Next.js vulnerabilities and security advisories

The newest reviewed advisories for next on npm. Each one shows which versions are affected, which version fixes it, and a prompt that has your AI agent check your project and upgrade only if it needs to.

Get an email when Next.js has a new one

Email alerts are coming soon. This page updates every hour.

$ latest 30 · 35 critical, high or exploited

criticalOct 22, 2026

Next.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays

next >= 16.0.0, <= 16.4.0 · fixed in 16.4.1

GHSA-673q-mjm6-r5xr

prompt for your AI agent

paste into your agent

A security advisory covers a package this project may use.

Advisory: GHSA-673q-mjm6-r5xr, severity critical
What it is: Next.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays
Affected packages:
- next: affected versions >= 16.0.0, <= 16.4.0. Fixed in 16.4.1.
Details: https://github.com/advisories/GHSA-673q-mjm6-r5xr

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.

mediumOct 22, 2026

next.js cache leak across root param values in nested 'use cache' functions

next >= 16.3.0, < 16.3.8 · fixed in 16.3.8

GHSA-h694-7cp9-m8p3CVE-2026-103004

prompt for your AI agent

paste into your agent

A security advisory covers a package this project may use.

Advisory: GHSA-h694-7cp9-m8p3 (CVE-2026-103004), severity medium
What it is: next.js cache leak across root param values in nested 'use cache' functions
Affected packages:
- next: affected versions >= 16.3.0, < 16.3.8. Fixed in 16.3.8.
Details: https://github.com/advisories/GHSA-h694-7cp9-m8p3

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.

criticalOct 22, 2026

Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used

next >= 10.0.0, <= 15.5.27 · fixed in 15.5.28
next >= 16.0.0, <= 16.4.0 · fixed in 16.4.1

GHSA-2464-fhr4-w9xw

prompt for your AI agent

paste into your agent

A security advisory covers a package this project may use.

Advisory: GHSA-2464-fhr4-w9xw, severity critical
What it is: Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used
Affected packages:
- next: affected versions >= 10.0.0, <= 15.5.27. Fixed in 15.5.28.
- next: affected versions >= 16.0.0, <= 16.4.0. Fixed in 16.4.1.
Details: https://github.com/advisories/GHSA-2464-fhr4-w9xw

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.

highOct 22, 2026

Next.js: Denial of Service in App Router using Server Actions

next >= 13.0.0, <= 15.5.27 · fixed in 15.5.28
next >= 16.0.0, <= 16.4.0 · fixed in 16.4.1

GHSA-p3m5-59mp-jv5rCVE-2026-94482

prompt for your AI agent

paste into your agent

A security advisory covers a package this project may use.

Advisory: GHSA-p3m5-59mp-jv5r (CVE-2026-94482), severity high
What it is: Next.js: Denial of Service in App Router using Server Actions
Affected packages:
- next: affected versions >= 13.0.0, <= 15.5.27. Fixed in 15.5.28.
- next: affected versions >= 16.0.0, <= 16.4.0. Fixed in 16.4.1.
Details: https://github.com/advisories/GHSA-p3m5-59mp-jv5r

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.

mediumOct 7, 2026

Next.js: Pending `use cache` fill can leak Draft Mode content into regular responses and persisted pages

next >= 16.3.0, < 16.3.8 · fixed in 16.3.8

GHSA-3w37-wq28-93x7CVE-2026-94544

prompt for your AI agent

paste into your agent

A security advisory covers a package this project may use.

Advisory: GHSA-3w37-wq28-93x7 (CVE-2026-94544), severity medium
What it is: Next.js: Pending `use cache` fill can leak Draft Mode content into regular responses and persisted pages
Affected packages:
- next: affected versions >= 16.3.0, < 16.3.8. Fixed in 16.3.8.
Details: https://github.com/advisories/GHSA-3w37-wq28-93x7

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.

mediumOct 7, 2026

Next.js has cache poisoning of SSG and ISR pages in self-hosted applications

next >= 15.0.0, < 15.5.27 · fixed in 15.5.27
next >= 16.0.0, < 16.3.8 · fixed in 16.3.8

GHSA-4jqv-mc3x-m676CVE-2026-94543

prompt for your AI agent

paste into your agent

A security advisory covers a package this project may use.

