129 matches found
ROOT-APP-NPM-AIKIDO-2026-10754 AIKIDO-2026-10754 in next - Patched by Root
Root has patched AIKIDO-2026-10754 in the next package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2024-47831 CVE-2024-47831 in next - Patched by Root
Root has patched CVE-2024-47831 in the next package for Root:npm. Multiple fixed versions available...
Linux Distros Unpatched Vulnerability : CVE-2026-64645
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a rewrites or redirects ru...
CVE-2026-64649
Next.js is a React framework for building full-stack web applications. In versions 14.1.1 through 15.5.20 and 16.0.0 through 16.2.10, when a Server Action forwards or redirects a request, an attacker can cause the server to send that outbound request to a malicious host Server-Side Request Forger...
CVE-2026-64649 Next.js: Server-Side Request Forgery in Server Actions on Custom Servers
Next.js is a React framework for building full-stack web applications. In versions 14.1.1 through 15.5.20 and 16.0.0 through 16.2.10, when a Server Action forwards or redirects a request, an attacker can cause the server to send that outbound request to a malicious host Server-Side Request Forger...
CVE-2026-64644
Next.js is a React framework for building full-stack web applications. In versions 15.5.0 through 15.5.20 and 16.0.0 through 16.2.10, when self-hosting Next.js with the default image loader, the Image Optimization API can optimize remotely hosted images if configured not enabled by default. If...
CVE-2026-64645 Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname
Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a rewrites or redirects rule that builds its external destination hostname from request-controlled input can be pointed at an arbitrary hostname, regardless of the...
CVE-2025-71389
Cal.com (calcom/cal.diy) versions before 5.9.9 are vulnerable to unauthenticated remote code execution via Next.js React Server Components (RSC) request handling that deserializes attacker-controlled input. A remote attacker can send a crafted RSC request to the server to execute arbitrary code d...
Exploit for Deserialization of Untrusted Data in Facebook React
CVE-2025-55182 — React2Shell CVSS 10.0 CRITICAL | Pre-Auth...
NPM: Next.js: Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences
NPM: Next.js: Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences vulnerability discovered by ? in WordPress Npm next versions = 13.0.0, 15.5.21...
PT-2026-63559
Name of the Vulnerable Software and Affected Versions Next.js versions 15.5.0 through 15.5.20 Next.js versions 16.0.0 through 16.2.10 Description When self-hosting with the default image loader, the Image Optimization API can optimize remotely hosted images if configured. Malicious content within...
CVE-2026-59801
9Router through version 0.4.41 contains an unauthenticated access vulnerability that allows remote attackers to interact with provider management API endpoints by sending requests without any credentials due to missing authentication middleware in the Next.js API routes under...
CVE-2026-59801 9Router 0.4.41 - Unauthenticated API Exposure via /api/providers
9Router through version 0.4.41 contains an unauthenticated access vulnerability that allows remote attackers to interact with provider management API endpoints by sending requests without any credentials due to missing authentication middleware in the Next.js API routes under...
next.js: Next.js: Information disclosure due to middleware bypass in Pages Router with i18n
A flaw was found in Next.js. Applications utilizing the Pages Router with internationalization i18n configured and middleware or proxy-based authorization are susceptible to unauthorized access. A remote attacker can exploit this by making locale-less /next/data//.json requests, which bypass the...
Linux Distros Unpatched Vulnerability : CVE-2026-44574
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Next.js is a React framework for building full-stack web applications. From 15.4.0 to before 15.5.16 and 16.2.5, applications that rely on middleware to protect...
Linux Distros Unpatched Vulnerability : CVE-2026-44578
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Next.js is a React framework for building full-stack web applications. From 13.4.13 to before 15.5.16 and 16.2.5, self-hosted applications using the built-in...
Exploit for CVE-2025-66478
CVE-2025-66478-Research-Proof-of-Concept Overview This re...
Exploit for Deserialization of Untrusted Data in Facebook React
CVE-2025-55182 - React2shell A Python 2.7 exploit for CVE-2...