EUVD-2026-91670

Next.js has cache poisoning of SSG and ISR pages in self-hosted applications...

CVE-2026-94543

The Next.js framework (versions 15.0.0 through 15.5.27 and 16.3.8 ) is vulnerable to cache poisoning in self-hosted applications using the Pages Router with statically generated or Incremental Static Regeneration (ISR) pages. The root cause is that response cache entries are not sufficiently boun...

ZEIT Next.js Input Validation Error Vulnerability (CNVD-2021-61800)

ZEIT Next.js is an open source web application framework from ZEIT based on Vue.js, Node.js, Webpack, and Babel.js. ZEIT Next.js is vulnerable to an input validation error in versions prior to 11.1.0, which stems from a web system or product that does not properly validate input data. An attacker...

PT-2021-21819

Name of the Vulnerable Software and Affected Versions Next.js versions prior to 11.1.0 Description The issue in Next.js allows an open redirect to occur to an external site when specially encoded paths are used with statically generated pages/ error.js. This redirect does not directly harm users...