next (npm)
Advisories
178
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 16.4.1 or later clears every advisory below that has a fix.
Upgrade commands
npm
npm install next@16.4.1yarn
yarn add next@16.4.1pnpm
pnpm add next@16.4.1Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-673q-mjm6-r5xr Next.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays |
Critical | >= 16.0.0, < 16.4.1 | 16.4.1 |
| GHSA-2464-fhr4-w9xw Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used |
Critical | >= 10.0.0, < 15.5.28 | 15.5.28 |
| GHSA-2464-fhr4-w9xw Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used |
Critical | >= 16.0.0, < 16.4.1 | 16.4.1 |
| GHSA-p3m5-59mp-jv5r Next.js: Denial of Service in App Router using Server Actions |
High EPSS 0.39% |
>= 13.0.0, < 15.5.28 | 15.5.28 |
| GHSA-p3m5-59mp-jv5r Next.js: Denial of Service in App Router using Server Actions |
High EPSS 0.39% |
>= 16.0.0, < 16.4.1 | 16.4.1 |
| GHSA-3w37-wq28-93x7 Next.js: Pending `use cache` fill can leak Draft Mode content into regular responses and persisted pages |
Medium EPSS 0.18% |
>= 16.3.0, < 16.3.8 | 16.3.8 |
| GHSA-4jqv-mc3x-m676 Next.js has cache poisoning of SSG and ISR pages in self-hosted applications |
Medium EPSS 0.51% |
>= 16.0.0, < 16.3.8 | 16.3.8 |
| GHSA-4jqv-mc3x-m676 Next.js has cache poisoning of SSG and ISR pages in self-hosted applications |
Medium EPSS 0.51% |
>= 15.0.0, < 15.5.27 | 15.5.27 |
| GHSA-39w2-rjm5-chcv Next.js has information disclosure in development server's Model Context Protocol endpoint |
Medium EPSS 0.11% |
>= 16.0.0, < 16.3.8 | 16.3.8 |
| GHSA-f87g-xv8r-7p7x Next.js has information disclosure in App Router metadata image routes via dynamicParams bypass |
Medium EPSS 0.17% |
>= 16.0.0, < 16.3.8 | 16.3.8 |
| GHSA-mcj8-r9mp-w47p Next.js has cache poisoning in SSG/ISR rendering that leads to cross-user content substitution and persistent denial of service |
Medium EPSS 0.24% |
>= 16.0.0, < 16.3.8 | 16.3.8 |
| GHSA-mcj8-r9mp-w47p Next.js has cache poisoning in SSG/ISR rendering that leads to cross-user content substitution and persistent denial of service |
Medium EPSS 0.24% |
>= 15.0.0, < 15.5.27 | 15.5.27 |
| GHSA-cjq9-62q9-8jv4 Next.js has Server-Side Request Forgery in Image Optimization |
Medium EPSS 0.33% |
>= 16.0.0, < 16.3.8 | 16.3.8 |
| GHSA-h694-7cp9-m8p3 next.js cache leak across root param values in nested 'use cache' functions |
Medium EPSS 0.25% |
>= 16.3.0, < 16.3.8 | 16.3.8 |
| GHSA-vcvr-r3jv-pc5j Next.js: Remote Code Execution in next/og ImageResponse |
Critical EPSS 1.08% |
>= 16.2.0, < 16.3.6 | 16.3.6 |
| GHSA-2xp9-vwfh-vxw4 Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used |
Critical | >= 16.0.0, < 16.3.3 | 16.3.3 |
| GHSA-2xp9-vwfh-vxw4 Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used |
Critical | >= 10.0.0, < 15.5.24 | 15.5.24 |
| GHSA-p293-qw3h-jr36 Next.js: Unauthenticated Remote Code Execution on windows-hosted servers |
Critical EPSS 2.10% |
>= 13.4.0, < 15.5.24 | 15.5.24 |
| GHSA-p293-qw3h-jr36 Next.js: Unauthenticated Remote Code Execution on windows-hosted servers |
Critical EPSS 2.10% |
>= 16.0.0, < 16.3.3 | 16.3.3 |
| GHSA-89xv-2m56-2m9x Next.js: Server-Side Request Forgery in Server Actions on custom servers |
