CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 26/01/2026 |
| CVE-2025-59471 | ÉLEVÉE7.5 | A denial of service vulnerability exists in self-hosted Next.js applications that have `remotePatterns` configured for the Image Optimizer. The image optimization endpoint (`/_next/image`) loads external images entirely into memory without enforcing a maximum size limit, allowing an attacker to cause out-of-memory cond | 26/01/2026 |
| GHSA-5j59-xgg2-r9c4 | ÉLEVÉE7.5 | Next has a Denial of Service with Server Components - Incomplete Fix Follow-Up | 12/12/2025 |
| CVE-2025-67779 | ÉLEVÉE7.5 | It was found that the fix addressing CVE-2025-55184 in React Server Components was incomplete and does not prevent a denial of service attack in a specific case. React Server Components versions 19.0.2, 19.1.3 and 19.2.2 are affected, allowing unsafe deserialization of payloads from HTTP requests to Server Function end | 12/12/2025 |
| GHSA-w37m-7fhw-fmv9 | MOYENNE5.3 | Next Server Actions Source Code Exposure | 11/12/2025 |
| GHSA-mwv6-3258-q52c | ÉLEVÉE7.5 | Next Vulnerable to Denial of Service with Server Components | 11/12/2025 |
| CVE-2025-55184 | ÉLEVÉE7.5 | A pre-authentication denial of service vulnerability exists in React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payload | 11/12/2025 |
| CVE-2025-55183 | MOYENNE5.3 | An information leak vulnerability exists in specific configurations of React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. A specifically crafted HTTP request sent | 11/12/2025 |
| GHSA-9qr9-h5gf-34mp | CRITIQUE10.0 | Next.js is vulnerable to RCE in React flight protocol | 03/12/2025 |
| CVE-2025-55182KEV | CRITIQUE10.0 | A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP request | 03/12/2025 |
| CVE-2025-57822 | ÉLEVÉE8.2 | Next.js is a React framework for building full-stack web applications. Prior to versions 14.2.32 and 15.4.7, when next() was used without explicitly passing the request object, it could lead to SSRF in self-hosted applications that incorrectly forwarded user-supplied headers. This vulnerability has been fixed in Next.j | 29/08/2025 |
| CVE-2025-57752 | MOYENNE6.2 | Next.js is a React framework for building full-stack web applications. In versions before 14.2.31 and from 15.0.0 to before 15.4.5, Next.js Image Optimization API routes are affected by cache key confusion. When images returned from API routes vary based on request headers (such as Cookie or Authorization), these respo | 29/08/2025 |
| CVE-2025-55173 | MOYENNE4.3 | Next.js is a React framework for building full-stack web applications. In versions before 14.2.31 and from 15.0.0 to before 15.4.5, Next.js Image Optimization is vulnerable to content injection. The issue allowed attacker-controlled external image sources to trigger file downloads with arbitrary content and filenames u | 29/08/2025 |
| CVE-2025-49826 | ÉLEVÉE7.5 | Next.js is a React framework for building full-stack web applications. From versions 15.0.4-canary.51 to before 15.1.8, a cache poisoning bug leading to a Denial of Service (DoS) condition was found in Next.js. This issue does not impact customers hosted on Vercel. Under certain conditions, this issue may allow a HTTP | 03/07/2025 |
| CVE-2025-49005 | FAIBLE3.7 | Next.js is a React framework for building full-stack web applications. In Next.js App Router from 15.3.0 to before 15.3.3 and Vercel CLI from 41.4.1 to 42.2.0, a cache poisoning vulnerability was found. The issue allowed page requests for HTML content to return a React Server Component (RSC) payload instead under certa | 03/07/2025 |
| CVE-2025-48068 | MOYENNE4.3 | Next.js is a React framework for building full-stack web applications. In versions starting from 13.0 to before 14.2.30 and 15.0.0 to before 15.2.2, Next.js may have allowed limited source code exposure when the dev server was running with the App Router enabled. The vulnerability only affects local development environ | 30/05/2025 |
| CVE-2025-32421 | FAIBLE3.7 | Next.js is a React framework for building full-stack web applications. Versions prior to 14.2.24 and 15.1.6 have a race-condition vulnerability. This issue only affects the Pages Router under certain misconfigurations, causing normal endpoints to serve `pageProps` data instead of standard HTML. This issue was patched i | 14/05/2025 |
| CVE-2025-30218 | MOYENNE5.9 | Next.js is a React framework for building full-stack web applications. To mitigate CVE-2025-29927, Next.js validated the x-middleware-subrequest-id which persisted across multiple incoming requests. However, this subrequest ID is sent to all requests, even if the destination is not the same host as the Next.js applicat | 02/04/2025 |