Next

This hub aggregates every CVE we track for Next, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting Next.

• GHSA-2xp9-vwfh-vxw4Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are usedSep 8, 2026
• CVE-2026-78180alibaba-fusion next deepMerge index.tsx ConfigProvider.getContextProps prototype pollution7.3Aug 24, 2026
• GHSA-8h8q-6873-q5fjNext.js Vulnerable to Denial of Service with Server ComponentsMay 11, 2026
• GHSA-q4gf-8mx6-v5v3Next.js has a Denial of Service with Server ComponentsApr 10, 2026
• CVE-2026-27978Next.js: null origin can bypass Server Actions CSRF checks4.3Mar 17, 2026
• CVE-2026-27977Next.js: null origin can bypass dev HMR websocket CSRF checks5.4Mar 17, 2026
• GHSA-h25m-26qc-wcjfNext.js HTTP request deserialization can lead to DoS when using insecure React Server ComponentsJan 28, 2026
• CVE-2025-59471A denial of service vulnerability exists in self-hosted Next.js applications that have `remotePatterns` configured for the Image Optimizer. The image optimization endpoint (`/_next/image`) loads ex...5.9Jan 26, 2026
• CVE-2025-59472A denial of service vulnerability exists in Next.js versions with Partial Prerendering (PPR) enabled when running in minimal mode. The PPR resume endpoint accepts unauthenticated POST requests with...5.9Jan 26, 2026
• GHSA-5j59-xgg2-r9c4Next has a Denial of Service with Server Components - Incomplete Fix Follow-UpDec 12, 2025
• GHSA-w37m-7fhw-fmv9Next Server Actions Source Code Exposure Dec 11, 2025
• GHSA-mwv6-3258-q52cNext Vulnerable to Denial of Service with Server ComponentsDec 11, 2025
• GHSA-9qr9-h5gf-34mpNext.js is vulnerable to RCE in React flight protocolDec 3, 2025
• CVE-2025-57752Next.js Affected by Cache Key Confusion for Image Optimization API Routes6.2Aug 29, 2025
• CVE-2025-55173Next.js Content Injection Vulnerability for Image Optimization4.3Aug 29, 2025