Medium EPSS 0.46% |
>= 14.1.1, < 15.5.21 | 15.5.21 |
| GHSA-89xv-2m56-2m9x Next.js: Server-Side Request Forgery in Server Actions on custom servers |
Medium EPSS 0.46% |
>= 16.0.0, < 16.2.11 | 16.2.11 |
| GHSA-68g3-v927-f742 Next.js: Cache confusion of response bodies for requests with bodies |
Medium EPSS 0.34% |
>= 13.0.0, < 15.5.21 | 15.5.21 |
| GHSA-68g3-v927-f742 Next.js: Cache confusion of response bodies for requests with bodies |
Medium EPSS 0.34% |
>= 16.0.0, < 16.2.11 | 16.2.11 |
| GHSA-4633-3j49-mh5q Next.js: Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences |
Medium EPSS 0.32% |
>= 13.0.0, < 15.5.21 | 15.5.21 |
| GHSA-4633-3j49-mh5q Next.js: Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences |
Medium EPSS 0.32% |
>= 16.0.0, < 16.2.11 | 16.2.11 |
| GHSA-4c39-4ccg-62r3 Next.js: Unbounded Server Action payload in Edge runtime |
Medium EPSS 0.52% |
>= 13.0.0, < 15.5.21 | 15.5.21 |
| GHSA-4c39-4ccg-62r3 Next.js: Unbounded Server Action payload in Edge runtime |
Medium EPSS 0.52% |
>= 16.0.0, < 16.2.11 | 16.2.11 |
| GHSA-p9j2-gv94-2wf4 Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname |
Medium EPSS 0.41% |
>= 12.0.0, < 15.5.21 | 15.5.21 |
| GHSA-p9j2-gv94-2wf4 Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname |
Medium EPSS 0.41% |
>= 16.0.0, < 16.2.11 | 16.2.11 |
| GHSA-q8wf-6r8g-63ch Next.js: Denial of Service in the Image Optimization API using SVGs |
Medium EPSS 0.67% |
>= 16.0.0, < 16.2.11 | 16.2.11 |
| GHSA-q8wf-6r8g-63ch Next.js: Denial of Service in the Image Optimization API using SVGs |
Medium EPSS 0.67% |
>= 15.5.0, < 15.5.21 | 15.5.21 |
| GHSA-955p-x3mx-jcvp Next.js: Unauthenticated disclosure of internal Server Function endpoints |
Medium EPSS 0.51% |
>= 13.0.0, < 15.5.21 | 15.5.21 |
| GHSA-955p-x3mx-jcvp Next.js: Unauthenticated disclosure of internal Server Function endpoints |
Medium EPSS 0.51% |
>= 16.0.0, < 16.2.11 | 16.2.11 |
| GHSA-6gpp-xcg3-4w24 Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale |
High EPSS 0.64% |
>= 16.0.0, < 16.2.11 | 16.2.11 |
| GHSA-m99w-x7hq-7vfj Next.js: Denial of Service in App Router using Server Actions |
High EPSS 0.86% |
>= 16.0.0, < 16.2.11 | 16.2.11 |
| GHSA-m99w-x7hq-7vfj Next.js: Denial of Service in App Router using Server Actions |
High EPSS 0.86% |
>= 13.0.0, < 15.5.21 | 15.5.21 |
| GHSA-26hh-7cqf-hhc6 Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Up |
High EPSS 0.60% |
>= 15.2.0, < 15.5.18 | 15.5.18 |
| GHSA-26hh-7cqf-hhc6 Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Up |
High EPSS 0.60% |
>= 16.0.0, < 16.2.6 | 16.2.6 |
| GHSA-3g8h-86w9-wvmq Next.js's Middleware / Proxy redirects can be cache-poisoned |
Medium EPSS 0.28% |
>= 12.2.0, < 15.5.16 | 15.5.16 |
| GHSA-3g8h-86w9-wvmq Next.js's Middleware / Proxy redirects can be cache-poisoned |
Medium EPSS 0.28% |
>= 16.0.0, < 16.2.5 | 16.2.5 |
| GHSA-ffhc-5mcf-pf4q Next.js vulnerable to cross-site scripting in App Router applications using CSP nonces |
Medium EPSS 0.22% |
>= 16.0.0, < 16.2.5 | 16.2.5 |
| GHSA-ffhc-5mcf-pf4q Next.js vulnerable to cross-site scripting in App Router applications using CSP nonces |
Medium EPSS 0.22% |
>= 13.4.0, < 15.5.16 | 15.5.16 |
