GHSA-39W2-RJM5-CHCV Next.js has information disclosure in development server's Model Context Protocol endpoint

The Next.js development server next dev exposes a Model Context Protocol endpoint that does not verify which website a request originates from, allowing a malicious website visited by the developer to read sensitive development data — including the project's location on disk, source code snippets...

Next.js has information disclosure in App Router metadata image routes via dynamicParams bypass

In Next.js App Router applications built with webpack, metadata image routes such as opengraph-image and twitter-image ignore the dynamicParams route segment option. An attacker can request metadata image URLs for dynamic segments that were deliberately excluded from generateStaticParams...

GHSA-F87G-XV8R-7P7X Next.js has information disclosure in App Router metadata image routes via dynamicParams bypass

In Next.js App Router applications built with webpack, metadata image routes such as opengraph-image and twitter-image ignore the dynamicParams route segment option. An attacker can request metadata image URLs for dynamic segments that were deliberately excluded from generateStaticParams...

EUVD-2026-91673

Next.js has information disclosure in App Router metadata image routes via dynamicParams bypass...

NPM: Next.js has information disclosure in App Router metadata image routes via dynamicParams bypass

NPM: Next.js has information disclosure in App Router metadata image routes via dynamicParams bypass vulnerability discovered by ? in WordPress Npm next versions = 16.0.0, 16.3.8...

EUVD-2026-91674

Next.js has cache poisoning in SSG/ISR rendering that leads to cross-user content substitution and persistent denial of service...

NPM: Next.js has cache poisoning in SSG/ISR rendering that leads to cross-user content substitution and persistent denial of service

NPM: Next.js has cache poisoning in SSG/ISR rendering that leads to cross-user content substitution and persistent denial of service vulnerability discovered by ? in WordPress Npm next versions = 15.0.0, 15.5.27...

GHSA-MCJ8-R9MP-W47P Next.js has cache poisoning in SSG/ISR rendering that leads to cross-user content substitution and persistent denial of service

Next.js applications that use a root-level catch-all page together with statically generated or Incremental Static Regeneration routes can have their shared response cache poisoned by a single unauthenticated crafted request...

Next.js has cache poisoning in SSG/ISR rendering that leads to cross-user content substitution and persistent denial of service

Next.js applications that use a root-level catch-all page together with statically generated or Incremental Static Regeneration routes can have their shared response cache poisoned by a single unauthenticated crafted request...

Next.js has Server-Side Request Forgery in Image Optimization

Impact An attacker-controlled, allow-listed remote URL can lead to server-side request forgery e.g. to private IPs during Image Optimization. Workaround Audit allow-listed remote URLs in images.remotePatterns see https://nextjs.org/docs/app/getting-started/imagesremote-images for hosts that may n...

EUVD-2026-91671

Next.js has Server-Side Request Forgery in Image Optimization...

GHSA-CJQ9-62Q9-8JV4 Next.js has Server-Side Request Forgery in Image Optimization

Impact An attacker-controlled, allow-listed remote URL can lead to server-side request forgery e.g. to private IPs during Image Optimization. Workaround Audit allow-listed remote URLs in images.remotePatterns see https://nextjs.org/docs/app/getting-started/imagesremote-images for hosts that may n...

NPM: Next.js has Server-Side Request Forgery in Image Optimization

NPM: Next.js has Server-Side Request Forgery in Image Optimization vulnerability discovered by ? in WordPress Npm next versions = 16.0.0, 16.3.8...

Exploit for Deserialization of Untrusted Data in Facebook React

CVE-2025-55182 — "Ghost Action" React2Shell React Server Co...

nextjs-middleware-exploit

Investigación de vulnerabilidad en middleware de Next.js CVE-2025-29927 Este repositorio demuestra una vulnerabilidad crítica en el middleware de Next.js CVE-2025-29927, que afecta a las versiones 11.1.4 hasta 15.1.7. Esta vulnerabilidad permite el bypass de autorización , el bypass de CSP y...

Next.js 15.5.6 Remote Code Execution

Next.js version 15.5.6 is affected by an unauthenticated remote code execution vulnerability in React Server Components request deserialization. This CTF deployment exposes a Server Action endpoint to demonstrate the issue...

nextjs-vulnerable-app

Aplicación de Autenticación con Next.js Esta es una aplicación de Next.js que implementa autenticación utilizando NextAuth.js. La aplicación cuenta con rutas protegidas que requieren que los usuarios estén autenticados para acceder a ciertas páginas. Estructura del Proyecto nextjs-auth-app ├──...

React2Shell CVE-2025-55182 Detection

Detects CVE-2025-55182 React2Shell by sending a safe React Flight multipart payload that evaluates 77+1 via the prefix gadget. Positive when the response reflects RSC deserialization behaviour. !/usr/bin/env python3 -- coding: utf-8 -- """Detect React2Shell CVE-2025-55182 on Next.js / React Serve...

React2Shell RCE (CVE-2025-55182)

Exploits CVE-2025-55182 React2Shell via React Flight multipart deserialization. Targets Next.js App Router and React Server Components endpoints using the prefix / formData gadget chain. !/usr/bin/env python3 -- coding: utf-8 -- """React2Shell pre-auth RCE CVE-2025-55182 on Next.js / React Server...

Next.js RSC Multi-CVE Chain RCE

Full-chain Next.js RSC exploitation: tries CVE-2025-55182 React2Shell first, then falls back to Next.js-specific RSC endpoints. Integrates detection signals from CVE-2026-44582/44573/44578 auxiliary modules. !/usr/bin/env python3 -- coding: utf-8 -- """Next.js RSC multi-CVE exploit chain...