Advisory: GHSA-4jqv-mc3x-m676 (CVE-2026-94543), severity medium
What it is: Next.js has cache poisoning of SSG and ISR pages in self-hosted applications
Affected packages:
- next: affected versions >= 15.0.0, < 15.5.27. Fixed in 15.5.27.
- next: affected versions >= 16.0.0, < 16.3.8. Fixed in 16.3.8.
Details: https://github.com/advisories/GHSA-4jqv-mc3x-m676

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.

lowOct 7, 2026

Next.js has information disclosure in development server's Model Context Protocol endpoint

next >= 16.0.0, < 16.3.8 · fixed in 16.3.8

GHSA-39w2-rjm5-chcvCVE-2026-94486

prompt for your AI agent

paste into your agent

A security advisory covers a package this project may use.

Advisory: GHSA-39w2-rjm5-chcv (CVE-2026-94486), severity low
What it is: Next.js has information disclosure in development server's Model Context Protocol endpoint
Affected packages:
- next: affected versions >= 16.0.0, < 16.3.8. Fixed in 16.3.8.
Details: https://github.com/advisories/GHSA-39w2-rjm5-chcv

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.

mediumOct 7, 2026

Next.js has information disclosure in App Router metadata image routes via dynamicParams bypass

next >= 16.0.0, < 16.3.8 · fixed in 16.3.8

GHSA-f87g-xv8r-7p7xCVE-2026-94485

prompt for your AI agent

paste into your agent

A security advisory covers a package this project may use.

Advisory: GHSA-f87g-xv8r-7p7x (CVE-2026-94485), severity medium
What it is: Next.js has information disclosure in App Router metadata image routes via dynamicParams bypass
Affected packages:
- next: affected versions >= 16.0.0, < 16.3.8. Fixed in 16.3.8.
Details: https://github.com/advisories/GHSA-f87g-xv8r-7p7x

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.

mediumOct 7, 2026

Next.js has cache poisoning in SSG/ISR rendering that leads to cross-user content substitution and persistent denial of service

next >= 16.0.0, < 16.3.8 · fixed in 16.3.8
next >= 15.0.0, < 15.5.27 · fixed in 15.5.27

GHSA-mcj8-r9mp-w47pCVE-2026-94484

prompt for your AI agent

paste into your agent

A security advisory covers a package this project may use.

Advisory: GHSA-mcj8-r9mp-w47p (CVE-2026-94484), severity medium
What it is: Next.js has cache poisoning in SSG/ISR rendering that leads to cross-user content substitution and persistent denial of service
Affected packages:
- next: affected versions >= 16.0.0, < 16.3.8. Fixed in 16.3.8.
- next: affected versions >= 15.0.0, < 15.5.27. Fixed in 15.5.27.
Details: https://github.com/advisories/GHSA-mcj8-r9mp-w47p

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.

highOct 7, 2026

Next.js has Server-Side Request Forgery in Image Optimization

next >= 16.0.0, < 16.3.8 · fixed in 16.3.8

GHSA-cjq9-62q9-8jv4CVE-2026-94483

prompt for your AI agent

paste into your agent

A security advisory covers a package this project may use.

Advisory: GHSA-cjq9-62q9-8jv4 (CVE-2026-94483), severity high
What it is: Next.js has Server-Side Request Forgery in Image Optimization
Affected packages:
- next: affected versions >= 16.0.0, < 16.3.8. Fixed in 16.3.8.
Details: https://github.com/advisories/GHSA-cjq9-62q9-8jv4

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.

criticalSep 30, 2026

Next.js: Remote Code Execution in next/og ImageResponse

next >= 16.2.0, < 16.3.6 · fixed in 16.3.6

GHSA-vcvr-r3jv-pc5j

prompt for your AI agent

paste into your agent

A security advisory covers a package this project may use.

