https://vulnerability.circl.lu/product/10a1964c-6295-4e11-b7f7-0b94a0e9ecab/recent 2026-10-08T13:42:34.039318+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Vulnerabilities published under the CPE names of Next.js. https://vulnerability.circl.lu/vuln/cve-2025-55182 2026-10-07T17:58:00.859000+00:00 A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.

2025-12-03T15:40:56.894000+00:00 https://vulnerability.circl.lu/vuln/cve-2026-94483 2026-10-06T16:33:25.979000+00:00 Next.js: Server-Side Request Forgery in Image Optimization

Next.js: Server-Side Request Forgery in Image Optimization

2026-10-02T15:18:38.684000+00:00 https://vulnerability.circl.lu/vuln/cve-2026-94543 2026-10-06T16:31:58.295000+00:00 Next.js: Cache poisoning of SSG and ISR pages in self-hosted Next.js applications

Next.js: Cache poisoning of SSG and ISR pages in self-hosted Next.js applications

2026-10-02T15:16:49.658000+00:00 https://vulnerability.circl.lu/vuln/cve-2026-94544 2026-10-05T20:21:54.256000+00:00 Next.js: Pending `use cache` fill can leak Draft Mode content into regular responses and persisted pages

Next.js: Pending `use cache` fill can leak Draft Mode content into regular responses and persisted pages

2026-10-02T15:14:43.506000+00:00 https://vulnerability.circl.lu/vuln/cve-2026-94484 2026-10-05T20:07:39.105000+00:00 Next.js: Cache poisoning in Next.js SSG/ISR rendering leads to cross-user content substitution and persistent denial of service

Next.js: Cache poisoning in Next.js SSG/ISR rendering leads to cross-user content substitution and persistent denial of service

2026-10-02T15:26:48.417000+00:00 https://vulnerability.circl.lu/vuln/cve-2026-94486 2026-10-02T16:20:19.256000+00:00 Next.js: Information disclosure in the Next.js development server's Model Context Protocol endpoint

Next.js: Information disclosure in the Next.js development server's Model Context Protocol endpoint

2026-10-02T15:12:31.134000+00:00 https://vulnerability.circl.lu/vuln/cve-2026-94485 2026-10-02T16:05:57.266000+00:00 Next.js: Information disclosure in Next.js App Router metadata image routes via dynamicParams bypass

Next.js: Information disclosure in Next.js App Router metadata image routes via dynamicParams bypass

2026-10-02T15:23:29.239000+00:00 https://vulnerability.circl.lu/vuln/cve-2026-103004 2026-10-01T16:09:53.178000+00:00 next.js cache leak on warm `use cache` handlers accessing root param

next.js cache leak on warm `use cache` handlers accessing root param

2026-10-01T14:50:27.033000+00:00 https://vulnerability.circl.lu/vuln/cve-2026-75604 2026-09-04T19:54:40.089000+00:00 Next.js: Unauthenticated Remote Code Execution on windows-hosted servers

Next.js: Unauthenticated Remote Code Execution on windows-hosted servers

2026-09-01T21:23:30.859000+00:00 https://vulnerability.circl.lu/vuln/cve-2026-45109 2026-08-13T12:04:29.810000+00:00 Next.js: Middleware / Proxy bypass in App Router applications via segment-prefetch routes

Next.js: Middleware / Proxy bypass in App Router applications via segment-prefetch routes

2026-05-13T17:11:07.275000+00:00