| GHSA-vfv6-92ff-j949 Next.js vulnerable to cache poisoning via collisions in React Server Component cache-busting |
Low EPSS 0.21% |
>= 13.4.6, < 15.5.16 | 15.5.16 |
| GHSA-vfv6-92ff-j949 Next.js vulnerable to cache poisoning via collisions in React Server Component cache-busting |
Low EPSS 0.21% |
>= 16.0.0, < 16.2.5 | 16.2.5 |
| GHSA-gx5p-jg67-6x7h Next.js has cross-site scripting in beforeInteractive scripts with untrusted input |
Medium EPSS 0.21% |
>= 16.0.0, < 16.2.5 | 16.2.5 |
| GHSA-gx5p-jg67-6x7h Next.js has cross-site scripting in beforeInteractive scripts with untrusted input |
Medium EPSS 0.21% |
>= 13.0.0, < 15.5.16 | 15.5.16 |
| GHSA-mg66-mrh9-m8jx Next.js vulnerable to Denial of Service via connection exhaustion in applications using Cache Components |
High EPSS 0.75% |
>= 16.0.0, < 16.2.5 | 16.2.5 |
| GHSA-mg66-mrh9-m8jx Next.js vulnerable to Denial of Service via connection exhaustion in applications using Cache Components |
High EPSS 0.75% |
>= 15.0.0, < 15.5.16 | 15.5.16 |
| GHSA-h64f-5h5j-jqjh Next.js has a Denial of Service in the Image Optimization API |
Medium EPSS 0.74% |
>= 16.0.0, < 16.2.5 | 16.2.5 |
| GHSA-h64f-5h5j-jqjh Next.js has a Denial of Service in the Image Optimization API |
Medium EPSS 0.74% |
>= 10.0.0, < 15.5.16 | 15.5.16 |
| GHSA-c4j6-fc7j-m34r Next.js vulnerable to server-side request forgery in applications using WebSocket upgrades |
High EPSS 35.54% |
>= 13.4.13, < 15.5.16 | 15.5.16 |
| GHSA-c4j6-fc7j-m34r Next.js vulnerable to server-side request forgery in applications using WebSocket upgrades |
High EPSS 35.54% |
>= 16.0.0, < 16.2.5 | 16.2.5 |
| GHSA-wfc6-r584-vfw7 Next.js vulnerable to cache poisoning in React Server Component responses |
Medium EPSS 0.29% |
>= 16.0.0, < 16.2.5 | 16.2.5 |
| GHSA-wfc6-r584-vfw7 Next.js vulnerable to cache poisoning in React Server Component responses |
Medium EPSS 0.29% |
>= 14.2.0, < 15.5.16 | 15.5.16 |
| GHSA-267c-6grr-h53f Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes |
High EPSS 1.59% |
>= 16.0.0, < 16.2.5 | 16.2.5 |
| GHSA-267c-6grr-h53f Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes |
High EPSS 1.59% |
>= 15.2.0, < 15.5.16 | 15.5.16 |
| GHSA-492v-c6pp-mqqv Next.js has a Middleware / Proxy bypass through dynamic route parameter injection |
High EPSS 0.64% |
>= 15.4.0, < 15.5.16 | 15.5.16 |
| GHSA-492v-c6pp-mqqv Next.js has a Middleware / Proxy bypass through dynamic route parameter injection |
High EPSS 0.64% |
>= 16.0.0, < 16.2.5 | 16.2.5 |
| GHSA-36qx-fr4f-26g5 Next.js has a Middleware / Proxy bypass in Pages Router applications using i18n |
High EPSS 0.80% |
>= 16.0.0, < 16.2.5 | 16.2.5 |
| GHSA-36qx-fr4f-26g5 Next.js has a Middleware / Proxy bypass in Pages Router applications using i18n |
High EPSS 0.80% |
>= 12.2.0, < 15.5.16 | 15.5.16 |
| GHSA-8h8q-6873-q5fj Next.js Vulnerable to Denial of Service with Server Components |
High | >= 16.0.0, < 16.2.5 | 16.2.5 |
| GHSA-8h8q-6873-q5fj Next.js Vulnerable to Denial of Service with Server Components |
High | >= 13.0.0, < 15.5.16 | 15.5.16 |
| GHSA-q4gf-8mx6-v5v3 Next.js has a Denial of Service with Server Components |
High | >= 13.0.0, < 15.5.15 | 15.5.15 |
| GHSA-q4gf-8mx6-v5v3 Next.js has a Denial of Service with Server Components |
