CaoCVSS 8.3GHSA-cjq9-62q9-8jv4CVE-2026-94483Next.js has Server-Side Request Forgery in Image Optimization
  • >= 16.0.0, < 16.3.8 → 16.3.8
07/10/2026Trung bìnhCVSS 6.3GHSA-f87g-xv8r-7p7xCVE-2026-94485Next.js has information disclosure in App Router metadata image routes via dynamicParams bypass
  • >= 16.0.0, < 16.3.8 → 16.3.8
07/10/2026Trung bìnhCVSS 6.3GHSA-mcj8-r9mp-w47pCVE-2026-94484Next.js has cache poisoning in SSG/ISR rendering that leads to cross-user content substitution and persistent denial of service
  • >= 16.0.0, < 16.3.8 → 16.3.8
  • >= 15.0.0, < 15.5.27 → 15.5.27
30/09/2026Nghiêm trọngCVSS 9.5GHSA-vcvr-r3jv-pc5jNext.js: Remote Code Execution in next/og ImageResponse
  • >= 16.2.0, < 16.3.6 → 16.3.6
08/09/2026Nghiêm trọngCVSS 9.5GHSA-2xp9-vwfh-vxw4Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used
  • >= 10.0.0, < 15.5.24 → 15.5.24
  • >= 16.0.0, < 16.3.3 → 16.3.3
08/09/2026Nghiêm trọngCVSS 9GHSA-p293-qw3h-jr36CVE-2026-75604Next.js: Unauthenticated Remote Code Execution on windows-hosted servers
  • >= 13.4.0, < 15.5.24 → 15.5.24
  • >= 16.0.0, < 16.3.3 → 16.3.3
22/07/2026Trung bìnhCVSS 6.3GHSA-4633-3j49-mh5qCVE-2026-64647Next.js: Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences
  • >= 13.0.0, < 15.5.21 → 15.5.21
  • >= 16.0.0, < 16.2.11 → 16.2.11
22/07/2026Trung bìnhCVSS 6.3GHSA-4c39-4ccg-62r3CVE-2026-64646Next.js: Unbounded Server Action payload in Edge runtime
  • >= 13.0.0, < 15.5.21 → 15.5.21
  • >= 16.0.0, < 16.2.11 → 16.2.11
22/07/2026Trung bìnhCVSS 6GHSA-68g3-v927-f742CVE-2026-64648Next.js: Cache confusion of response bodies for requests with bodies
  • >= 13.0.0, < 15.5.21 → 15.5.21
  • >= 16.0.0, < 16.2.11 → 16.2.11
22/07/2026CaoCVSS 8.3GHSA-6gpp-xcg3-4w24CVE-2026-64642Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale
  • >= 16.0.0, < 16.2.11 → 16.2.11
22/07/2026CaoCVSS 8.3GHSA-89xv-2m56-2m9xCVE-2026-64649Next.js: Server-Side Request Forgery in Server Actions on custom servers
  • >= 14.1.1, < 15.5.21 → 15.5.21
  • >= 16.0.0, < 16.2.11 → 16.2.11
22/07/2026Trung bìnhCVSS 6.3GHSA-955p-x3mx-jcvpCVE-2026-64643Next.js: Unauthenticated disclosure of internal Server Function endpoints
  • >= 13.0.0, < 15.5.21 → 15.5.21
  • >= 16.0.0, < 16.2.11 → 16.2.11
22/07/2026CaoCVSS 8.2GHSA-m99w-x7hq-7vfjCVE-2026-64641Next.js: Denial of Service in App Router using Server Actions
  • >= 13.0.0, < 15.5.21 → 15.5.21
  • >= 16.0.0, < 16.2.11 → 16.2.11
22/07/2026CaoCVSS 8.3GHSA-p9j2-gv94-2wf4CVE-2026-64645Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname
  • >= 12.0.0, < 15.5.21 → 15.5.21
  • >= 16.0.0, < 16.2.11 → 16.2.11
