https://vulnerability.circl.lu Vulnerabilities published under the CPE names of Next.js. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 13:41:09 +0000 https://vulnerability.circl.lu/vuln/cve-2025-55182 A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints. A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints. https://vulnerability.circl.lu/vuln/cve-2025-55182 Wed, 03 Dec 2025 15:40:56 +0000 https://vulnerability.circl.lu/vuln/cve-2026-94483 Next.js: Server-Side Request Forgery in Image Optimization Next.js: Server-Side Request Forgery in Image Optimization https://vulnerability.circl.lu/vuln/cve-2026-94483 Fri, 02 Oct 2026 15:18:38 +0000 https://vulnerability.circl.lu/vuln/cve-2026-94543 Next.js: Cache poisoning of SSG and ISR pages in self-hosted Next.js applications Next.js: Cache poisoning of SSG and ISR pages in self-hosted Next.js applications https://vulnerability.circl.lu/vuln/cve-2026-94543 Fri, 02 Oct 2026 15:16:49 +0000 https://vulnerability.circl.lu/vuln/cve-2026-94544 Next.js: Pending `use cache` fill can leak Draft Mode content into regular responses and persisted pages Next.js: Pending `use cache` fill can leak Draft Mode content into regular responses and persisted pages https://vulnerability.circl.lu/vuln/cve-2026-94544 Fri, 02 Oct 2026 15:14:43 +0000 https://vulnerability.circl.lu/vuln/cve-2026-94484 Next.js: Cache poisoning in Next.js SSG/ISR rendering leads to cross-user content substitution and persistent denial of service Next.js: Cache poisoning in Next.js SSG/ISR rendering leads to cross-user content substitution and persistent denial of service https://vulnerability.circl.lu/vuln/cve-2026-94484 Fri, 02 Oct 2026 15:26:48 +0000 https://vulnerability.circl.lu/vuln/cve-2026-94486 Next.js: Information disclosure in the Next.js development server's Model Context Protocol endpoint Next.js: Information disclosure in the Next.js development server's Model Context Protocol endpoint https://vulnerability.circl.lu/vuln/cve-2026-94486 Fri, 02 Oct 2026 15:12:31 +0000 https://vulnerability.circl.lu/vuln/cve-2026-94485 Next.js: Information disclosure in Next.js App Router metadata image routes via dynamicParams bypass Next.js: Information disclosure in Next.js App Router metadata image routes via dynamicParams bypass https://vulnerability.circl.lu/vuln/cve-2026-94485 Fri, 02 Oct 2026 15:23:29 +0000 https://vulnerability.circl.lu/vuln/cve-2026-103004 next.js cache leak on warm `use cache` handlers accessing root param next.js cache leak on warm `use cache` handlers accessing root param https://vulnerability.circl.lu/vuln/cve-2026-103004 Thu, 01 Oct 2026 14:50:27 +0000 https://vulnerability.circl.lu/vuln/cve-2026-75604 Next.js: Unauthenticated Remote Code Execution on windows-hosted servers Next.js: Unauthenticated Remote Code Execution on windows-hosted servers https://vulnerability.circl.lu/vuln/cve-2026-75604 Tue, 01 Sep 2026 21:23:30 +0000 https://vulnerability.circl.lu/vuln/cve-2026-45109 Next.js: Middleware / Proxy bypass in App Router applications via segment-prefetch routes Next.js: Middleware / Proxy bypass in App Router applications via segment-prefetch routes https://vulnerability.circl.lu/vuln/cve-2026-45109 Wed, 13 May 2026 17:11:07 +0000