High | >= 16.0.0-beta.0, < 16.2.3 | 16.2.3 |
| GHSA-ggv3-7p47-pfv8 Next.js: HTTP request smuggling in rewrites |
Medium EPSS 0.45% |
>= 9.5.0, < 15.5.13 | 15.5.13 |
| GHSA-ggv3-7p47-pfv8 Next.js: HTTP request smuggling in rewrites |
Medium EPSS 0.45% |
>= 16.0.0-beta.0, < 16.1.7 | 16.1.7 |
| GHSA-3x4c-7xq6-9pq8 Next.js: Unbounded next/image disk cache growth can exhaust storage |
High EPSS 0.71% |
>= 16.0.0-beta.0, < 16.1.7 | 16.1.7 |
| GHSA-3x4c-7xq6-9pq8 Next.js: Unbounded next/image disk cache growth can exhaust storage |
High EPSS 0.71% |
>= 10.0.0, < 15.5.14 | 15.5.14 |
| GHSA-h27x-g6w4-24gq Next.js: Unbounded postponed resume buffering can lead to DoS |
High EPSS 0.69% |
>= 16.0.1, < 16.1.7 | 16.1.7 |
| GHSA-mq59-m269-xvcx Next.js: null origin can bypass Server Actions CSRF checks |
Medium EPSS 0.21% |
>= 16.0.1, < 16.1.7 | 16.1.7 |
| GHSA-jcc7-9wpm-mj36 Next.js: null origin can bypass dev HMR websocket CSRF checks |
Medium EPSS 0.18% |
>= 16.0.1, < 16.1.7 | 16.1.7 |
| GHSA-h25m-26qc-wcjf Next.js HTTP request deserialization can lead to DoS when using insecure React Server Components |
High | >= 15.6.0-canary.0, < 15.6.0-canary.61 | 15.6.0-canary.61 |
| GHSA-h25m-26qc-wcjf Next.js HTTP request deserialization can lead to DoS when using insecure React Server Components |
High | >= 15.4.0-canary.0, < 15.4.11 | 15.4.11 |
| GHSA-h25m-26qc-wcjf Next.js HTTP request deserialization can lead to DoS when using insecure React Server Components |
High | >= 16.0.0-beta.0, < 16.0.11 | 16.0.11 |
| GHSA-h25m-26qc-wcjf Next.js HTTP request deserialization can lead to DoS when using insecure React Server Components |
High | >= 16.1.0-canary.0, < 16.1.5 | 16.1.5 |
| GHSA-h25m-26qc-wcjf Next.js HTTP request deserialization can lead to DoS when using insecure React Server Components |
High | >= 15.5.1-canary.0, < 15.5.10 | 15.5.10 |
| GHSA-h25m-26qc-wcjf Next.js HTTP request deserialization can lead to DoS when using insecure React Server Components |
High | >= 15.1.1-canary.0, < 15.1.12 | 15.1.12 |
| GHSA-h25m-26qc-wcjf Next.js HTTP request deserialization can lead to DoS when using insecure React Server Components |
High | >= 15.2.0-canary.0, < 15.2.9 | 15.2.9 |
| GHSA-h25m-26qc-wcjf Next.js HTTP request deserialization can lead to DoS when using insecure React Server Components |
High | >= 15.3.0-canary.0, < 15.3.9 | 15.3.9 |
| GHSA-h25m-26qc-wcjf Next.js HTTP request deserialization can lead to DoS when using insecure React Server Components |
High | >= 13.0.0, < 15.0.8 | 15.0.8 |
| GHSA-5f7q-jpqc-wp7h Next.js has Unbounded Memory Consumption via PPR Resume Endpoint |
High EPSS 0.43% |
>= 15.3.0-canary.0, <= 15.3.0-canary.46 | No fix yet |
| GHSA-5f7q-jpqc-wp7h Next.js has Unbounded Memory Consumption via PPR Resume Endpoint |
High EPSS 0.43% |
>= 15.2.1-canary.0, <= 15.2.1-canary.6 | No fix yet |
| GHSA-5f7q-jpqc-wp7h Next.js has Unbounded Memory Consumption via PPR Resume Endpoint |
High EPSS 0.43% |
>= 15.2.0-canary.0, <= 15.2.0-canary.77 | No fix yet |
| GHSA-5f7q-jpqc-wp7h Next.js has Unbounded Memory Consumption via PPR Resume Endpoint |
High EPSS 0.43% |
>= 15.1.1-canary.0, <= 15.1.1-canary.27 | No fix yet |
