Next.js: Unauthenticated Remote Code Execution on windows-hosted servers

Impact A vulnerability in applications using Pages and App router without Cache Component can lead to remote code execution when the server is hosted on machines using a Windows filesystem. Workaround There is no known workaround for affected windows-hosted applications. You should upgrade...

GHSA-P293-QW3H-JR36 Next.js: Unauthenticated Remote Code Execution on windows-hosted servers

Impact A vulnerability in applications using Pages and App router without Cache Component can lead to remote code execution when the server is hosted on machines using a Windows filesystem. Workaround There is no known workaround for affected windows-hosted applications. You should upgrade...

fbconsulting_v0_chat

Chat SDK Chat SDK is a free, open-source template built with Next.js and the AI SDK that helps you quickly build powerful chatbot applications. Read Docs · Features · Model Providers · Deploy Your Own · Running locally Features Next.js App Router Advanced routing for seamless navigation and...

Next.js Framework 13.x < 15.5.21 / 16.x < 16.2.11 Multiple Vulnerabilities

The Next.js Framework on the remote host is affected by multiple vulnerabilities: - A server-side fetch with a request body may return a cached response body from a different request to the same URL but different body. Confidential data in the POST's response body would then leak to unauthorized...

Next.js Framework 13.4 < 15.5.24 / 16.x < 16.3.3 RCE (Windows)

The Next.js Framework on the remote host is affected by a remote code execution vulnerability: - A vulnerability in applications using both the Pages Router and App Router without Cache Components can lead to unauthenticated remote code execution when the Next.js server uses a Windows filesystem...

CVE-2026-75604: Improper Limitation of a Pathname to a Restricted Directory

Next.js is a React framework for building full-stack web applications. From 13.4.0 until 15.5.24 and 16.3.3, Next.js applications using Pages Router or App Router without Cache Components on Windows-hosted servers do not consistently escape backslashes in route segments before constructing...

CVE-2025-55182_CVE-2025-66478

CVE-2025-55182 - Esecuzione Remota di Codice nei Server Components di Next.js/React Panoramica Questo repository contiene un exploit Proof-of-Concept PoC per CVE-2025-55182, una vulnerabilità critica di Esecuzione Remota di Codice RCE che interessa i Server Components di React nelle versioni 19.x...

vulnerabilities in Next.js

Vercel has identified two vulnerabilities in Next.js, a React framework for developing web applications. A malicious actor could exploit these vulnerabilities to execute arbitrary code on the application server. These vulnerabilities only exist in Next.js applications hosted in a Windows...

Exploit for CVE-2026-75604

CVE-2026-75604 RCE PoC Python proof of concept for CVE-2026-...

next: Next.js: Denial of Service via crafted requests to App Router with Server Actions

A flaw was found in Next.js, a React framework for building web applications. A remote attacker can send specially crafted requests to Next.js applications that utilize the App Router with Server Actions. This can lead to excessive CPU usage, causing the application to become unresponsive and...

next.js: Next.js: Unauthorized access to protected content via middleware bypass

A flaw was found in Next.js. App Router applications that use middleware or proxy-based authorization checks are vulnerable to unauthorized access. A remote attacker can exploit this by crafting specific .rsc and segment-prefetch URLs, which bypass the intended middleware rules. This allows acces...

Linux Distros Unpatched Vulnerability : CVE-2026-64642

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Next.js is a React framework for building full-stack web applications. In versions 16.0.0 through 16.2.10, crafted requests targeting Next.js applications using...

Linux Distros Unpatched Vulnerability : CVE-2026-64643

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, Next.js applications using...

CVE-2026-64646

A flaw was found in Next.js. An attacker sending specially crafted requests to a Next.js application utilizing the App Router with Server Actions configured to use the Edge runtime can cause excessive memory consumption. This can lead to a denial of service DoS due to resource exhaustion...

CVE-2026-64642

A flaw was found in Next.js, a React framework. A remote attacker can bypass authentication in Next.js applications using App Router built with Turbopack and a single entry in config.i18n.locales by sending crafted requests. This vulnerability allows for unauthorized access, leading to a high...

CVE-2026-64641

A flaw was found in Next.js, a React framework for building web applications. A remote attacker can send specially crafted requests to Next.js applications that utilize the App Router with Server Actions. This can lead to excessive CPU usage, causing the application to become unresponsive and...

CVE-2026-64646

Next.js is a React framework for building full-stack web applications. In versions 13.0.0 through 15.5.20 and 16.0.0 through 16.2.10, requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive memory consumption if that Server Actions uses the...

EUVD-2026-49401

Next.js is a React framework for building full-stack web applications. In versions 13.0.0 through 15.5.20 and 16.0.0 through 16.2.10, requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive memory consumption if that Server Actions uses the...

CVE-2026-64646 Next.js: Unbounded Server Action payload in Edge runtime

Next.js is a React framework for building full-stack web applications. In versions 13.0.0 through 15.5.20 and 16.0.0 through 16.2.10, requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive memory consumption if that Server Actions uses the...

CVE-2026-64646 Next.js: Unbounded Server Action payload in Edge runtime

Next.js is a React framework for building full-stack web applications. In versions 13.0.0 through 15.5.20 and 16.0.0 through 16.2.10, requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive memory consumption if that Server Actions uses the...