Next.js vulnerabilities and security advisories

The newest reviewed advisories for next on npm. Each one shows which versions are affected, which version fixes it, and a prompt that has your AI agent check your project and upgrade only if it needs to.

Get an email when Next.js has a new one

Email alerts are coming soon. This page updates every hour.

$ latest 30 · 30 critical, high or exploited

criticalSep 8, 2026

Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used

next >= 10.0.0, < 15.5.24 · fixed in 15.5.24
next >= 16.0.0, < 16.3.3 · fixed in 16.3.3

GHSA-2xp9-vwfh-vxw4

prompt for your AI agent

paste into your agent

A security advisory covers a package this project may use.

Advisory: GHSA-2xp9-vwfh-vxw4, severity critical
What it is: Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used
Affected packages:
- next: affected versions >= 10.0.0, < 15.5.24. Fixed in 15.5.24.
- next: affected versions >= 16.0.0, < 16.3.3. Fixed in 16.3.3.
Details: https://github.com/advisories/GHSA-2xp9-vwfh-vxw4

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.

criticalSep 8, 2026

Next.js: Unauthenticated Remote Code Execution on windows-hosted servers

next >= 13.4.0, < 15.5.24 · fixed in 15.5.24
next >= 16.0.0, < 16.3.3 · fixed in 16.3.3

GHSA-p293-qw3h-jr36CVE-2026-75604

prompt for your AI agent

paste into your agent

A security advisory covers a package this project may use.

Advisory: GHSA-p293-qw3h-jr36 (CVE-2026-75604), severity critical
What it is: Next.js: Unauthenticated Remote Code Execution on windows-hosted servers
Affected packages:
- next: affected versions >= 13.4.0, < 15.5.24. Fixed in 15.5.24.
- next: affected versions >= 16.0.0, < 16.3.3. Fixed in 16.3.3.
Details: https://github.com/advisories/GHSA-p293-qw3h-jr36

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.

highJul 22, 2026

Next.js: Server-Side Request Forgery in Server Actions on custom servers

next >= 14.1.1, < 15.5.21 · fixed in 15.5.21
next >= 16.0.0, < 16.2.11 · fixed in 16.2.11

GHSA-89xv-2m56-2m9xCVE-2026-64649

prompt for your AI agent

paste into your agent

A security advisory covers a package this project may use.

Advisory: GHSA-89xv-2m56-2m9x (CVE-2026-64649), severity high
What it is: Next.js: Server-Side Request Forgery in Server Actions on custom servers
Affected packages:
- next: affected versions >= 14.1.1, < 15.5.21. Fixed in 15.5.21.
- next: affected versions >= 16.0.0, < 16.2.11. Fixed in 16.2.11.
Details: https://github.com/advisories/GHSA-89xv-2m56-2m9x

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.

mediumJul 22, 2026

Next.js: Cache confusion of response bodies for requests with bodies

next >= 13.0.0, < 15.5.21 · fixed in 15.5.21
next >= 16.0.0, < 16.2.11 · fixed in 16.2.11

GHSA-68g3-v927-f742CVE-2026-64648

prompt for your AI agent

paste into your agent

A security advisory covers a package this project may use.

Advisory: GHSA-68g3-v927-f742 (CVE-2026-64648), severity medium
What it is: Next.js: Cache confusion of response bodies for requests with bodies
Affected packages:
- next: affected versions >= 13.0.0, < 15.5.21. Fixed in 15.5.21.
- next: affected versions >= 16.0.0, < 16.2.11. Fixed in 16.2.11.
Details: https://github.com/advisories/GHSA-68g3-v927-f742

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.

mediumJul 22, 2026

Next.js: Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences

next >= 13.0.0, < 15.5.21 · fixed in 15.5.21
next >= 16.0.0, < 16.2.11 · fixed in 16.2.11

GHSA-4633-3j49-mh5qCVE-2026-64647

prompt for your AI agent

paste into your agent

A security advisory covers a package this project may use.