| GHSA-5f7q-jpqc-wp7h Next.js has Unbounded Memory Consumption via PPR Resume Endpoint |
High EPSS 0.43% |
>= 15.0.4-canary.0, <= 15.0.4-canary.52 | No fix yet |
| GHSA-5f7q-jpqc-wp7h Next.js has Unbounded Memory Consumption via PPR Resume Endpoint |
High EPSS 0.43% |
>= 15.0.3-canary.0, <= 15.0.3-canary.9 | No fix yet |
| GHSA-5f7q-jpqc-wp7h Next.js has Unbounded Memory Consumption via PPR Resume Endpoint |
High EPSS 0.43% |
>= 15.0.2-canary.0, <= 15.0.2-canary.11 | No fix yet |
| GHSA-5f7q-jpqc-wp7h Next.js has Unbounded Memory Consumption via PPR Resume Endpoint |
High EPSS 0.43% |
>= 15.0.1-canary.0, <= 15.0.1-canary.3 | No fix yet |
| GHSA-5f7q-jpqc-wp7h Next.js has Unbounded Memory Consumption via PPR Resume Endpoint |
High EPSS 0.43% |
>= 15.0.0-canary.0, <= 15.0.0-canary.205 | No fix yet |
| GHSA-5f7q-jpqc-wp7h Next.js has Unbounded Memory Consumption via PPR Resume Endpoint |
High EPSS 0.43% |
>= 16.0.0-beta.0, < 16.1.5 | 16.1.5 |
| GHSA-5f7q-jpqc-wp7h Next.js has Unbounded Memory Consumption via PPR Resume Endpoint |
High EPSS 0.43% |
>= 15.3.1-canary.0, <= 15.3.1-canary.15 | No fix yet |
| GHSA-5f7q-jpqc-wp7h Next.js has Unbounded Memory Consumption via PPR Resume Endpoint |
High EPSS 0.43% |
>= 15.4.0-canary.0, <= 15.4.0-canary.130 | No fix yet |
| GHSA-5f7q-jpqc-wp7h Next.js has Unbounded Memory Consumption via PPR Resume Endpoint |
High EPSS 0.43% |
>= 15.4.2-canary.0, <= 15.4.2-canary.56 | No fix yet |
| GHSA-5f7q-jpqc-wp7h Next.js has Unbounded Memory Consumption via PPR Resume Endpoint |
High EPSS 0.43% |
>= 15.5.1-canary.0, <= 15.5.1-canary.39 | No fix yet |
| GHSA-5f7q-jpqc-wp7h Next.js has Unbounded Memory Consumption via PPR Resume Endpoint |
High EPSS 0.43% |
>= 15.6.0-canary.0, < 15.6.0-canary.61 | 15.6.0-canary.61 |
| GHSA-5f7q-jpqc-wp7h Next.js has Unbounded Memory Consumption via PPR Resume Endpoint |
High EPSS 0.43% |
>= 15.2.2-canary.0, <= 15.2.2-canary.7 | No fix yet |
| GHSA-9g9p-9gw9-jx7f Next.js self-hosted applications vulnerable to DoS via Image Optimizer remotePatterns configuration |
High EPSS 0.49% |
>= 15.6.0-canary.0, < 16.1.5 | 16.1.5 |
| GHSA-9g9p-9gw9-jx7f Next.js self-hosted applications vulnerable to DoS via Image Optimizer remotePatterns configuration |
High EPSS 0.49% |
>= 10.0.0, < 15.5.10 | 15.5.10 |
| GHSA-5j59-xgg2-r9c4 Next has a Denial of Service with Server Components - Incomplete Fix Follow-Up |
High | >= 15.0.6, < 15.0.7 | 15.0.7 |
| GHSA-5j59-xgg2-r9c4 Next has a Denial of Service with Server Components - Incomplete Fix Follow-Up |
High | >= 13.3.1-canary.0, < 14.2.35 | 14.2.35 |
| GHSA-5j59-xgg2-r9c4 Next has a Denial of Service with Server Components - Incomplete Fix Follow-Up |
High | >= 15.1.10, < 15.1.11 | 15.1.11 |
| GHSA-5j59-xgg2-r9c4 Next has a Denial of Service with Server Components - Incomplete Fix Follow-Up |
High | >= 15.2.7, < 15.2.8 | 15.2.8 |
| GHSA-5j59-xgg2-r9c4 Next has a Denial of Service with Server Components - Incomplete Fix Follow-Up |
High | >= 15.3.7, < 15.3.8 | 15.3.8 |
| GHSA-5j59-xgg2-r9c4 Next has a Denial of Service with Server Components - Incomplete Fix Follow-Up |
High | >= 15.4.9, < 15.4.10 | 15.4.10 |
| GHSA-5j59-xgg2-r9c4 Next has a Denial of Service with Server Components - Incomplete Fix Follow-Up |