Advisory: GHSA-vcvr-r3jv-pc5j, severity critical
What it is: Next.js: Remote Code Execution in next/og ImageResponse
Affected packages:
- next: affected versions >= 16.2.0, < 16.3.6. Fixed in 16.3.6.
Details: https://github.com/advisories/GHSA-vcvr-r3jv-pc5j

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.

criticalSep 8, 2026

Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used

next >= 10.0.0, < 15.5.24 · fixed in 15.5.24
next >= 16.0.0, < 16.3.3 · fixed in 16.3.3

GHSA-2xp9-vwfh-vxw4

prompt for your AI agent

paste into your agent

A security advisory covers a package this project may use.

Advisory: GHSA-2xp9-vwfh-vxw4, severity critical
What it is: Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used
Affected packages:
- next: affected versions >= 10.0.0, < 15.5.24. Fixed in 15.5.24.
- next: affected versions >= 16.0.0, < 16.3.3. Fixed in 16.3.3.
Details: https://github.com/advisories/GHSA-2xp9-vwfh-vxw4

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.

criticalSep 8, 2026

Next.js: Unauthenticated Remote Code Execution on windows-hosted servers

next >= 13.4.0, < 15.5.24 · fixed in 15.5.24
next >= 16.0.0, < 16.3.3 · fixed in 16.3.3

GHSA-p293-qw3h-jr36CVE-2026-75604

prompt for your AI agent

paste into your agent

A security advisory covers a package this project may use.

Advisory: GHSA-p293-qw3h-jr36 (CVE-2026-75604), severity critical
What it is: Next.js: Unauthenticated Remote Code Execution on windows-hosted servers
Affected packages:
- next: affected versions >= 13.4.0, < 15.5.24. Fixed in 15.5.24.
- next: affected versions >= 16.0.0, < 16.3.3. Fixed in 16.3.3.
Details: https://github.com/advisories/GHSA-p293-qw3h-jr36

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.

highJul 22, 2026

Next.js: Server-Side Request Forgery in Server Actions on custom servers

next >= 14.1.1, < 15.5.21 · fixed in 15.5.21
next >= 16.0.0, < 16.2.11 · fixed in 16.2.11

GHSA-89xv-2m56-2m9xCVE-2026-64649

prompt for your AI agent

paste into your agent

A security advisory covers a package this project may use.

Advisory: GHSA-89xv-2m56-2m9x (CVE-2026-64649), severity high
What it is: Next.js: Server-Side Request Forgery in Server Actions on custom servers
Affected packages:
- next: affected versions >= 14.1.1, < 15.5.21. Fixed in 15.5.21.
- next: affected versions >= 16.0.0, < 16.2.11. Fixed in 16.2.11.
Details: https://github.com/advisories/GHSA-89xv-2m56-2m9x

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.

mediumJul 22, 2026

Next.js: Cache confusion of response bodies for requests with bodies

next >= 13.0.0, < 15.5.21 · fixed in 15.5.21
next >= 16.0.0, < 16.2.11 · fixed in 16.2.11

GHSA-68g3-v927-f742CVE-2026-64648

prompt for your AI agent

paste into your agent

A security advisory covers a package this project may use.

Advisory: GHSA-68g3-v927-f742 (CVE-2026-64648), severity medium
What it is: Next.js: Cache confusion of response bodies for requests with bodies
Affected packages:
- next: affected versions >= 13.0.0, < 15.5.21. Fixed in 15.5.21.
- next: affected versions >= 16.0.0, < 16.2.11. Fixed in 16.2.11.
Details: https://github.com/advisories/GHSA-68g3-v927-f742

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.

mediumJul 22, 2026

Next.js: Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences

next >= 13.0.0, < 15.5.21 · fixed in 15.5.21
next >= 16.0.0, < 16.2.11 · fixed in 16.2.11

GHSA-4633-3j49-mh5qCVE-2026-64647

prompt for your AI agent

paste into your agent

A security advisory covers a package this project may use.