Advisory: GHSA-4633-3j49-mh5q (CVE-2026-64647), severity medium
What it is: Next.js: Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences
Affected packages:
- next: affected versions >= 13.0.0, < 15.5.21. Fixed in 15.5.21.
- next: affected versions >= 16.0.0, < 16.2.11. Fixed in 16.2.11.
Details: https://github.com/advisories/GHSA-4633-3j49-mh5q

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.

mediumJul 22, 2026

Next.js: Unbounded Server Action payload in Edge runtime

next >= 13.0.0, < 15.5.21 · fixed in 15.5.21
next >= 16.0.0, < 16.2.11 · fixed in 16.2.11

GHSA-4c39-4ccg-62r3CVE-2026-64646

prompt for your AI agent

paste into your agent

A security advisory covers a package this project may use.

Advisory: GHSA-4c39-4ccg-62r3 (CVE-2026-64646), severity medium
What it is: Next.js: Unbounded Server Action payload in Edge runtime
Affected packages:
- next: affected versions >= 13.0.0, < 15.5.21. Fixed in 15.5.21.
- next: affected versions >= 16.0.0, < 16.2.11. Fixed in 16.2.11.
Details: https://github.com/advisories/GHSA-4c39-4ccg-62r3

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.

highJul 22, 2026

Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname

next >= 12.0.0, < 15.5.21 · fixed in 15.5.21
next >= 16.0.0, < 16.2.11 · fixed in 16.2.11

GHSA-p9j2-gv94-2wf4CVE-2026-64645

prompt for your AI agent

paste into your agent

A security advisory covers a package this project may use.

Advisory: GHSA-p9j2-gv94-2wf4 (CVE-2026-64645), severity high
What it is: Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname
Affected packages:
- next: affected versions >= 12.0.0, < 15.5.21. Fixed in 15.5.21.
- next: affected versions >= 16.0.0, < 16.2.11. Fixed in 16.2.11.
Details: https://github.com/advisories/GHSA-p9j2-gv94-2wf4

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.

mediumJul 22, 2026

Next.js: Denial of Service in the Image Optimization API using SVGs

next >= 15.5.0, < 15.5.21 · fixed in 15.5.21
next >= 16.0.0, < 16.2.11 · fixed in 16.2.11

GHSA-q8wf-6r8g-63chCVE-2026-64644

prompt for your AI agent

paste into your agent

A security advisory covers a package this project may use.

Advisory: GHSA-q8wf-6r8g-63ch (CVE-2026-64644), severity medium
What it is: Next.js: Denial of Service in the Image Optimization API using SVGs
Affected packages:
- next: affected versions >= 15.5.0, < 15.5.21. Fixed in 15.5.21.
- next: affected versions >= 16.0.0, < 16.2.11. Fixed in 16.2.11.
Details: https://github.com/advisories/GHSA-q8wf-6r8g-63ch

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.

mediumJul 22, 2026

Next.js: Unauthenticated disclosure of internal Server Function endpoints

next >= 13.0.0, < 15.5.21 · fixed in 15.5.21
next >= 16.0.0, < 16.2.11 · fixed in 16.2.11

GHSA-955p-x3mx-jcvpCVE-2026-64643

prompt for your AI agent

paste into your agent

A security advisory covers a package this project may use.

Advisory: GHSA-955p-x3mx-jcvp (CVE-2026-64643), severity medium
What it is: Next.js: Unauthenticated disclosure of internal Server Function endpoints
Affected packages:
- next: affected versions >= 13.0.0, < 15.5.21. Fixed in 15.5.21.
- next: affected versions >= 16.0.0, < 16.2.11. Fixed in 16.2.11.
Details: https://github.com/advisories/GHSA-955p-x3mx-jcvp

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.

highJul 22, 2026

Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale

next >= 16.0.0, < 16.2.11 · fixed in 16.2.11

GHSA-6gpp-xcg3-4w24CVE-2026-64642

prompt for your AI agent

paste into your agent

A security advisory covers a package this project may use.

Advisory: GHSA-6gpp-xcg3-4w24 (CVE-2026-64642), severity high
What it is: Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale
Affected packages:
- next: affected versions >= 16.0.0, < 16.2.11. Fixed in 16.2.11.
Details: https://github.com/advisories/GHSA-6gpp-xcg3-4w24

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.

highJul 22, 2026

Next.js: Denial of Service in App Router using Server Actions

next >= 13.0.0, < 15.5.21 · fixed in 15.5.21
next >= 16.0.0, < 16.2.11 · fixed in 16.2.11

GHSA-m99w-x7hq-7vfjCVE-2026-64641

prompt for your AI agent

paste into your agent

A security advisory covers a package this project may use.