High | >= 15.5.8, < 15.5.9 | 15.5.9 |
| GHSA-5j59-xgg2-r9c4 Next has a Denial of Service with Server Components - Incomplete Fix Follow-Up |
High | >= 15.6.0-canary.59, < 15.6.0-canary.60 | 15.6.0-canary.60 |
| GHSA-5j59-xgg2-r9c4 Next has a Denial of Service with Server Components - Incomplete Fix Follow-Up |
High | >= 16.0.9, < 16.0.10 | 16.0.10 |
| GHSA-5j59-xgg2-r9c4 Next has a Denial of Service with Server Components - Incomplete Fix Follow-Up |
High | >= 16.1.0-canary.17, < 16.1.0-canary.19 | 16.1.0-canary.19 |
| GHSA-w37m-7fhw-fmv9 Next Server Actions Source Code Exposure |
Medium | >= 15.3.0-canary.0, < 15.3.7 | 15.3.7 |
| GHSA-w37m-7fhw-fmv9 Next Server Actions Source Code Exposure |
Medium | >= 15.0.0-canary.0, < 15.0.6 | 15.0.6 |
| GHSA-w37m-7fhw-fmv9 Next Server Actions Source Code Exposure |
Medium | >= 15.1.1-canary.0, < 15.1.10 | 15.1.10 |
| GHSA-w37m-7fhw-fmv9 Next Server Actions Source Code Exposure |
Medium | >= 15.2.0-canary.0, < 15.2.7 | 15.2.7 |
| GHSA-w37m-7fhw-fmv9 Next Server Actions Source Code Exposure |
Medium | >= 16.1.0-canary.0, < 16.1.0-canary.17 | 16.1.0-canary.17 |
| GHSA-w37m-7fhw-fmv9 Next Server Actions Source Code Exposure |
Medium | >= 16.0.0-beta.0, < 16.0.9 | 16.0.9 |
| GHSA-w37m-7fhw-fmv9 Next Server Actions Source Code Exposure |
Medium | >= 15.6.0-canary.0, < 15.6.0-canary.59 | 15.6.0-canary.59 |
| GHSA-w37m-7fhw-fmv9 Next Server Actions Source Code Exposure |
Medium | >= 15.5.1-canary.0, < 15.5.8 | 15.5.8 |
| GHSA-w37m-7fhw-fmv9 Next Server Actions Source Code Exposure |
Medium | >= 15.4.0-canary.0, < 15.4.9 | 15.4.9 |
| GHSA-mwv6-3258-q52c Next Vulnerable to Denial of Service with Server Components |
High | >= 13.3.0, < 14.2.34 | 14.2.34 |
| GHSA-mwv6-3258-q52c Next Vulnerable to Denial of Service with Server Components |
High | >= 16.1.0-canary.0, < 16.1.0-canary.17 | 16.1.0-canary.17 |
| GHSA-mwv6-3258-q52c Next Vulnerable to Denial of Service with Server Components |
High | >= 16.0.0-beta.0, < 16.0.9 | 16.0.9 |
| GHSA-mwv6-3258-q52c Next Vulnerable to Denial of Service with Server Components |
High | >= 15.6.0-canary.0, < 15.6.0-canary.59 | 15.6.0-canary.59 |
| GHSA-mwv6-3258-q52c Next Vulnerable to Denial of Service with Server Components |
High | >= 15.5.1-canary.0, < 15.5.8 | 15.5.8 |
| GHSA-mwv6-3258-q52c Next Vulnerable to Denial of Service with Server Components |
High | >= 15.4.0-canary.0, < 15.4.9 | 15.4.9 |
| GHSA-mwv6-3258-q52c Next Vulnerable to Denial of Service with Server Components |
High | >= 15.3.0-canary.0, < 15.3.7 | 15.3.7 |
| GHSA-mwv6-3258-q52c Next Vulnerable to Denial of Service with Server Components |
High | >= 15.2.0-canary.0, < 15.2.7 | 15.2.7 |
| GHSA-mwv6-3258-q52c Next Vulnerable to Denial of Service with Server Components |
High | >= 15.1.1-canary.0, < 15.1.10 | 15.1.10 |
| GHSA-mwv6-3258-q52c Next Vulnerable to Denial of Service with Server Components |
High | >= 15.0.0-canary.0, < 15.0.6 | 15.0.6 |
| GHSA-9qr9-h5gf-34mp Next.js is vulnerable to RCE in React flight protocol |
Critical EPSS 1.35% |
>= 15.2.0-canary.0, < 15.2.6 | 15.2.6 |
| GHSA-9qr9-h5gf-34mp Next.js is vulnerable to RCE in React flight protocol |
Critical EPSS 1.35% |