22/07/2026Trung bìnhCVSS 6.3GHSA-q8wf-6r8g-63chCVE-2026-64644Next.js: Denial of Service in the Image Optimization API using SVGs
  • >= 15.5.0, < 15.5.21 → 15.5.21
  • >= 16.0.0, < 16.2.11 → 16.2.11
11/05/2026CaoCVSS 7.5GHSA-267c-6grr-h53fCVE-2026-44575Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes
  • >= 15.2.0, < 15.5.16 → 15.5.16
  • >= 16.0.0, < 16.2.5 → 16.2.5
11/05/2026CaoCVSS 7.5GHSA-26hh-7cqf-hhc6CVE-2026-45109Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Up
  • >= 15.2.0, < 15.5.18 → 15.5.18
  • >= 16.0.0, < 16.2.6 → 16.2.6
11/05/2026CaoCVSS 7.5GHSA-36qx-fr4f-26g5CVE-2026-44573Next.js has a Middleware / Proxy bypass in Pages Router applications using i18n
  • >= 12.2.0, < 15.5.16 → 15.5.16
  • >= 16.0.0, < 16.2.5 → 16.2.5
11/05/2026ThấpCVSS 3.7GHSA-3g8h-86w9-wvmqCVE-2026-44572Next.js's Middleware / Proxy redirects can be cache-poisoned
  • >= 12.2.0, < 15.5.16 → 15.5.16
  • >= 16.0.0, < 16.2.5 → 16.2.5
11/05/2026CaoCVSS 8.1GHSA-492v-c6pp-mqqvCVE-2026-44574Next.js has a Middleware / Proxy bypass through dynamic route parameter injection
  • >= 15.4.0, < 15.5.16 → 15.5.16
  • >= 16.0.0, < 16.2.5 → 16.2.5
11/05/2026CaoCVSS 7.5GHSA-8h8q-6873-q5fjNext.js Vulnerable to Denial of Service with Server Components
  • >= 13.0.0, < 15.5.16 → 15.5.16
  • >= 16.0.0, < 16.2.5 → 16.2.5
11/05/2026CaoCVSS 8.6GHSA-c4j6-fc7j-m34rCVE-2026-44578Next.js vulnerable to server-side request forgery in applications using WebSocket upgrades
  • >= 13.4.13, < 15.5.16 → 15.5.16
  • >= 16.0.0, < 16.2.5 → 16.2.5
11/05/2026Trung bìnhCVSS 4.7GHSA-ffhc-5mcf-pf4qCVE-2026-44581Next.js vulnerable to cross-site scripting in App Router applications using CSP nonces
  • >= 13.4.0, < 15.5.16 → 15.5.16
  • >= 16.0.0, < 16.2.5 → 16.2.5
11/05/2026Trung bìnhCVSS 6.1GHSA-gx5p-jg67-6x7hCVE-2026-44580Next.js has cross-site scripting in beforeInteractive scripts with untrusted input
  • >= 13.0.0, < 15.5.16 → 15.5.16
  • >= 16.0.0, < 16.2.5 → 16.2.5
11/05/2026Trung bìnhCVSS 5.9GHSA-h64f-5h5j-jqjhCVE-2026-44577Next.js has a Denial of Service in the Image Optimization API
  • >= 10.0.0, < 15.5.16 → 15.5.16
  • >= 16.0.0, < 16.2.5 → 16.2.5
11/05/2026CaoCVSS 7.5GHSA-mg66-mrh9-m8jxCVE-2026-44579Next.js vulnerable to Denial of Service via connection exhaustion in applications using Cache Components
  • >= 15.0.0, < 15.5.16 → 15.5.16
  • >= 16.0.0, < 16.2.5 → 16.2.5
11/05/2026ThấpCVSS 3.7GHSA-vfv6-92ff-j949CVE-2026-44582Next.js vulnerable to cache poisoning via collisions in React Server Component cache-busting
  • >= 13.4.6, < 15.5.16 → 15.5.16
  • >= 16.0.0, < 16.2.5 → 16.2.5
11/05/2026Trung bìnhCVSS 5.4GHSA-wfc6-r584-vfw7CVE-2026-44576Next.js vulnerable to cache poisoning in React Server Component responses