Advisory: GHSA-4633-3j49-mh5q (CVE-2026-64647), severity medium
What it is: Next.js: Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences
Affected packages:
- next: affected versions >= 13.0.0, < 15.5.21. Fixed in 15.5.21.
- next: affected versions >= 16.0.0, < 16.2.11. Fixed in 16.2.11.
Details: https://github.com/advisories/GHSA-4633-3j49-mh5q

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.

mediumJul 22, 2026

Next.js: Unbounded Server Action payload in Edge runtime

next >= 13.0.0, < 15.5.21 · fixed in 15.5.21
next >= 16.0.0, < 16.2.11 · fixed in 16.2.11

GHSA-4c39-4ccg-62r3CVE-2026-64646

prompt for your AI agent

paste into your agent

A security advisory covers a package this project may use.

Advisory: GHSA-4c39-4ccg-62r3 (CVE-2026-64646), severity medium
What it is: Next.js: Unbounded Server Action payload in Edge runtime
Affected packages:
- next: affected versions >= 13.0.0, < 15.5.21. Fixed in 15.5.21.
- next: affected versions >= 16.0.0, < 16.2.11. Fixed in 16.2.11.
Details: https://github.com/advisories/GHSA-4c39-4ccg-62r3

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.

highJul 22, 2026

Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname

next >= 12.0.0, < 15.5.21 · fixed in 15.5.21
next >= 16.0.0, < 16.2.11 · fixed in 16.2.11

GHSA-p9j2-gv94-2wf4CVE-2026-64645

prompt for your AI agent

paste into your agent

A security advisory covers a package this project may use.

Advisory: GHSA-p9j2-gv94-2wf4 (CVE-2026-64645), severity high
What it is: Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname
Affected packages:
- next: affected versions >= 12.0.0, < 15.5.21. Fixed in 15.5.21.
- next: affected versions >= 16.0.0, < 16.2.11. Fixed in 16.2.11.
Details: https://github.com/advisories/GHSA-p9j2-gv94-2wf4

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.

mediumJul 22, 2026

Next.js: Denial of Service in the Image Optimization API using SVGs

next >= 15.5.0, < 15.5.21 · fixed in 15.5.21
next >= 16.0.0, < 16.2.11 · fixed in 16.2.11

GHSA-q8wf-6r8g-63chCVE-2026-64644

prompt for your AI agent

paste into your agent

A security advisory covers a package this project may use.

Advisory: GHSA-q8wf-6r8g-63ch (CVE-2026-64644), severity medium
What it is: Next.js: Denial of Service in the Image Optimization API using SVGs
Affected packages:
- next: affected versions >= 15.5.0, < 15.5.21. Fixed in 15.5.21.
- next: affected versions >= 16.0.0, < 16.2.11. Fixed in 16.2.11.
Details: https://github.com/advisories/GHSA-q8wf-6r8g-63ch

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.

mediumJul 22, 2026

Next.js: Unauthenticated disclosure of internal Server Function endpoints

next >= 13.0.0, < 15.5.21 · fixed in 15.5.21
next >= 16.0.0, < 16.2.11 · fixed in 16.2.11

GHSA-955p-x3mx-jcvpCVE-2026-64643

prompt for your AI agent

paste into your agent

A security advisory covers a package this project may use.

Advisory: GHSA-955p-x3mx-jcvp (CVE-2026-64643), severity medium
What it is: Next.js: Unauthenticated disclosure of internal Server Function endpoints
Affected packages:
- next: affected versions >= 13.0.0, < 15.5.21. Fixed in 15.5.21.
- next: affected versions >= 16.0.0, < 16.2.11. Fixed in 16.2.11.
Details: https://github.com/advisories/GHSA-955p-x3mx-jcvp

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.

highJul 22, 2026

Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale

next >= 16.0.0, < 16.2.11 · fixed in 16.2.11

GHSA-6gpp-xcg3-4w24CVE-2026-64642

prompt for your AI agent

paste into your agent

A security advisory covers a package this project may use.