Advisory: GHSA-m99w-x7hq-7vfj (CVE-2026-64641), severity high
What it is: Next.js: Denial of Service in App Router using Server Actions
Affected packages:
- next: affected versions >= 13.0.0, < 15.5.21. Fixed in 15.5.21.
- next: affected versions >= 16.0.0, < 16.2.11. Fixed in 16.2.11.
Details: https://github.com/advisories/GHSA-m99w-x7hq-7vfj

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.

highMay 11, 2026

Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Up

next >= 15.2.0, < 15.5.18 · fixed in 15.5.18
next >= 16.0.0, < 16.2.6 · fixed in 16.2.6

GHSA-26hh-7cqf-hhc6CVE-2026-45109

prompt for your AI agent

paste into your agent

A security advisory covers a package this project may use.

Advisory: GHSA-26hh-7cqf-hhc6 (CVE-2026-45109), severity high
What it is: Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Up
Affected packages:
- next: affected versions >= 15.2.0, < 15.5.18. Fixed in 15.5.18.
- next: affected versions >= 16.0.0, < 16.2.6. Fixed in 16.2.6.
Details: https://github.com/advisories/GHSA-26hh-7cqf-hhc6

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.

lowMay 11, 2026

Next.js's Middleware / Proxy redirects can be cache-poisoned

next >= 12.2.0, < 15.5.16 · fixed in 15.5.16
next >= 16.0.0, < 16.2.5 · fixed in 16.2.5

GHSA-3g8h-86w9-wvmqCVE-2026-44572

prompt for your AI agent

paste into your agent

A security advisory covers a package this project may use.

Advisory: GHSA-3g8h-86w9-wvmq (CVE-2026-44572), severity low
What it is: Next.js's Middleware / Proxy redirects can be cache-poisoned
Affected packages:
- next: affected versions >= 12.2.0, < 15.5.16. Fixed in 15.5.16.
- next: affected versions >= 16.0.0, < 16.2.5. Fixed in 16.2.5.
Details: https://github.com/advisories/GHSA-3g8h-86w9-wvmq

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.

mediumMay 11, 2026

Next.js vulnerable to cross-site scripting in App Router applications using CSP nonces

next >= 13.4.0, < 15.5.16 · fixed in 15.5.16
next >= 16.0.0, < 16.2.5 · fixed in 16.2.5

GHSA-ffhc-5mcf-pf4qCVE-2026-44581

prompt for your AI agent

paste into your agent

A security advisory covers a package this project may use.

Advisory: GHSA-ffhc-5mcf-pf4q (CVE-2026-44581), severity medium
What it is: Next.js vulnerable to cross-site scripting in App Router applications using CSP nonces
Affected packages:
- next: affected versions >= 13.4.0, < 15.5.16. Fixed in 15.5.16.
- next: affected versions >= 16.0.0, < 16.2.5. Fixed in 16.2.5.
Details: https://github.com/advisories/GHSA-ffhc-5mcf-pf4q

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.

lowMay 11, 2026

Next.js vulnerable to cache poisoning via collisions in React Server Component cache-busting

next >= 13.4.6, < 15.5.16 · fixed in 15.5.16
next >= 16.0.0, < 16.2.5 · fixed in 16.2.5

GHSA-vfv6-92ff-j949CVE-2026-44582

prompt for your AI agent

paste into your agent

A security advisory covers a package this project may use.

Advisory: GHSA-vfv6-92ff-j949 (CVE-2026-44582), severity low
What it is: Next.js vulnerable to cache poisoning via collisions in React Server Component cache-busting
Affected packages:
- next: affected versions >= 13.4.6, < 15.5.16. Fixed in 15.5.16.
- next: affected versions >= 16.0.0, < 16.2.5. Fixed in 16.2.5.
Details: https://github.com/advisories/GHSA-vfv6-92ff-j949

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.

mediumMay 11, 2026

Next.js has cross-site scripting in beforeInteractive scripts with untrusted input

next >= 13.0.0, < 15.5.16 · fixed in 15.5.16
next >= 16.0.0, < 16.2.5 · fixed in 16.2.5

GHSA-gx5p-jg67-6x7hCVE-2026-44580

prompt for your AI agent

paste into your agent

A security advisory covers a package this project may use.