  • >= 14.2.0, < 15.5.16 → 15.5.16
  • >= 16.0.0, < 16.2.5 → 16.2.5
10/04/2026CaoCVSS 7.5GHSA-q4gf-8mx6-v5v3Next.js has a Denial of Service with Server Components
  • >= 13.0.0, < 15.5.15 → 15.5.15
  • >= 16.0.0-beta.0, < 16.2.3 → 16.2.3
17/03/2026Trung bìnhCVSS 6.9GHSA-3x4c-7xq6-9pq8CVE-2026-27980Next.js: Unbounded next/image disk cache growth can exhaust storage
  • >= 16.0.0-beta.0, < 16.1.7 → 16.1.7
  • >= 10.0.0, < 15.5.14 → 15.5.14
17/03/2026Trung bìnhCVSS 6.3GHSA-ggv3-7p47-pfv8CVE-2026-29057Next.js: HTTP request smuggling in rewrites
  • >= 16.0.0-beta.0, < 16.1.7 → 16.1.7
  • >= 9.5.0, < 15.5.13 → 15.5.13
17/03/2026Trung bìnhCVSS 6.9GHSA-h27x-g6w4-24gqCVE-2026-27979Next.js: Unbounded postponed resume buffering can lead to DoS
  • >= 16.0.1, < 16.1.7 → 16.1.7
17/03/2026ThấpCVSS 2.3GHSA-jcc7-9wpm-mj36CVE-2026-27977Next.js: null origin can bypass dev HMR websocket CSRF checks
  • >= 16.0.1, < 16.1.7 → 16.1.7
17/03/2026Trung bìnhCVSS 5.3GHSA-mq59-m269-xvcxCVE-2026-27978Next.js: null origin can bypass Server Actions CSRF checks
  • >= 16.0.1, < 16.1.7 → 16.1.7
28/01/2026Trung bìnhCVSS 5.9GHSA-5f7q-jpqc-wp7hCVE-2025-59472Next.js has Unbounded Memory Consumption via PPR Resume Endpoint
  • >= 16.0.0-beta.0, < 16.1.5 → 16.1.5
  • >= 15.6.0-canary.0, < 15.6.0-canary.61 → 15.6.0-canary.61
  • >= 15.0.0-canary.0, <= 15.0.0-canary.205 → chưa có bản vá
  • >= 15.0.1-canary.0, <= 15.0.1-canary.3 → chưa có bản vá
  • >= 15.0.2-canary.0, <= 15.0.2-canary.11 → chưa có bản vá
  • >= 15.0.3-canary.0, <= 15.0.3-canary.9 → chưa có bản vá
  • >= 15.0.4-canary.0, <= 15.0.4-canary.52 → chưa có bản vá
  • >= 15.1.1-canary.0, <= 15.1.1-canary.27 → chưa có bản vá
  • >= 15.2.0-canary.0, <= 15.2.0-canary.77 → chưa có bản vá
  • >= 15.2.1-canary.0, <= 15.2.1-canary.6 → chưa có bản vá
  • >= 15.2.2-canary.0, <= 15.2.2-canary.7 → chưa có bản vá
  • >= 15.3.0-canary.0, <= 15.3.0-canary.46 → chưa có bản vá
  • >= 15.3.1-canary.0, <= 15.3.1-canary.15 → chưa có bản vá
  • >= 15.4.0-canary.0, <= 15.4.0-canary.130 → chưa có bản vá
  • >= 15.4.2-canary.0, <= 15.4.2-canary.56 → chưa có bản vá
  • >= 15.5.1-canary.0, <= 15.5.1-canary.39 → chưa có bản vá
28/01/2026CaoCVSS 7.5GHSA-h25m-26qc-wcjfNext.js HTTP request deserialization can lead to DoS when using insecure React Server Components
  • >= 13.0.0, < 15.0.8 → 15.0.8
  • >= 15.1.1-canary.0, < 15.1.12 → 15.1.12
  • >= 15.2.0-canary.0, < 15.2.9 → 15.2.9
  • >= 15.3.0-canary.0, < 15.3.9 → 15.3.9
  • >= 15.4.0-canary.0, < 15.4.11 → 15.4.11
  • >= 15.5.1-canary.0, < 15.5.10 → 15.5.10
  • >= 15.6.0-canary.0, < 15.6.0-canary.61 → 15.6.0-canary.61