>= 16.0.0-canary.0, < 16.0.7 | 16.0.7 |
| GHSA-9qr9-h5gf-34mp Next.js is vulnerable to RCE in React flight protocol |
Critical EPSS 1.35% |
>= 14.3.0-canary.77, < 15.0.5 | 15.0.5 |
| GHSA-9qr9-h5gf-34mp Next.js is vulnerable to RCE in React flight protocol |
Critical EPSS 1.35% |
>= 15.1.0-canary.0, < 15.1.9 | 15.1.9 |
| GHSA-9qr9-h5gf-34mp Next.js is vulnerable to RCE in React flight protocol |
Critical EPSS 1.35% |
>= 15.3.0-canary.0, < 15.3.6 | 15.3.6 |
| GHSA-9qr9-h5gf-34mp Next.js is vulnerable to RCE in React flight protocol |
Critical EPSS 1.35% |
>= 15.4.0-canary.0, < 15.4.8 | 15.4.8 |
| GHSA-9qr9-h5gf-34mp Next.js is vulnerable to RCE in React flight protocol |
Critical EPSS 1.35% |
>= 15.5.0-canary.0, < 15.5.7 | 15.5.7 |
| GHSA-g5qg-72qw-gw5v Next.js Affected by Cache Key Confusion for Image Optimization API Routes |
Medium EPSS 0.35% |
>= 15.0.0, < 15.4.5 | 15.4.5 |
| GHSA-g5qg-72qw-gw5v Next.js Affected by Cache Key Confusion for Image Optimization API Routes |
Medium EPSS 0.35% |
>= 0.9.9, < 14.2.31 | 14.2.31 |
| GHSA-xv57-4mr9-wg8v Next.js Content Injection Vulnerability for Image Optimization |
Medium EPSS 0.60% |
>= 0.9.9, < 14.2.31 | 14.2.31 |
| GHSA-xv57-4mr9-wg8v Next.js Content Injection Vulnerability for Image Optimization |
Medium EPSS 0.60% |
>= 15.0.0, < 15.4.5 | 15.4.5 |
| GHSA-4342-x723-ch2f Next.js Improper Middleware Redirect Handling Leads to SSRF |
High EPSS 2.58% |
>= 0.9.9, < 14.2.32 | 14.2.32 |
| GHSA-4342-x723-ch2f Next.js Improper Middleware Redirect Handling Leads to SSRF |
High EPSS 2.58% |
>= 15.0.0-canary.0, < 15.4.7 | 15.4.7 |
| GHSA-67rr-84xm-4c7r Next.JS vulnerability can lead to DoS via cache poisoning |
High EPSS 1.13% |
>= 15.0.4-canary.51, < 15.1.8 | 15.1.8 |
| GHSA-r2fc-ccr8-96c4 Next.js has a Cache poisoning vulnerability due to omission of the Vary header |
Low EPSS 0.49% |
>= 15.3.0, < 15.3.3 | 15.3.3 |
| GHSA-3h52-269p-cp9r Information exposure in Next.js dev server due to lack of origin verification |
Medium EPSS 0.20% |
>= 15.0.0, < 15.2.2 | 15.2.2 |
| GHSA-3h52-269p-cp9r Information exposure in Next.js dev server due to lack of origin verification |
Medium EPSS 0.20% |
>= 13.0, < 14.2.30 | 14.2.30 |
| GHSA-qpjv-v59x-3qc4 Next.js Race Condition to Cache Poisoning |
Low EPSS 0.80% |
>= 15.0.0, < 15.1.6 | 15.1.6 |
| GHSA-qpjv-v59x-3qc4 Next.js Race Condition to Cache Poisoning |
Low EPSS 0.80% |
>= 0.9.9, < 14.2.24 | 14.2.24 |
| GHSA-223j-4rm8-mrmf Next.js may leak x-middleware-subrequest-id to external hosts |
Medium EPSS 0.43% |
>= 14.2.25, < 14.2.26 | 14.2.26 |
| GHSA-223j-4rm8-mrmf Next.js may leak x-middleware-subrequest-id to external hosts |
Medium EPSS 0.43% |
>= 12.3.5, < 12.3.6 | 12.3.6 |
| GHSA-223j-4rm8-mrmf Next.js may leak x-middleware-subrequest-id to external hosts |
Medium EPSS 0.43% |
>= 13.5.9, < 13.5.10 | 13.5.10 |
| GHSA-223j-4rm8-mrmf Next.js may leak x-middleware-subrequest-id to external hosts |
Medium EPSS 0.43% |
>= 15.2.3, < 15.2.4 | 15.2.4 |
| GHSA-f82v-jwr5-mffw Authorization Bypass in Next.js Middleware |
Critical EPSS 99.22% |
>= 12.0.0, < 12.3.5 | 12.3.5 |
| GHSA-f82v-jwr5-mffw Authorization Bypass in Next.js Middleware |
Critical EPSS 99.22% |
