Next.js security advisories

65 advisories reach Next.js 13 or later, newest first. Updated 2026-10-29.

Critical 7
High 23
Moderate 26
Low 9

Published	Severity	Advisory	Summary	Affected → fixed in
2026-10-22	CriticalCVSS 9.5	GHSA-2464-fhr4-w9xw	Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used	`>= 10.0.0, <= 15.5.27` → `15.5.28` `>= 16.0.0, <= 16.4.0` → `16.4.1`
2026-10-22	CriticalCVSS 9.5	GHSA-673q-mjm6-r5xr	Next.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays	`>= 16.0.0, <= 16.4.0` → `16.4.1`
2026-10-22	ModerateCVSS 6.3	GHSA-h694-7cp9-m8p3CVE-2026-103004	next.js cache leak across root param values in nested 'use cache' functions	`>= 16.3.0, < 16.3.8` → `16.3.8`
2026-10-22	HighCVSS 8.2	GHSA-p3m5-59mp-jv5rCVE-2026-94482	Next.js: Denial of Service in App Router using Server Actions	`>= 13.0.0, <= 15.5.27` → `15.5.28` `>= 16.0.0, <= 16.4.0` → `16.4.1`
2026-10-07	LowCVSS 2.3	GHSA-39w2-rjm5-chcvCVE-2026-94486	Next.js has information disclosure in development server's Model Context Protocol endpoint	`>= 16.0.0, < 16.3.8` → `16.3.8`
2026-10-07	ModerateCVSS 6.3	GHSA-3w37-wq28-93x7CVE-2026-94544	Next.js: Pending `use cache` fill can leak Draft Mode content into regular responses and persisted pages	`>= 16.3.0, < 16.3.8` → `16.3.8`
2026-10-07	ModerateCVSS 6.3	GHSA-4jqv-mc3x-m676CVE-2026-94543	Next.js has cache poisoning of SSG and ISR pages in self-hosted applications	`>= 15.0.0, < 15.5.27` → `15.5.27` `>= 16.0.0, < 16.3.8` → `16.3.8`
2026-10-07	HighCVSS 8.3	GHSA-cjq9-62q9-8jv4CVE-2026-94483	Next.js has Server-Side Request Forgery in Image Optimization	`>= 16.0.0, < 16.3.8` → `16.3.8`
2026-10-07	ModerateCVSS 6.3	GHSA-f87g-xv8r-7p7xCVE-2026-94485	Next.js has information disclosure in App Router metadata image routes via dynamicParams bypass	`>= 16.0.0, < 16.3.8` → `16.3.8`
2026-10-07	ModerateCVSS 6.3	GHSA-mcj8-r9mp-w47pCVE-2026-94484	Next.js has cache poisoning in SSG/ISR rendering that leads to cross-user content substitution and persistent denial of service	`>= 16.0.0, < 16.3.8` → `16.3.8` `>= 15.0.0, < 15.5.27` → `15.5.27`
2026-09-30	CriticalCVSS 9.5	GHSA-vcvr-r3jv-pc5j	Next.js: Remote Code Execution in next/og ImageResponse	`>= 16.2.0, < 16.3.6` → `16.3.6`
2026-09-08	CriticalCVSS 9.5	GHSA-2xp9-vwfh-vxw4	Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used	`>= 10.0.0, < 15.5.24` → `15.5.24` `>= 16.0.0, < 16.3.3` → `16.3.3`