Advisory: GHSA-gx5p-jg67-6x7h (CVE-2026-44580), severity medium
What it is: Next.js has cross-site scripting in beforeInteractive scripts with untrusted input
Affected packages:
- next: affected versions >= 13.0.0, < 15.5.16. Fixed in 15.5.16.
- next: affected versions >= 16.0.0, < 16.2.5. Fixed in 16.2.5.
Details: https://github.com/advisories/GHSA-gx5p-jg67-6x7h

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.

highMay 11, 2026

Next.js vulnerable to Denial of Service via connection exhaustion in applications using Cache Components

next >= 15.0.0, < 15.5.16 · fixed in 15.5.16
next >= 16.0.0, < 16.2.5 · fixed in 16.2.5

GHSA-mg66-mrh9-m8jxCVE-2026-44579

prompt for your AI agent

paste into your agent

A security advisory covers a package this project may use.

Advisory: GHSA-mg66-mrh9-m8jx (CVE-2026-44579), severity high
What it is: Next.js vulnerable to Denial of Service via connection exhaustion in applications using Cache Components
Affected packages:
- next: affected versions >= 15.0.0, < 15.5.16. Fixed in 15.5.16.
- next: affected versions >= 16.0.0, < 16.2.5. Fixed in 16.2.5.
Details: https://github.com/advisories/GHSA-mg66-mrh9-m8jx

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.

mediumMay 11, 2026

Next.js has a Denial of Service in the Image Optimization API

next >= 10.0.0, < 15.5.16 · fixed in 15.5.16
next >= 16.0.0, < 16.2.5 · fixed in 16.2.5

GHSA-h64f-5h5j-jqjhCVE-2026-44577

prompt for your AI agent

paste into your agent

A security advisory covers a package this project may use.

Advisory: GHSA-h64f-5h5j-jqjh (CVE-2026-44577), severity medium
What it is: Next.js has a Denial of Service in the Image Optimization API
Affected packages:
- next: affected versions >= 10.0.0, < 15.5.16. Fixed in 15.5.16.
- next: affected versions >= 16.0.0, < 16.2.5. Fixed in 16.2.5.
Details: https://github.com/advisories/GHSA-h64f-5h5j-jqjh

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.

highMay 11, 2026

Next.js vulnerable to server-side request forgery in applications using WebSocket upgrades

next >= 13.4.13, < 15.5.16 · fixed in 15.5.16
next >= 16.0.0, < 16.2.5 · fixed in 16.2.5

GHSA-c4j6-fc7j-m34rCVE-2026-44578

prompt for your AI agent

paste into your agent

A security advisory covers a package this project may use.

Advisory: GHSA-c4j6-fc7j-m34r (CVE-2026-44578), severity high
What it is: Next.js vulnerable to server-side request forgery in applications using WebSocket upgrades
Affected packages:
- next: affected versions >= 13.4.13, < 15.5.16. Fixed in 15.5.16.
- next: affected versions >= 16.0.0, < 16.2.5. Fixed in 16.2.5.
Details: https://github.com/advisories/GHSA-c4j6-fc7j-m34r

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.

mediumMay 11, 2026

Next.js vulnerable to cache poisoning in React Server Component responses

next >= 14.2.0, < 15.5.16 · fixed in 15.5.16
next >= 16.0.0, < 16.2.5 · fixed in 16.2.5

GHSA-wfc6-r584-vfw7CVE-2026-44576

prompt for your AI agent

paste into your agent

A security advisory covers a package this project may use.