>= 13.0.0, < 13.5.9 | 13.5.9 |
| GHSA-f82v-jwr5-mffw Authorization Bypass in Next.js Middleware |
Critical EPSS 99.22% |
>= 14.0.0, < 14.2.25 | 14.2.25 |
| GHSA-f82v-jwr5-mffw Authorization Bypass in Next.js Middleware |
Critical EPSS 99.22% |
>= 15.0.0, < 15.2.3 | 15.2.3 |
| GHSA-7m27-7ghc-44w9 Next.js Allows a Denial of Service (DoS) with Server Actions |
Medium EPSS 0.80% |
>= 13.0.0, < 13.5.8 | 13.5.8 |
| GHSA-7m27-7ghc-44w9 Next.js Allows a Denial of Service (DoS) with Server Actions |
Medium EPSS 0.80% |
>= 15.0.0, < 15.1.2 | 15.1.2 |
| GHSA-7m27-7ghc-44w9 Next.js Allows a Denial of Service (DoS) with Server Actions |
Medium EPSS 0.80% |
>= 14.0.0, < 14.2.21 | 14.2.21 |
| GHSA-7gfc-8cq8-jh5f Next.js authorization bypass vulnerability |
High EPSS 4.00% |
>= 9.5.5, < 14.2.15 | 14.2.15 |
| GHSA-g77x-44xx-532m Denial of Service condition in Next.js image optimization |
High EPSS 0.73% |
>= 10.0.0, < 14.2.7 | 14.2.7 |
| GHSA-gp8f-8m3g-qvj9 Next.js Cache Poisoning |
High EPSS 59.18% |
>= 14.0.0, < 14.2.10 | 14.2.10 |
| GHSA-gp8f-8m3g-qvj9 Next.js Cache Poisoning |
High EPSS 59.18% |
>= 13.5.1, < 13.5.7 | 13.5.7 |
| GHSA-fq54-2j52-jc42 Next.js Denial of Service (DoS) condition |
High EPSS 0.49% |
>= 13.3.1, < 13.5.0 | 13.5.0 |
| GHSA-fr5h-rqp8-mj6g Next.js Server-Side Request Forgery in Server Actions |
High EPSS 5.45% |
>= 13.4.0, < 14.1.1 | 14.1.1 |
| GHSA-77r5-gw3j-2mpf Next.js Vulnerable to HTTP Request Smuggling |
High EPSS 1.19% |
>= 13.4.0, < 13.5.1 | 13.5.1 |
| GHSA-c59h-r6p8-q9wc Next.js missing cache-control header may lead to CDN caching empty reply |
High EPSS 1.61% |
>= 0.9.9, < 13.4.20-canary.13 | 13.4.20-canary.13 |
| GHSA-wff4-fpwg-qqv3 Unexpected server crash in Next.js |
Medium EPSS 1.19% |
>= 12.2.3, < 12.2.4 | 12.2.4 |
| GHSA-fmvm-x8mv-47mj Improper CSP in Image Optimization API for Next.js versions between 10.0.0 and 12.1.0 |
Medium EPSS 1.80% |
>= 10.0.0, < 12.1.0 | 12.1.0 |
| GHSA-wr66-vrwm-5g5x Denial of Service Vulnerability in next.js |
Medium EPSS 2.15% |
>= 12.0.0, < 12.0.9 | 12.0.9 |
| GHSA-25mp-g6fv-mqxx Unexpected server crash in Next.js. |
High EPSS 47.25% |
>= 0.9.9, < 11.1.3 | 11.1.3 |
| GHSA-25mp-g6fv-mqxx Unexpected server crash in Next.js. |
High EPSS 47.25% |
>= 12.0.0, < 12.0.5 | 12.0.5 |
| GHSA-9gr3-7897-pp7m XSS in Image Optimization API for Next.js |
High EPSS 1.14% |
>= 10.0.0, < 11.1.1 | 11.1.1 |
| GHSA-vxf5-wxwp-m7g9 Open Redirect in Next.js |
Medium EPSS 1.03% |
>= 0.9.9, < 11.1.0 | 11.1.0 |
| GHSA-x56p-c8cg-q435 Open Redirect in Next.js versions |
Medium EPSS 0.77% |
>= 9.5.0, < 9.5.4 | 9.5.4 |
| GHSA-5vj8-3v2h-h38v Remote Code Execution in next |
High | >= 0.9.9, < 5.1.0 | 5.1.0 |
| GHSA-fq77-7p7r-83rj Directory Traversal in Next.js |
Medium EPSS 44.78% |
>= 0.9.9, < 9.3.2 | 9.3.2 |
| GHSA-qw96-mm2g-c8m7 Next.js has cross site scripting (XSS) vulnerability via the 404 or 500 /_error page |
Medium EPSS 1.03% |
>= 7.0.0, < 7.0.2 | 7.0.2 |
| GHSA-m34x-wgrh-g897 Directory traversal vulnerability in Next.js |
High EPSS 9.06% |
>= 1.0.0, < 4.2.3 | 4.2.3 |
| GHSA-3f5c-4qxj-vmpf Next.js Directory Traversal Vulnerability |
High EPSS 14.10% |
>= 1.0.0, < 2.4.1 | 2.4.1 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor