Vulnerable Library - next-14.2.3.tgz
Library home page: https://registry.npmjs.org/next/-/next-14.2.3.tgz
Sample Path to Dependency File: /package.json
Path to vulnerable library: /package.json
Vulnerabilities
| Vulnerability |
Severity |
 CVSS |
Dependency |
Type |
Fixed in (next version) |
Remediation Possible** |
| WS-2026-0029 |
 Critical |
10.0 |
next-14.2.3.tgz |
Direct |
15.5.24 |
❌ |
| CVE-2026-64645 |
Critical |
9.3 |
next-14.2.3.tgz |
Direct |
https://github.com/vercel/next.js.git - v15.5.21,https://github.com/vercel/next.js.git - v16.2.11 |
❌ |
| CVE-2025-29927 |
Critical |
9.1 |
next-14.2.3.tgz |
Direct |
14.2.25 |
❌ |
| CVE-2026-75604 |
Critical |
9.0 |
next-14.2.3.tgz |
Direct |
15.5.24 |
❌ |
| CVE-2026-44578 |
 High |
8.6 |
next-14.2.3.tgz |
Direct |
15.5.16 |
❌ |
| CVE-2026-64649 |
High |
8.2 |
next-14.2.3.tgz |
Direct |
https://github.com/vercel/next.js.git - v15.5.21,https://github.com/vercel/next.js.git - v16.2.11 |
❌ |
| CVE-2026-73646 |
High |
7.5 |
postcss-8.4.31.tgz |
Transitive |
N/A* |
❌ |
| CVE-2026-64641 |
High |
7.5 |
next-14.2.3.tgz |
Direct |
https://github.com/vercel/next.js.git - v15.5.21,https://github.com/vercel/next.js.git - v16.2.11 |
❌ |
| CVE-2026-45623 |
High |
7.5 |
postcss-8.4.31.tgz |
Transitive |
N/A* |
❌ |
| CVE-2026-44573 |
High |
7.5 |
next-14.2.3.tgz |
Direct |
15.5.16 |
❌ |
| CVE-2024-51479 |
High |
7.5 |
next-14.2.3.tgz |
Direct |
14.2.15 |
❌ |
| CVE-2024-46982 |
High |
7.5 |
next-14.2.3.tgz |
Direct |
14.2.10 |
❌ |
| CVE-2026-64648 |
High |
7.1 |
next-14.2.3.tgz |
Direct |
https://github.com/vercel/next.js.git - v16.2.11,https://github.com/vercel/next.js.git - v15.5.21 |
❌ |
| CVE-2026-29057 |
 Medium |
6.5 |
next-14.2.3.tgz |
Direct |
https://github.com/vercel/next.js.git - v16.1.7,https://github.com/vercel/next.js.git - v15.5.13 |
❌ |
| CVE-2025-57822 |
Medium |
6.5 |
next-14.2.3.tgz |
Direct |
14.2.32 |
❌ |
| CVE-2025-57752 |
Medium |
6.2 |
next-14.2.3.tgz |
Direct |
14.2.31 |
❌ |
| CVE-2026-44580 |
Medium |
6.1 |
next-14.2.3.tgz |
Direct |
next - 15.5.16,next - 16.2.5 |
❌ |
| CVE-2026-41305 |
Medium |
6.1 |
postcss-8.4.31.tgz |
Transitive |
N/A* |
❌ |
| CVE-2026-44577 |
Medium |
5.9 |
next-14.2.3.tgz |
Direct |
next - 15.5.16,next - 16.2.5 |
❌ |
| CVE-2025-59471 |
Medium |
5.9 |
next-14.2.3.tgz |
Direct |
next - 15.5.10,next - 16.1.5 |
❌ |
| CVE-2024-47831 |
Medium |
5.9 |
next-14.2.3.tgz |
Direct |
14.2.7 |
❌ |
| CVE-2026-44576 |
Medium |
5.4 |
next-14.2.3.tgz |
Direct |
next - 16.2.5,next - 15.5.16 |
❌ |
| CVE-2026-69153 |
Medium |
5.3 |
postcss-8.4.31.tgz |
Transitive |
N/A* |
❌ |
| CVE-2026-64646 |
Medium |
5.3 |
next-14.2.3.tgz |
Direct |
https://github.com/vercel/next.js.git - v15.5.21,https://github.com/vercel/next.js.git - v16.2.11 |
❌ |
| CVE-2026-64643 |
Medium |
5.3 |
next-14.2.3.tgz |
Direct |
https://github.com/vercel/next.js.git - v15.5.21,https://github.com/vercel/next.js.git - v16.2.11 |
❌ |
| CVE-2026-27980 |
Medium |
5.3 |
next-14.2.3.tgz |
Direct |
https://github.com/vercel/next.js.git - v16.1.7,https://github.com/vercel/next.js.git - v15.5.13 |
❌ |
| CVE-2024-56332 |
Medium |
5.3 |
next-14.2.3.tgz |
Direct |
14.2.21 |
❌ |
| CVE-2026-64647 |
Medium |
4.8 |
next-14.2.3.tgz |
Direct |
https://github.com/vercel/next.js.git - v16.2.11,https://github.com/vercel/next.js.git - v15.5.21 |
❌ |
| CVE-2026-44581 |
Medium |
4.7 |
next-14.2.3.tgz |
Direct |
next - 15.5.16,next - 16.2.5 |
❌ |
| CVE-2025-48068 |
Medium |
4.7 |
next-14.2.3.tgz |
Direct |
14.2.30 |
❌ |
| CVE-2025-55173 |
Medium |
4.3 |
next-14.2.3.tgz |
Direct |
14.2.31 |
❌ |
| CVE-2026-44582 |
 Low |
3.7 |
next-14.2.3.tgz |
Direct |
next - 16.2.5,next - 15.5.16 |
❌ |
| CVE-2026-44572 |
Low |
3.7 |
next-14.2.3.tgz |
Direct |
next - 16.2.5,next - 15.5.16 |
❌ |
| CVE-2025-32421 |
Low |
3.7 |
next-14.2.3.tgz |
Direct |
14.2.24 |
❌ |
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
Partial details (24 vulnerabilities) are displayed below due to a content size limitation in GitHub. To view information on the remaining vulnerabilities, navigate to the Mend Application.