2026-09-08	CriticalCVSS 9	GHSA-p293-qw3h-jr36CVE-2026-75604	Next.js: Unauthenticated Remote Code Execution on windows-hosted servers	`>= 13.4.0, < 15.5.24` → `15.5.24` `>= 16.0.0, < 16.3.3` → `16.3.3`
2026-07-22	ModerateCVSS 6.3	GHSA-4633-3j49-mh5qCVE-2026-64647	Next.js: Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences	`>= 13.0.0, < 15.5.21` → `15.5.21` `>= 16.0.0, < 16.2.11` → `16.2.11`
2026-07-22	ModerateCVSS 6.3	GHSA-4c39-4ccg-62r3CVE-2026-64646	Next.js: Unbounded Server Action payload in Edge runtime	`>= 13.0.0, < 15.5.21` → `15.5.21` `>= 16.0.0, < 16.2.11` → `16.2.11`
2026-07-22	ModerateCVSS 6	GHSA-68g3-v927-f742CVE-2026-64648	Next.js: Cache confusion of response bodies for requests with bodies	`>= 13.0.0, < 15.5.21` → `15.5.21` `>= 16.0.0, < 16.2.11` → `16.2.11`
2026-07-22	HighCVSS 8.3	GHSA-6gpp-xcg3-4w24CVE-2026-64642	Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale	`>= 16.0.0, < 16.2.11` → `16.2.11`
2026-07-22	HighCVSS 8.3	GHSA-89xv-2m56-2m9xCVE-2026-64649	Next.js: Server-Side Request Forgery in Server Actions on custom servers	`>= 14.1.1, < 15.5.21` → `15.5.21` `>= 16.0.0, < 16.2.11` → `16.2.11`
2026-07-22	ModerateCVSS 6.3	GHSA-955p-x3mx-jcvpCVE-2026-64643	Next.js: Unauthenticated disclosure of internal Server Function endpoints	`>= 13.0.0, < 15.5.21` → `15.5.21` `>= 16.0.0, < 16.2.11` → `16.2.11`
2026-07-22	HighCVSS 8.2	GHSA-m99w-x7hq-7vfjCVE-2026-64641	Next.js: Denial of Service in App Router using Server Actions	`>= 13.0.0, < 15.5.21` → `15.5.21` `>= 16.0.0, < 16.2.11` → `16.2.11`
2026-07-22	HighCVSS 8.3	GHSA-p9j2-gv94-2wf4CVE-2026-64645	Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname	`>= 12.0.0, < 15.5.21` → `15.5.21` `>= 16.0.0, < 16.2.11` → `16.2.11`
2026-07-22	ModerateCVSS 6.3	GHSA-q8wf-6r8g-63chCVE-2026-64644	Next.js: Denial of Service in the Image Optimization API using SVGs	`>= 15.5.0, < 15.5.21` → `15.5.21` `>= 16.0.0, < 16.2.11` → `16.2.11`
2026-05-11	HighCVSS 7.5	GHSA-267c-6grr-h53fCVE-2026-44575	Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes	`>= 15.2.0, < 15.5.16` → `15.5.16` `>= 16.0.0, < 16.2.5` → `16.2.5`
2026-05-11	HighCVSS 7.5	GHSA-26hh-7cqf-hhc6CVE-2026-45109	Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Up	`>= 15.2.0, < 15.5.18` → `15.5.18` `>= 16.0.0, < 16.2.6` → `16.2.6`
2026-05-11	HighCVSS 7.5	GHSA-36qx-fr4f-26g5CVE-2026-44573	Next.js has a Middleware / Proxy bypass in Pages Router applications using i18n	`>= 12.2.0, < 15.5.16` → `15.5.16` `>= 16.0.0, < 16.2.5` → `16.2.5`
