CVE-2026-64646 Next.js: Unbounded Server Action payload in Edge runtime

Next.js is a React framework for building full-stack web applications. In versions 13.0.0 through 15.5.20 and 16.0.0 through 16.2.10, requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive memory consumption if that Server Actions uses the...

CVE-2026-32887

Effect is a TypeScript framework that consists of several packages that work together to help build TypeScript applications. Prior to version 3.20.0, when using "RpcServer.toWebHandler" or "HttpApp.toWebHandlerRuntime" inside a Next.js App Router route handler, any Node.js...

Exploit for CVE-2025-55182

CVE-2025-55182 - Dockerized Proof of Concept This repository...

Exploit for CVE-2025-55182

CVE-2025-55182-shellinteractive Base used from: https://gith...

EUVD-2025-113130

Malicious code in got-prettier-stylelint-server-nextjs npm...

GHSA-FR5H-RQP8-MJ6G Next.js Server-Side Request Forgery in Server Actions

Impact A Server-Side Request Forgery SSRF vulnerability was identified in Next.js Server Actions by security researchers at Assetnote. If the Host header is modified, and the below conditions are also met, an attacker may be able to make requests that appear to be originating from the Next.js...

GHSA-25MP-G6FV-MQXX Unexpected server crash in Next.js.

Next.js is a React framework. In versions of Next.js prior to 12.0.5 or 11.1.3, invalid or malformed URLs could lead to a server crash. In order to be affected by this issue, the deployment must use Next.js versions above 11.1.0 and below 12.0.5, Node.js above 15.0.0, and next start or a custom...