CVE-2026-64647

Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a server-side fetch with a request body may return a cached response body from a different request to the same URL but different body. Confidential data in the...

GHSA-955P-X3MX-JCVP Next.js: Unauthenticated disclosure of internal Server Function endpoints

Impact In Next.js applications using App Router, Server Actions use server or use cache endpoints can be disclosed bypassing any authentication on the pages where these endpoints are usually used. Server Action IDs can be disclosed to unauthenticated users via publicly served client artifacts for...

Exploit for Deserialization of Untrusted Data in Facebook React

CVE-2025-55182-PoC-exploit Next.js RCE via React Server Funct...

Exploit for Deserialization of Untrusted Data in Facebook React

React2Shell Scanner A comprehensive vulnera...

GHSA-7M27-7GHC-44W9 Next.js Allows a Denial of Service (DoS) with Server Actions

Impact A Denial of Service DoS attack allows attackers to construct requests that leaves requests to Server Actions hanging until the hosting provider cancels the function execution. Note: Next.js server is idle during that time and only keeps the connection open. CPU and memory footprint are low...