Advisory: GHSA-wfc6-r584-vfw7 (CVE-2026-44576), severity medium
What it is: Next.js vulnerable to cache poisoning in React Server Component responses
Affected packages:
- next: affected versions >= 14.2.0, < 15.5.16. Fixed in 15.5.16.
- next: affected versions >= 16.0.0, < 16.2.5. Fixed in 16.2.5.
Details: https://github.com/advisories/GHSA-wfc6-r584-vfw7

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.

highMay 11, 2026

Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes

next >= 15.2.0, < 15.5.16 · fixed in 15.5.16
next >= 16.0.0, < 16.2.5 · fixed in 16.2.5

GHSA-267c-6grr-h53fCVE-2026-44575

prompt for your AI agent

paste into your agent

A security advisory covers a package this project may use.

Advisory: GHSA-267c-6grr-h53f (CVE-2026-44575), severity high
What it is: Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes
Affected packages:
- next: affected versions >= 15.2.0, < 15.5.16. Fixed in 15.5.16.
- next: affected versions >= 16.0.0, < 16.2.5. Fixed in 16.2.5.
Details: https://github.com/advisories/GHSA-267c-6grr-h53f

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.

highMay 11, 2026

Next.js has a Middleware / Proxy bypass through dynamic route parameter injection

next >= 15.4.0, < 15.5.16 · fixed in 15.5.16
next >= 16.0.0, < 16.2.5 · fixed in 16.2.5

GHSA-492v-c6pp-mqqvCVE-2026-44574

prompt for your AI agent

paste into your agent

A security advisory covers a package this project may use.

Advisory: GHSA-492v-c6pp-mqqv (CVE-2026-44574), severity high
What it is: Next.js has a Middleware / Proxy bypass through dynamic route parameter injection
Affected packages:
- next: affected versions >= 15.4.0, < 15.5.16. Fixed in 15.5.16.
- next: affected versions >= 16.0.0, < 16.2.5. Fixed in 16.2.5.
Details: https://github.com/advisories/GHSA-492v-c6pp-mqqv

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.

highMay 11, 2026

Next.js has a Middleware / Proxy bypass in Pages Router applications using i18n

next >= 12.2.0, < 15.5.16 · fixed in 15.5.16
next >= 16.0.0, < 16.2.5 · fixed in 16.2.5

GHSA-36qx-fr4f-26g5CVE-2026-44573

prompt for your AI agent

paste into your agent

A security advisory covers a package this project may use.

Advisory: GHSA-36qx-fr4f-26g5 (CVE-2026-44573), severity high
What it is: Next.js has a Middleware / Proxy bypass in Pages Router applications using i18n
Affected packages:
- next: affected versions >= 12.2.0, < 15.5.16. Fixed in 15.5.16.
- next: affected versions >= 16.0.0, < 16.2.5. Fixed in 16.2.5.
Details: https://github.com/advisories/GHSA-36qx-fr4f-26g5

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.

highMay 11, 2026

Next.js Vulnerable to Denial of Service with Server Components

next >= 13.0.0, < 15.5.16 · fixed in 15.5.16
next >= 16.0.0, < 16.2.5 · fixed in 16.2.5

GHSA-8h8q-6873-q5fj

prompt for your AI agent

paste into your agent

A security advisory covers a package this project may use.

Advisory: GHSA-8h8q-6873-q5fj, severity high
What it is: Next.js Vulnerable to Denial of Service with Server Components
Affected packages:
- next: affected versions >= 13.0.0, < 15.5.16. Fixed in 15.5.16.
- next: affected versions >= 16.0.0, < 16.2.5. Fixed in 16.2.5.
Details: https://github.com/advisories/GHSA-8h8q-6873-q5fj

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.

highApr 10, 2026

Next.js has a Denial of Service with Server Components

next >= 13.0.0, < 15.5.15 · fixed in 15.5.15
next >= 16.0.0-beta.0, < 16.2.3 · fixed in 16.2.3

GHSA-q4gf-8mx6-v5v3

prompt for your AI agent

paste into your agent

A security advisory covers a package this project may use.

Advisory: GHSA-q4gf-8mx6-v5v3, severity high
What it is: Next.js has a Denial of Service with Server Components
Affected packages:
- next: affected versions >= 13.0.0, < 15.5.15. Fixed in 15.5.15.
- next: affected versions >= 16.0.0-beta.0, < 16.2.3. Fixed in 16.2.3.
Details: https://github.com/advisories/GHSA-q4gf-8mx6-v5v3

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.

mediumMar 17, 2026

Next.js: HTTP request smuggling in rewrites

next >= 16.0.0-beta.0, < 16.1.7 · fixed in 16.1.7
next >= 9.5.0, < 15.5.13 · fixed in 15.5.13

GHSA-ggv3-7p47-pfv8CVE-2026-29057

prompt for your AI agent

paste into your agent

A security advisory covers a package this project may use.

