Linux Distros Unpatched Vulnerability : CVE-2026-44572

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Next.js is a React framework for building full-stack web applications. From 12.2.0 to before 15.5.16 and 16.2.5, an external client could send a x-nextjs-data...

Exploit for Deserialization of Untrusted Data in Facebook React

CVE-2025-55182 React2Shell Analysis Report Sections require...

Next.js Hash Function Data Compromise

The vulnerability of the Next.js web application development software platform is related to the use of an algorithm that does not meet security requirements for hash functions. Exploiting this vulnerability could allow a malicious actor to compromise the integrity of the protected information...

Next.js Auth Bypass

The vulnerability of the Next.js web application development software platform is related to deficiencies in the authentication process. Exploiting this vulnerability allows an attacker to bypass existing security mechanisms and gain unauthorized access to protected information...

Next.js Authentication Bypass

The vulnerability of the Next.js web application development software platform lies in the ability to bypass authentication procedures by using an alternative path or channel. Exploiting this vulnerability allows a malicious actor to circumvent existing security mechanisms and gain unauthorized...

Next.js Unauthenticated Access Disclosure

The vulnerability of the Next.js web application development software platform is related to insufficient validation of requests at the server side. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

Next.js Code Execution

The vulnerability of the Next.js web application development software platform is related to the lack of security measures for protecting the structure of web pages. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Exploit for Server-Side Request Forgery in Vercel Next.Js

nextjs-cve-2026-44578 Nuclei templates for detecting...

Next.js Framework 12.2.x < 15.5.16 / 16.x < 16.2.5 Information Disclosure

The Next.js Framework on the remote host is affected by an information disclosure vulnerability: - Applications using the Pages Router with i18n configured and middleware/proxy-based authorization can allow unauthorized access to protected page data through locale-less /next/data//.json requests...

Next.js Framework 13.x < 15.5.16 / 16.x < 16.2.5 XSS

The Next.js Framework on the remote host is affected by a cross-site scripting vulnerability: - Applications that use beforeInteractive scripts together with untrusted content can be vulnerable to cross-site scripting. In affected versions, serialized script content was not escaped safely before...

Next.js Framework 13.4.x < 15.5.16 / 16.x < 16.2.5 Stored XSS

The Next.js Framework on the remote host is affected by a stored cross-site scripting vulnerability: - App Router applications that rely on CSP nonces can be vulnerable to stored cross-site scripting when deployed behind shared caches. In affected versions, malformed nonce values derived from...

WS-2020-0122

next.js before 5.1.0 is vulnerable to Remote Code Execution. /path route is not handled properly, which allows attackers execute JavaScript code on the server...

CVE-2026-44582

Next.js is a React framework for building full-stack web applications. From 13.4.6 to before 15.5.16 and 16.2.5, React Server Component responses can be vulnerable to cache poisoning in deployments that rely on shared caches with insufficient response partitioning. In affected conditions,...

CVE-2026-44579

Next.js is a React framework for building full-stack web applications. From to before 15.5.16 and 16.2.5, applications using Partial Prerendering through the Cache Components feature can be vulnerable to connection exhaustion through crafted POST requests to a server action. In affected...

CVE-2026-44581

Next.js is a React framework for building full-stack web applications. From 13.4.0 to before 15.5.16 and 16.2.5, App Router applications that rely on CSP nonces can be vulnerable to stored cross-site scripting when deployed behind shared caches. In affected versions, malformed nonce values derive...

CVE-2026-44580

Next.js is a React framework for building full-stack web applications. From 13.0.0 to before 15.5.16 and 16.2.5, applications that use beforeInteractive scripts together with untrusted content can be vulnerable to cross-site scripting. In affected versions, serialized script content was not escap...

CVE-2026-44578

Next.js is a React framework for building full-stack web applications. From 13.4.13 to before 15.5.16 and 16.2.5, self-hosted applications using the built-in Node.js server can be vulnerable to server-side request forgery through crafted WebSocket upgrade requests. An attacker can cause the serve...

CVE-2026-44576

Next.js is a React framework for building full-stack web applications. From 14.2.0 to before 15.5.16 and 16.2.5, applications using React Server Components can be vulnerable to cache poisoning when shared caches do not correctly partition response variants. Under affected conditions, an attacker...

CVE-2026-44577

Next.js is a React framework for building full-stack web applications. From 10.0.0 to before 15.5.16 and 16.2.5, when self-hosting Next.js with the default image loader, the Image Optimization API fetches local images entirely into memory without enforcing a maximum size limit. An attacker could...

CVE-2026-44574

Next.js is a React framework for building full-stack web applications. From 15.4.0 to before 15.5.16 and 16.2.5, applications that rely on middleware to protect dynamic routes can be vulnerable to authorization bypass. In affected deployments, specially crafted query parameters can alter the...