2026-05-11	LowCVSS 3.7	GHSA-3g8h-86w9-wvmqCVE-2026-44572	Next.js's Middleware / Proxy redirects can be cache-poisoned	`>= 12.2.0, < 15.5.16` → `15.5.16` `>= 16.0.0, < 16.2.5` → `16.2.5`
2026-05-11	HighCVSS 8.1	GHSA-492v-c6pp-mqqvCVE-2026-44574	Next.js has a Middleware / Proxy bypass through dynamic route parameter injection	`>= 15.4.0, < 15.5.16` → `15.5.16` `>= 16.0.0, < 16.2.5` → `16.2.5`
2026-05-11	HighCVSS 7.5	GHSA-8h8q-6873-q5fj	Next.js Vulnerable to Denial of Service with Server Components	`>= 13.0.0, < 15.5.16` → `15.5.16` `>= 16.0.0, < 16.2.5` → `16.2.5`
2026-05-11	HighCVSS 8.6	GHSA-c4j6-fc7j-m34rCVE-2026-44578	Next.js vulnerable to server-side request forgery in applications using WebSocket upgrades	`>= 13.4.13, < 15.5.16` → `15.5.16` `>= 16.0.0, < 16.2.5` → `16.2.5`
2026-05-11	ModerateCVSS 4.7	GHSA-ffhc-5mcf-pf4qCVE-2026-44581	Next.js vulnerable to cross-site scripting in App Router applications using CSP nonces	`>= 13.4.0, < 15.5.16` → `15.5.16` `>= 16.0.0, < 16.2.5` → `16.2.5`
2026-05-11	ModerateCVSS 6.1	GHSA-gx5p-jg67-6x7hCVE-2026-44580	Next.js has cross-site scripting in beforeInteractive scripts with untrusted input	`>= 13.0.0, < 15.5.16` → `15.5.16` `>= 16.0.0, < 16.2.5` → `16.2.5`
2026-05-11	ModerateCVSS 5.9	GHSA-h64f-5h5j-jqjhCVE-2026-44577	Next.js has a Denial of Service in the Image Optimization API	`>= 10.0.0, < 15.5.16` → `15.5.16` `>= 16.0.0, < 16.2.5` → `16.2.5`
2026-05-11	HighCVSS 7.5	GHSA-mg66-mrh9-m8jxCVE-2026-44579	Next.js vulnerable to Denial of Service via connection exhaustion in applications using Cache Components	`>= 15.0.0, < 15.5.16` → `15.5.16` `>= 16.0.0, < 16.2.5` → `16.2.5`
2026-05-11	LowCVSS 3.7	GHSA-vfv6-92ff-j949CVE-2026-44582	Next.js vulnerable to cache poisoning via collisions in React Server Component cache-busting	`>= 13.4.6, < 15.5.16` → `15.5.16` `>= 16.0.0, < 16.2.5` → `16.2.5`
2026-05-11	ModerateCVSS 5.4	GHSA-wfc6-r584-vfw7CVE-2026-44576	Next.js vulnerable to cache poisoning in React Server Component responses	`>= 14.2.0, < 15.5.16` → `15.5.16` `>= 16.0.0, < 16.2.5` → `16.2.5`
2026-04-10	HighCVSS 7.5	GHSA-q4gf-8mx6-v5v3	Next.js has a Denial of Service with Server Components	`>= 13.0.0, < 15.5.15` → `15.5.15` `>= 16.0.0-beta.0, < 16.2.3` → `16.2.3`
2026-03-17	ModerateCVSS 6.9	GHSA-3x4c-7xq6-9pq8CVE-2026-27980	Next.js: Unbounded next/image disk cache growth can exhaust storage	`>= 16.0.0-beta.0, < 16.1.7` → `16.1.7` `>= 10.0.0, < 15.5.14` → `15.5.14`