  • >= 16.0.0-beta.0, < 16.0.11 → 16.0.11
  • >= 16.1.0-canary.0, < 16.1.5 → 16.1.5
27/01/2026Trung bìnhCVSS 5.9GHSA-9g9p-9gw9-jx7fCVE-2025-59471Next.js self-hosted applications vulnerable to DoS via Image Optimizer remotePatterns configuration
  • >= 10.0.0, < 15.5.10 → 15.5.10
  • >= 15.6.0-canary.0, < 16.1.5 → 16.1.5
12/12/2025CaoCVSS 7.5GHSA-5j59-xgg2-r9c4Next has a Denial of Service with Server Components - Incomplete Fix Follow-Up
  • >= 13.3.1-canary.0, < 14.2.35 → 14.2.35
  • >= 15.0.6, < 15.0.7 → 15.0.7
  • >= 15.1.10, < 15.1.11 → 15.1.11
  • >= 15.2.7, < 15.2.8 → 15.2.8
  • >= 15.3.7, < 15.3.8 → 15.3.8
  • >= 15.4.9, < 15.4.10 → 15.4.10
  • >= 15.5.8, < 15.5.9 → 15.5.9
  • >= 15.6.0-canary.59, < 15.6.0-canary.60 → 15.6.0-canary.60
  • >= 16.0.9, < 16.0.10 → 16.0.10
  • >= 16.1.0-canary.17, < 16.1.0-canary.19 → 16.1.0-canary.19
11/12/2025CaoCVSS 7.5GHSA-mwv6-3258-q52cNext Vulnerable to Denial of Service with Server Components
  • >= 13.3.0, < 14.2.34 → 14.2.34
  • >= 15.0.0-canary.0, < 15.0.6 → 15.0.6
  • >= 15.1.1-canary.0, < 15.1.10 → 15.1.10
  • >= 15.2.0-canary.0, < 15.2.7 → 15.2.7
  • >= 15.3.0-canary.0, < 15.3.7 → 15.3.7
  • >= 15.4.0-canary.0, < 15.4.9 → 15.4.9
  • >= 15.5.1-canary.0, < 15.5.8 → 15.5.8
  • >= 15.6.0-canary.0, < 15.6.0-canary.59 → 15.6.0-canary.59
  • >= 16.0.0-beta.0, < 16.0.9 → 16.0.9
  • >= 16.1.0-canary.0, < 16.1.0-canary.17 → 16.1.0-canary.17
11/12/2025Trung bìnhCVSS 5.3GHSA-w37m-7fhw-fmv9Next Server Actions Source Code Exposure
  • >= 15.0.0-canary.0, < 15.0.6 → 15.0.6
  • >= 15.1.1-canary.0, < 15.1.10 → 15.1.10
  • >= 15.2.0-canary.0, < 15.2.7 → 15.2.7
  • >= 15.3.0-canary.0, < 15.3.7 → 15.3.7
  • >= 15.4.0-canary.0, < 15.4.9 → 15.4.9
  • >= 15.5.1-canary.0, < 15.5.8 → 15.5.8
  • >= 15.6.0-canary.0, < 15.6.0-canary.59 → 15.6.0-canary.59
  • >= 16.0.0-beta.0, < 16.0.9 → 16.0.9
  • >= 16.1.0-canary.0, < 16.1.0-canary.17 → 16.1.0-canary.17
03/12/2025Nghiêm trọngCVSS 10GHSA-9qr9-h5gf-34mpNext.js is vulnerable to RCE in React flight protocol
  • >= 14.3.0-canary.77, < 15.0.5 → 15.0.5
  • >= 15.2.0-canary.0, < 15.2.6 → 15.2.6
  • >= 15.3.0-canary.0, < 15.3.6 → 15.3.6
  • >= 15.4.0-canary.0, < 15.4.8 → 15.4.8
  • >= 16.0.0-canary.0, < 16.0.7 → 16.0.7
  • >= 15.1.0-canary.0, < 15.1.9 → 15.1.9
  • >= 15.5.0-canary.0, < 15.5.7 → 15.5.7
29/08/2025Trung bìnhCVSS 6.5GHSA-4342-x723-ch2fCVE-2025-57822Next.js Improper Middleware Redirect Handling Leads to SSRF
  • >= 15.0.0-canary.0, < 15.4.7 → 15.4.7
  • >= 0.9.9, < 14.2.32 → 14.2.32
29/08/2025Trung bìnhCVSS 6.2GHSA-g5qg-72qw-gw5vCVE-2025-57752Next.js Affected by Cache Key Confusion for Image Optimization API Routes