Advisory: GHSA-6gpp-xcg3-4w24 (CVE-2026-64642), severity high
What it is: Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale
Affected packages:
- next: affected versions >= 16.0.0, < 16.2.11. Fixed in 16.2.11.
Details: https://github.com/advisories/GHSA-6gpp-xcg3-4w24

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.

highJul 22, 2026

Next.js: Denial of Service in App Router using Server Actions

next >= 13.0.0, < 15.5.21 · fixed in 15.5.21
next >= 16.0.0, < 16.2.11 · fixed in 16.2.11

GHSA-m99w-x7hq-7vfjCVE-2026-64641

prompt for your AI agent

paste into your agent

A security advisory covers a package this project may use.

Advisory: GHSA-m99w-x7hq-7vfj (CVE-2026-64641), severity high
What it is: Next.js: Denial of Service in App Router using Server Actions
Affected packages:
- next: affected versions >= 13.0.0, < 15.5.21. Fixed in 15.5.21.
- next: affected versions >= 16.0.0, < 16.2.11. Fixed in 16.2.11.
Details: https://github.com/advisories/GHSA-m99w-x7hq-7vfj

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.

highMay 11, 2026

Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Up

next >= 15.2.0, < 15.5.18 · fixed in 15.5.18
next >= 16.0.0, < 16.2.6 · fixed in 16.2.6

GHSA-26hh-7cqf-hhc6CVE-2026-45109

prompt for your AI agent

paste into your agent

A security advisory covers a package this project may use.

Advisory: GHSA-26hh-7cqf-hhc6 (CVE-2026-45109), severity high
What it is: Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Up
Affected packages:
- next: affected versions >= 15.2.0, < 15.5.18. Fixed in 15.5.18.
- next: affected versions >= 16.0.0, < 16.2.6. Fixed in 16.2.6.
Details: https://github.com/advisories/GHSA-26hh-7cqf-hhc6

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.

lowMay 11, 2026

Next.js's Middleware / Proxy redirects can be cache-poisoned

next >= 12.2.0, < 15.5.16 · fixed in 15.5.16
next >= 16.0.0, < 16.2.5 · fixed in 16.2.5

GHSA-3g8h-86w9-wvmqCVE-2026-44572

prompt for your AI agent

paste into your agent

A security advisory covers a package this project may use.

Advisory: GHSA-3g8h-86w9-wvmq (CVE-2026-44572), severity low
What it is: Next.js's Middleware / Proxy redirects can be cache-poisoned
Affected packages:
- next: affected versions >= 12.2.0, < 15.5.16. Fixed in 15.5.16.
- next: affected versions >= 16.0.0, < 16.2.5. Fixed in 16.2.5.
Details: https://github.com/advisories/GHSA-3g8h-86w9-wvmq

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.

mediumMay 11, 2026

Next.js vulnerable to cross-site scripting in App Router applications using CSP nonces

next >= 13.4.0, < 15.5.16 · fixed in 15.5.16
next >= 16.0.0, < 16.2.5 · fixed in 16.2.5

GHSA-ffhc-5mcf-pf4qCVE-2026-44581

prompt for your AI agent

paste into your agent

A security advisory covers a package this project may use.

Advisory: GHSA-ffhc-5mcf-pf4q (CVE-2026-44581), severity medium
What it is: Next.js vulnerable to cross-site scripting in App Router applications using CSP nonces
Affected packages:
- next: affected versions >= 13.4.0, < 15.5.16. Fixed in 15.5.16.
- next: affected versions >= 16.0.0, < 16.2.5. Fixed in 16.2.5.
Details: https://github.com/advisories/GHSA-ffhc-5mcf-pf4q

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.

lowMay 11, 2026

Next.js vulnerable to cache poisoning via collisions in React Server Component cache-busting

next >= 13.4.6, < 15.5.16 · fixed in 15.5.16
next >= 16.0.0, < 16.2.5 · fixed in 16.2.5

GHSA-vfv6-92ff-j949CVE-2026-44582

prompt for your AI agent

paste into your agent

A security advisory covers a package this project may use.