2026-03-17	ModerateCVSS 6.3	GHSA-ggv3-7p47-pfv8CVE-2026-29057	Next.js: HTTP request smuggling in rewrites	`>= 16.0.0-beta.0, < 16.1.7` → `16.1.7` `>= 9.5.0, < 15.5.13` → `15.5.13`
2026-03-17	ModerateCVSS 6.9	GHSA-h27x-g6w4-24gqCVE-2026-27979	Next.js: Unbounded postponed resume buffering can lead to DoS	`>= 16.0.1, < 16.1.7` → `16.1.7`
2026-03-17	LowCVSS 2.3	GHSA-jcc7-9wpm-mj36CVE-2026-27977	Next.js: null origin can bypass dev HMR websocket CSRF checks	`>= 16.0.1, < 16.1.7` → `16.1.7`
2026-03-17	ModerateCVSS 5.3	GHSA-mq59-m269-xvcxCVE-2026-27978	Next.js: null origin can bypass Server Actions CSRF checks	`>= 16.0.1, < 16.1.7` → `16.1.7`
2026-01-28	ModerateCVSS 5.9	GHSA-5f7q-jpqc-wp7hCVE-2025-59472	Next.js has Unbounded Memory Consumption via PPR Resume Endpoint	`>= 16.0.0-beta.0, < 16.1.5` → `16.1.5` `>= 15.6.0-canary.0, < 15.6.0-canary.61` → `15.6.0-canary.61` `>= 15.0.0-canary.0, <= 15.0.0-canary.205` → no fix yet `>= 15.0.1-canary.0, <= 15.0.1-canary.3` → no fix yet `>= 15.0.2-canary.0, <= 15.0.2-canary.11` → no fix yet `>= 15.0.3-canary.0, <= 15.0.3-canary.9` → no fix yet `>= 15.0.4-canary.0, <= 15.0.4-canary.52` → no fix yet `>= 15.1.1-canary.0, <= 15.1.1-canary.27` → no fix yet `>= 15.2.0-canary.0, <= 15.2.0-canary.77` → no fix yet `>= 15.2.1-canary.0, <= 15.2.1-canary.6` → no fix yet `>= 15.2.2-canary.0, <= 15.2.2-canary.7` → no fix yet `>= 15.3.0-canary.0, <= 15.3.0-canary.46` → no fix yet `>= 15.3.1-canary.0, <= 15.3.1-canary.15` → no fix yet `>= 15.4.0-canary.0, <= 15.4.0-canary.130` → no fix yet `>= 15.4.2-canary.0, <= 15.4.2-canary.56` → no fix yet `>= 15.5.1-canary.0, <= 15.5.1-canary.39` → no fix yet
2026-01-28	HighCVSS 7.5	GHSA-h25m-26qc-wcjf	Next.js HTTP request deserialization can lead to DoS when using insecure React Server Components	`>= 13.0.0, < 15.0.8` → `15.0.8` `>= 15.1.1-canary.0, < 15.1.12` → `15.1.12` `>= 15.2.0-canary.0, < 15.2.9` → `15.2.9` `>= 15.3.0-canary.0, < 15.3.9` → `15.3.9` `>= 15.4.0-canary.0, < 15.4.11` → `15.4.11` `>= 15.5.1-canary.0, < 15.5.10` → `15.5.10` `>= 15.6.0-canary.0, < 15.6.0-canary.61` → `15.6.0-canary.61` `>= 16.0.0-beta.0, < 16.0.11` → `16.0.11` `>= 16.1.0-canary.0, < 16.1.5` → `16.1.5`
2026-01-27	ModerateCVSS 5.9	GHSA-9g9p-9gw9-jx7fCVE-2025-59471	Next.js self-hosted applications vulnerable to DoS via Image Optimizer remotePatterns configuration	`>= 10.0.0, < 15.5.10` → `15.5.10` `>= 15.6.0-canary.0, < 16.1.5` → `16.1.5`
