React Server Components - Remote Code Execution

React Server Components 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack contain a remote code execution caused by unsafe deserialization of payloads from HTTP requests to Server Function endpoints, letting...

Nextjs <2.4.1 - Local File Inclusion

ZEIT Next.js before 2.4.1 is susceptible to local file inclusion via the /next and /static request namespace, allowing attackers to obtain sensitive information. id: CVE-2017-16877 info: name: Nextjs 2.4.1 - Local File Inclusion author: pikpikcu severity: high description: ZEIT Next.js before 2.4...

nextploiter

nextploiter Exploit tool for NextJS Usage Commands Usage $ npm install -g nextploiter $ nextploiter COMMAND running command... $ nextploiter --version nextploiter/1.0.0 darwin-arm64 node-v24.12.0 $ nextploiter --help COMMAND USAGE $ nextploiter COMMAND ... Commands nextploiter help COMMAND...

nextjs-supabase-stripe-security-checker

nextjs-supabase-stripe-security-checker Free, local security scan for Next.js + Supabase + Stripe apps: leaked keys, missing RLS and grants, unsafe Stripe webhooks. Your AI agent shipped the app. Did it also ship your Stripe secret key, a table without RLS, or a webhook that anyone can call? One...

CVE-2025-55182-exploit

⚠️ DISCLAIMER This tool is for authorized security testing and educational purposes ONLY. Only test systems you own or have explicit written permission to test Unauthorized use is illegal and unethical The developers assume no liability for misuse Use responsibly and in compliance with all...

next-cve-2025-66478

NextJS CVE-2025-66478 Scans all projects vulnerable to CVE-2025-66478 projects in the current working directory and reports them. Learn more about CVE-2025-66478 Warning This script doesn't fix any vulnerabilities. This is just for locating them. Please refer to this article to learn more about t...

test-cve-2025-29927

Test app to exploit CVE-2025-29927 The NextJS app has cookie based authentification and a middleware to prevent unauthorized access to /admin page. To start the app run yarn then yarn dev To get unauthorized access to /admin page by using CVE-2025-29927 vulnerability run a proxy-server which adds...

Next.js Middleware Bypass

Next.js contains a critical middleware bypass vulnerability affecting versions 11.1.4 through 15.2.2. Attackers may bypass middleware by sending a crafted x-middleware-subrequest header. This template requires a baseline middleware redirect before accepting a bypass 200 response. id: CVE-2025-299...

@akinon/next (>=2.0.0-beta.13, <=3.0.0-snapshot-ZERO-4399-20260601082423), @akinon/pz-rate-review (>=2.0.152-rc.1, <=2.0.159-rc.20) +38 more potentially affected by CVE-2026-114139 via @sentry/nextjs (>=10.30.0, <=10.75.0)

@sentry/nextjs NPM version =10.30.0, =2.0.0-beta.13, =2.0.152-rc.1, =2.0.0-beta.13, =20251229.1441.35, =20260226.1857.59, =20260128.2248.28, =20260323.400.54, =20260617.1750.25, =20260604.9.7, =20260617.1703.12, =20251229.1447.48, =20260713.1602.10, =20260828.1636.54, =20260710.2210.9,...

EUVD-2026-107549

Sentry-Javascript: Middleware Bypass when using Tunnel route...

@akinon/next (>=2.0.0-beta.13, <=3.0.0-snapshot-ZERO-4399-20260601082423), @akinon/pz-rate-review (>=2.0.152-rc.1, <=2.0.159-rc.20) +38 more potentially affected by CVE-2026-114139 via @sentry/nextjs (>=10.30.0, <=10.75.0)

@sentry/nextjs NPM version =10.30.0, =2.0.0-beta.13, =2.0.152-rc.1, =2.0.0-beta.13, =20251229.1441.35, =20260226.1857.59, =20260128.2248.28, =20260323.400.54, =20260617.1750.25, =20260604.9.7, =20260617.1703.12, =20251229.1447.48, =20260713.1602.10, =20260828.1636.54, =20260710.2210.9,...

@akinon/next (>=2.0.0-beta.13, <=3.0.0-snapshot-ZERO-4399-20260601082423), @akinon/pz-rate-review (>=2.0.152-rc.1, <=2.0.159-rc.20) +38 more potentially affected by CVE-2026-114139 via @sentry/nextjs (>=10.30.0, <=10.75.0)

@sentry/nextjs NPM version =10.30.0, =2.0.0-beta.13, =2.0.152-rc.1, =2.0.0-beta.13, =20251229.1441.35, =20260226.1857.59, =20260128.2248.28, =20260323.400.54, =20260617.1750.25, =20260604.9.7, =20260617.1703.12, =20251229.1447.48, =20260713.1602.10, =20260828.1636.54, =20260710.2210.9,...

Access Control Bypass

Overview @sentry/nextjs is an Official Sentry SDK for Next.js Affected versions of this package are vulnerable to Access Control Bypass via the isPathnameUnderSentryTunnelRoute function in wrapMiddlewareWithSentry.ts when the tunnel route feature is enabled. The middleware wrapper incorrectly...

@akinon/next (>=2.0.0-beta.13, <=3.0.0-snapshot-ZERO-4399-20260601082423), @akinon/pz-rate-review (>=2.0.152-rc.1, <=2.0.159-rc.20) +38 more potentially affected by CVE-2026-114139 via @sentry/nextjs (>=10.30.0, <=10.75.0)

@sentry/nextjs NPM version =10.30.0, =2.0.0-beta.13, =2.0.152-rc.1, =2.0.0-beta.13, =20251229.1441.35, =20260226.1857.59, =20260128.2248.28, =20260323.400.54, =20260617.1750.25, =20260604.9.7, =20260617.1703.12, =20251229.1447.48, =20260713.1602.10, =20260828.1636.54, =20260710.2210.9,...

PT-2026-120805

Name of the Vulnerable Software and Affected Versions @sentry/nextjs versions 9.36.0 through 9.47.1 @sentry/nextjs versions 10.x through 10.75.1 @sentry/nextjs versions 11.0.0-rc.0 Description The webpack integration for @sentry/nextjs skips application middleware for every request path under a...

Sentry processing logic error vulnerability

Versions prior to Sentry 9.36.0 through 9.47.2, 10.0.0-alpha.0 through 10.75.2, and 11.0.0-alpha.0 through 11.0.0-rc.1 contain a logic error vulnerability. This vulnerability arises because the webpack integration for @sentry/nextjs bypasses application middleware under the configured tunnelRoute...

CLSA-2026-1792162081 TuxCare security update for @storybook/nextjs (1 CVE)

TuxCare rebuilt @storybook/nextjs to address 1 CVE. Fixed in 7.0.7-tuxcare.1...

PT-2026-124536

TuxCare rebuilt @storybook/nextjs to address 1 CVE. Fixed in 7.0.7-tuxcare.1...

@smg-automotive/auth (>=6.8.0-auth0-update-access-token-endpoint.1, <=9.3.5) potentially affected by CVE-2026-107369 via @auth0/nextjs-auth0 (>=4.9.0, <=4.25.0)

@auth0/nextjs-auth0 NPM version =4.9.0, =6.8.0-auth0-update-access-token-endpoint.1, =9.3.5 Source cves: CVE-2026-107369 Source advisory: SNYK:JS-AUTH0NEXTJSAUTH0-20936946...

Open Redirect

Overview @auth0/nextjs-auth0 is a Next.js SDK for signing in with Auth0 Affected versions of this package are vulnerable to Open Redirect via the returnTo parameter, where the SDK validates it as a same-origin URL but the subsequent reconstruction logic can produce a URL that browsers interpret a...