Advisory: GHSA-vfv6-92ff-j949 (CVE-2026-44582), severity low
What it is: Next.js vulnerable to cache poisoning via collisions in React Server Component cache-busting
Affected packages:
- next: affected versions >= 13.4.6, < 15.5.16. Fixed in 15.5.16.
- next: affected versions >= 16.0.0, < 16.2.5. Fixed in 16.2.5.
Details: https://github.com/advisories/GHSA-vfv6-92ff-j949

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.

mediumMay 11, 2026

Next.js has cross-site scripting in beforeInteractive scripts with untrusted input

next >= 13.0.0, < 15.5.16 · fixed in 15.5.16
next >= 16.0.0, < 16.2.5 · fixed in 16.2.5

GHSA-gx5p-jg67-6x7hCVE-2026-44580

prompt for your AI agent

paste into your agent

A security advisory covers a package this project may use.

Advisory: GHSA-gx5p-jg67-6x7h (CVE-2026-44580), severity medium
What it is: Next.js has cross-site scripting in beforeInteractive scripts with untrusted input
Affected packages:
- next: affected versions >= 13.0.0, < 15.5.16. Fixed in 15.5.16.
- next: affected versions >= 16.0.0, < 16.2.5. Fixed in 16.2.5.
Details: https://github.com/advisories/GHSA-gx5p-jg67-6x7h

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.

highMay 11, 2026

Next.js vulnerable to Denial of Service via connection exhaustion in applications using Cache Components

next >= 15.0.0, < 15.5.16 · fixed in 15.5.16
next >= 16.0.0, < 16.2.5 · fixed in 16.2.5

GHSA-mg66-mrh9-m8jxCVE-2026-44579

prompt for your AI agent

paste into your agent

A security advisory covers a package this project may use.

Advisory: GHSA-mg66-mrh9-m8jx (CVE-2026-44579), severity high
What it is: Next.js vulnerable to Denial of Service via connection exhaustion in applications using Cache Components
Affected packages:
- next: affected versions >= 15.0.0, < 15.5.16. Fixed in 15.5.16.
- next: affected versions >= 16.0.0, < 16.2.5. Fixed in 16.2.5.
Details: https://github.com/advisories/GHSA-mg66-mrh9-m8jx

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.

mediumMay 11, 2026

Next.js has a Denial of Service in the Image Optimization API

next >= 10.0.0, < 15.5.16 · fixed in 15.5.16
next >= 16.0.0, < 16.2.5 · fixed in 16.2.5

GHSA-h64f-5h5j-jqjhCVE-2026-44577

prompt for your AI agent

paste into your agent

A security advisory covers a package this project may use.

Advisory: GHSA-h64f-5h5j-jqjh (CVE-2026-44577), severity medium
What it is: Next.js has a Denial of Service in the Image Optimization API
Affected packages:
- next: affected versions >= 10.0.0, < 15.5.16. Fixed in 15.5.16.
- next: affected versions >= 16.0.0, < 16.2.5. Fixed in 16.2.5.
Details: https://github.com/advisories/GHSA-h64f-5h5j-jqjh

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.

highMay 11, 2026

Next.js vulnerable to server-side request forgery in applications using WebSocket upgrades

next >= 13.4.13, < 15.5.16 · fixed in 15.5.16
next >= 16.0.0, < 16.2.5 · fixed in 16.2.5

GHSA-c4j6-fc7j-m34rCVE-2026-44578

prompt for your AI agent

paste into your agent

A security advisory covers a package this project may use.

Advisory: GHSA-c4j6-fc7j-m34r (CVE-2026-44578), severity high
What it is: Next.js vulnerable to server-side request forgery in applications using WebSocket upgrades
Affected packages:
- next: affected versions >= 13.4.13, < 15.5.16. Fixed in 15.5.16.
- next: affected versions >= 16.0.0, < 16.2.5. Fixed in 16.2.5.
Details: https://github.com/advisories/GHSA-c4j6-fc7j-m34r

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.

From the GitHub Advisory Database, refreshed hourly. Full history on GitHub.

Keeping Next.js patched

npm audit (or pnpm audit) lists known vulnerable packages in your lockfile, including ones pulled in by other packages.
Turn on Dependabot for your GitHub repo and it opens the upgrade for you when an advisory lands.
A patched framework doesn't cover your own setup: headers, cookies and HTTPS. The free check looks at those.