2025-12-12	HighCVSS 7.5	GHSA-5j59-xgg2-r9c4	Next has a Denial of Service with Server Components - Incomplete Fix Follow-Up	`>= 13.3.1-canary.0, < 14.2.35` → `14.2.35` `>= 15.0.6, < 15.0.7` → `15.0.7` `>= 15.1.10, < 15.1.11` → `15.1.11` `>= 15.2.7, < 15.2.8` → `15.2.8` `>= 15.3.7, < 15.3.8` → `15.3.8` `>= 15.4.9, < 15.4.10` → `15.4.10` `>= 15.5.8, < 15.5.9` → `15.5.9` `>= 15.6.0-canary.59, < 15.6.0-canary.60` → `15.6.0-canary.60` `>= 16.0.9, < 16.0.10` → `16.0.10` `>= 16.1.0-canary.17, < 16.1.0-canary.19` → `16.1.0-canary.19`
2025-12-11	HighCVSS 7.5	GHSA-mwv6-3258-q52c	Next Vulnerable to Denial of Service with Server Components	`>= 13.3.0, < 14.2.34` → `14.2.34` `>= 15.0.0-canary.0, < 15.0.6` → `15.0.6` `>= 15.1.1-canary.0, < 15.1.10` → `15.1.10` `>= 15.2.0-canary.0, < 15.2.7` → `15.2.7` `>= 15.3.0-canary.0, < 15.3.7` → `15.3.7` `>= 15.4.0-canary.0, < 15.4.9` → `15.4.9` `>= 15.5.1-canary.0, < 15.5.8` → `15.5.8` `>= 15.6.0-canary.0, < 15.6.0-canary.59` → `15.6.0-canary.59` `>= 16.0.0-beta.0, < 16.0.9` → `16.0.9` `>= 16.1.0-canary.0, < 16.1.0-canary.17` → `16.1.0-canary.17`
2025-12-11	ModerateCVSS 5.3	GHSA-w37m-7fhw-fmv9	Next Server Actions Source Code Exposure	`>= 15.0.0-canary.0, < 15.0.6` → `15.0.6` `>= 15.1.1-canary.0, < 15.1.10` → `15.1.10` `>= 15.2.0-canary.0, < 15.2.7` → `15.2.7` `>= 15.3.0-canary.0, < 15.3.7` → `15.3.7` `>= 15.4.0-canary.0, < 15.4.9` → `15.4.9` `>= 15.5.1-canary.0, < 15.5.8` → `15.5.8` `>= 15.6.0-canary.0, < 15.6.0-canary.59` → `15.6.0-canary.59` `>= 16.0.0-beta.0, < 16.0.9` → `16.0.9` `>= 16.1.0-canary.0, < 16.1.0-canary.17` → `16.1.0-canary.17`
2025-12-03	CriticalCVSS 10	GHSA-9qr9-h5gf-34mp	Next.js is vulnerable to RCE in React flight protocol	`>= 14.3.0-canary.77, < 15.0.5` → `15.0.5` `>= 15.2.0-canary.0, < 15.2.6` → `15.2.6` `>= 15.3.0-canary.0, < 15.3.6` → `15.3.6` `>= 15.4.0-canary.0, < 15.4.8` → `15.4.8` `>= 16.0.0-canary.0, < 16.0.7` → `16.0.7` `>= 15.1.0-canary.0, < 15.1.9` → `15.1.9` `>= 15.5.0-canary.0, < 15.5.7` → `15.5.7`
2025-08-29	ModerateCVSS 6.5	GHSA-4342-x723-ch2fCVE-2025-57822	Next.js Improper Middleware Redirect Handling Leads to SSRF	`>= 15.0.0-canary.0, < 15.4.7` → `15.4.7` `>= 0.9.9, < 14.2.32` → `14.2.32`
2025-08-29	ModerateCVSS 6.2	GHSA-g5qg-72qw-gw5vCVE-2025-57752	Next.js Affected by Cache Key Confusion for Image Optimization API Routes	`>= 15.0.0, <= 15.4.4` → `15.4.5` `>= 0.9.9, < 14.2.31` → `14.2.31`
2025-08-29	ModerateCVSS 4.3	GHSA-xv57-4mr9-wg8vCVE-2025-55173	Next.js Content Injection Vulnerability for Image Optimization	`>= 15.0.0, <= 15.4.4` → `15.4.5` `>= 0.9.9, < 14.2.31` → `14.2.31`