  • >= 15.0.0, <= 15.4.4 → 15.4.5
  • >= 0.9.9, < 14.2.31 → 14.2.31
29/08/2025Trung bìnhCVSS 4.3GHSA-xv57-4mr9-wg8vCVE-2025-55173Next.js Content Injection Vulnerability for Image Optimization
  • >= 15.0.0, <= 15.4.4 → 15.4.5
  • >= 0.9.9, < 14.2.31 → 14.2.31
03/07/2025CaoCVSS 7.5GHSA-67rr-84xm-4c7rCVE-2025-49826Next.JS vulnerability can lead to DoS via cache poisoning
  • >= 15.0.4-canary.51, < 15.1.8 → 15.1.8
03/07/2025ThấpCVSS 3.7GHSA-r2fc-ccr8-96c4CVE-2025-49005Next.js has a Cache poisoning vulnerability due to omission of the Vary header
  • >= 15.3.0, < 15.3.3 → 15.3.3
28/05/2025ThấpCVSS 2.3GHSA-3h52-269p-cp9rCVE-2025-48068Information exposure in Next.js dev server due to lack of origin verification
  • >= 15.0.0, < 15.2.2 → 15.2.2
  • >= 13.0, < 14.2.30 → 14.2.30
15/05/2025ThấpCVSS 3.7GHSA-qpjv-v59x-3qc4CVE-2025-32421Next.js Race Condition to Cache Poisoning
  • >= 15.0.0, < 15.1.6 → 15.1.6
  • >= 0.9.9, < 14.2.24 → 14.2.24
02/04/2025ThấpCVSS 1.7GHSA-223j-4rm8-mrmfCVE-2025-30218Next.js may leak x-middleware-subrequest-id to external hosts
  • = 12.3.5 → 12.3.6
  • = 13.5.9 → 13.5.10
  • = 14.2.25 → 14.2.26
  • = 15.2.3 → 15.2.4
21/03/2025Nghiêm trọngCVSS 9.1GHSA-f82v-jwr5-mffwCVE-2025-29927Authorization Bypass in Next.js Middleware
  • >= 13.0.0, < 13.5.9 → 13.5.9
  • >= 14.0.0, < 14.2.25 → 14.2.25
  • >= 15.0.0, < 15.2.3 → 15.2.3
  • >= 12.0.0, < 12.3.5 → 12.3.5
03/01/2025Trung bìnhCVSS 5.3GHSA-7m27-7ghc-44w9CVE-2024-56332Next.js Allows a Denial of Service (DoS) with Server Actions
  • >= 13.0.0, < 13.5.8 → 13.5.8
  • >= 14.0.0, < 14.2.21 → 14.2.21
  • >= 15.0.0, < 15.1.2 → 15.1.2
17/12/2024CaoCVSS 7.5GHSA-7gfc-8cq8-jh5fCVE-2024-51479Next.js authorization bypass vulnerability
  • >= 9.5.5, < 14.2.15 → 14.2.15
14/10/2024Trung bìnhCVSS 4.6GHSA-g77x-44xx-532mCVE-2024-47831Denial of Service condition in Next.js image optimization
  • >= 10.0.0, < 14.2.7 → 14.2.7
17/09/2024CaoCVSS 8.7GHSA-gp8f-8m3g-qvj9CVE-2024-46982Next.js Cache Poisoning
  • >= 13.5.1, < 13.5.7 → 13.5.7
  • >= 14.0.0, < 14.2.10 → 14.2.10
10/07/2024CaoCVSS 8.7GHSA-fq54-2j52-jc42CVE-2024-39693Next.js Denial of Service (DoS) condition
  • >= 13.3.1, < 13.5.0 → 13.5.0
09/05/2024CaoCVSS 7.5GHSA-77r5-gw3j-2mpfCVE-2024-34350Next.js Vulnerable to HTTP Request Smuggling
  • >= 13.4.0, < 13.5.1 → 13.5.1
09/05/2024CaoCVSS 7.5GHSA-fr5h-rqp8-mj6gCVE-2024-34351Next.js Server-Side Request Forgery in Server Actions
  • >= 13.4.0, < 14.1.1 → 14.1.1
22/10/2023ThấpGHSA-c59h-r6p8-q9wcCVE-2023-46298Next.js missing cache-control header may lead to CDN caching empty reply
  • >= 0.9.9, < 13.4.20-canary.13 → 13.4.20-canary.13

GitHub Advisory Database, CC-BY-4.0.