Advisory: GHSA-ggv3-7p47-pfv8 (CVE-2026-29057), severity medium
What it is: Next.js: HTTP request smuggling in rewrites
Affected packages:
- next: affected versions >= 16.0.0-beta.0, < 16.1.7. Fixed in 16.1.7.
- next: affected versions >= 9.5.0, < 15.5.13. Fixed in 15.5.13.
Details: https://github.com/advisories/GHSA-ggv3-7p47-pfv8

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.

mediumMar 17, 2026

Next.js: Unbounded next/image disk cache growth can exhaust storage

next >= 16.0.0-beta.0, < 16.1.7 · fixed in 16.1.7
next >= 10.0.0, < 15.5.14 · fixed in 15.5.14

GHSA-3x4c-7xq6-9pq8CVE-2026-27980

prompt for your AI agent

paste into your agent

A security advisory covers a package this project may use.

Advisory: GHSA-3x4c-7xq6-9pq8 (CVE-2026-27980), severity medium
What it is: Next.js: Unbounded next/image disk cache growth can exhaust storage
Affected packages:
- next: affected versions >= 16.0.0-beta.0, < 16.1.7. Fixed in 16.1.7.
- next: affected versions >= 10.0.0, < 15.5.14. Fixed in 15.5.14.
Details: https://github.com/advisories/GHSA-3x4c-7xq6-9pq8

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.

mediumMar 17, 2026

Next.js: Unbounded postponed resume buffering can lead to DoS

next >= 16.0.1, < 16.1.7 · fixed in 16.1.7

GHSA-h27x-g6w4-24gqCVE-2026-27979

prompt for your AI agent

paste into your agent

A security advisory covers a package this project may use.

Advisory: GHSA-h27x-g6w4-24gq (CVE-2026-27979), severity medium
What it is: Next.js: Unbounded postponed resume buffering can lead to DoS
Affected packages:
- next: affected versions >= 16.0.1, < 16.1.7. Fixed in 16.1.7.
Details: https://github.com/advisories/GHSA-h27x-g6w4-24gq

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.

mediumMar 17, 2026

Next.js: null origin can bypass Server Actions CSRF checks

next >= 16.0.1, < 16.1.7 · fixed in 16.1.7

GHSA-mq59-m269-xvcxCVE-2026-27978

prompt for your AI agent

paste into your agent

A security advisory covers a package this project may use.

Advisory: GHSA-mq59-m269-xvcx (CVE-2026-27978), severity medium
What it is: Next.js: null origin can bypass Server Actions CSRF checks
Affected packages:
- next: affected versions >= 16.0.1, < 16.1.7. Fixed in 16.1.7.
Details: https://github.com/advisories/GHSA-mq59-m269-xvcx

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.

lowMar 17, 2026

Next.js: null origin can bypass dev HMR websocket CSRF checks

next >= 16.0.1, < 16.1.7 · fixed in 16.1.7

GHSA-jcc7-9wpm-mj36CVE-2026-27977

prompt for your AI agent

paste into your agent

A security advisory covers a package this project may use.

Advisory: GHSA-jcc7-9wpm-mj36 (CVE-2026-27977), severity low
What it is: Next.js: null origin can bypass dev HMR websocket CSRF checks
Affected packages:
- next: affected versions >= 16.0.1, < 16.1.7. Fixed in 16.1.7.
Details: https://github.com/advisories/GHSA-jcc7-9wpm-mj36

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.

From the GitHub Advisory Database, refreshed hourly. Full history on GitHub.

Keeping Next.js patched

npm audit (or pnpm audit) lists known vulnerable packages in your lockfile, including ones pulled in by other packages.
Turn on Dependabot for your GitHub repo and it opens the upgrade for you when an advisory lands.
A patched framework doesn't cover your own setup: headers, cookies and HTTPS. The free check looks at those.