2025-07-03	HighCVSS 7.5	GHSA-67rr-84xm-4c7rCVE-2025-49826	Next.JS vulnerability can lead to DoS via cache poisoning	`>= 15.0.4-canary.51, < 15.1.8` → `15.1.8`
2025-07-03	LowCVSS 3.7	GHSA-r2fc-ccr8-96c4CVE-2025-49005	Next.js has a Cache poisoning vulnerability due to omission of the Vary header	`>= 15.3.0, < 15.3.3` → `15.3.3`
2025-05-28	LowCVSS 2.3	GHSA-3h52-269p-cp9rCVE-2025-48068	Information exposure in Next.js dev server due to lack of origin verification	`>= 15.0.0, < 15.2.2` → `15.2.2` `>= 13.0, < 14.2.30` → `14.2.30`
2025-05-15	LowCVSS 3.7	GHSA-qpjv-v59x-3qc4CVE-2025-32421	Next.js Race Condition to Cache Poisoning	`>= 15.0.0, < 15.1.6` → `15.1.6` `>= 0.9.9, < 14.2.24` → `14.2.24`
2025-04-02	LowCVSS 1.7	GHSA-223j-4rm8-mrmfCVE-2025-30218	Next.js may leak x-middleware-subrequest-id to external hosts	`= 12.3.5` → `12.3.6` `= 13.5.9` → `13.5.10` `= 14.2.25` → `14.2.26` `= 15.2.3` → `15.2.4`
2025-03-21	CriticalCVSS 9.1	GHSA-f82v-jwr5-mffwCVE-2025-29927	Authorization Bypass in Next.js Middleware	`>= 13.0.0, < 13.5.9` → `13.5.9` `>= 14.0.0, < 14.2.25` → `14.2.25` `>= 15.0.0, < 15.2.3` → `15.2.3` `>= 12.0.0, < 12.3.5` → `12.3.5`
2025-01-03	ModerateCVSS 5.3	GHSA-7m27-7ghc-44w9CVE-2024-56332	Next.js Allows a Denial of Service (DoS) with Server Actions	`>= 13.0.0, < 13.5.8` → `13.5.8` `>= 14.0.0, < 14.2.21` → `14.2.21` `>= 15.0.0, < 15.1.2` → `15.1.2`
2024-12-17	HighCVSS 7.5	GHSA-7gfc-8cq8-jh5fCVE-2024-51479	Next.js authorization bypass vulnerability	`>= 9.5.5, < 14.2.15` → `14.2.15`
2024-10-14	ModerateCVSS 4.6	GHSA-g77x-44xx-532mCVE-2024-47831	Denial of Service condition in Next.js image optimization	`>= 10.0.0, < 14.2.7` → `14.2.7`
2024-09-17	HighCVSS 8.7	GHSA-gp8f-8m3g-qvj9CVE-2024-46982	Next.js Cache Poisoning	`>= 13.5.1, < 13.5.7` → `13.5.7` `>= 14.0.0, < 14.2.10` → `14.2.10`
2024-07-10	HighCVSS 8.7	GHSA-fq54-2j52-jc42CVE-2024-39693	Next.js Denial of Service (DoS) condition	`>= 13.3.1, < 13.5.0` → `13.5.0`
2024-05-09	HighCVSS 7.5	GHSA-77r5-gw3j-2mpfCVE-2024-34350	Next.js Vulnerable to HTTP Request Smuggling	`>= 13.4.0, < 13.5.1` → `13.5.1`
2024-05-09	HighCVSS 7.5	GHSA-fr5h-rqp8-mj6gCVE-2024-34351	Next.js Server-Side Request Forgery in Server Actions	`>= 13.4.0, < 14.1.1` → `14.1.1`
2023-10-22	Low	GHSA-c59h-r6p8-q9wcCVE-2023-46298	Next.js missing cache-control header may lead to CDN caching empty reply	`>= 0.9.9, < 13.4.20-canary.13` → `13.4.20-canary.13`

GitHub Advisory Database, CC-BY-4.0.