WS-2026-0029
Vulnerable Library - next-14.2.3.tgz
Library home page: https://registry.npmjs.org/next/-/next-14.2.3.tgz
Sample Path to Dependency File: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
- ❌ next-14.2.3.tgz (Vulnerable Library)
Found in base branch: main
Vulnerability Details
A vulnerability in the underlying libheif library used by sharp which Next.js uses for image optimization can lead to remote code execution when AVIF files are optimized.
Until a fix has propagated, optimization of AVIF files is disabled.
Publish Date: 2026-08-24
URL: WS-2026-0029
CVSS 3 Score Details (10.0)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-2xp9-vwfh-vxw4
Release Date: 2026-08-24
Fix Resolution: 15.5.24
Step up your Open Source Security Game with Mend here
CVE-2026-64645
Vulnerable Library - next-14.2.3.tgz
Library home page: https://registry.npmjs.org/next/-/next-14.2.3.tgz
Sample Path to Dependency File: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
- ❌ next-14.2.3.tgz (Vulnerable Library)
Found in base branch: main
Vulnerability Details
Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a
rewrites() or redirects() rule that builds its external destination hostname from request-controlled input can be pointed at an arbitrary hostname, regardless of the rule's hostname suffix. For a rewrite, Next.js proxies the request to that arbitrary host and serves the response from the application's origin, leading to Server-Side Request forgery. A redirects() rule configured this way is vulnerable to an Open Redirect. This issue has been fixed in versions 15.5.21 and 16.2.11.
Publish Date: 2026-07-27
URL: CVE-2026-64645
CVSS 3 Score Details (9.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-p9j2-gv94-2wf4
Release Date: 2026-07-23
Fix Resolution: https://github.com/vercel/next.js.git - v15.5.21,https://github.com/vercel/next.js.git - v16.2.11
Step up your Open Source Security Game with Mend here
CVE-2025-29927
Vulnerable Library - next-14.2.3.tgz
Library home page: https://registry.npmjs.org/next/-/next-14.2.3.tgz
Sample Path to Dependency File: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
- ❌ next-14.2.3.tgz (Vulnerable Library)
Found in base branch: main
Vulnerability Details
Next.js is a React framework for building full-stack web applications. Starting in version 1.11.4 and prior to versions 12.3.5, 13.5.9, 14.2.25, and 15.2.3, it is possible to bypass authorization checks within a Next.js application, if the authorization check occurs in middleware. If patching to a safe version is infeasible, it is recommend that you prevent external user requests which contain the x-middleware-subrequest header from reaching your Next.js application. This vulnerability is fixed in 12.3.5, 13.5.9, 14.2.25, and 15.2.3.
Mend Note: The description of this vulnerability differs from MITRE.
Publish Date: 2025-03-21
URL: CVE-2025-29927
CVSS 3 Score Details (9.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-f82v-jwr5-mffw
Release Date: 2025-03-21
Fix Resolution: 14.2.25
Step up your Open Source Security Game with Mend here
CVE-2026-75604
Vulnerable Library - next-14.2.3.tgz
Library home page: https://registry.npmjs.org/next/-/next-14.2.3.tgz
Sample Path to Dependency File: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
- ❌ next-14.2.3.tgz (Vulnerable Library)
Found in base branch: main
Vulnerability Details
A vulnerability in applications using Pages and App router without Cache Component can lead to remote code execution when the server is hosted on machines using a Windows filesystem.
Publish Date: 2026-08-24
URL: CVE-2026-75604
CVSS 3 Score Details (9.0)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-p293-qw3h-jr36
Release Date: 2026-08-24
Fix Resolution: 15.5.24
Step up your Open Source Security Game with Mend here
CVE-2026-44578
Vulnerable Library - next-14.2.3.tgz
Library home page: https://registry.npmjs.org/next/-/next-14.2.3.tgz
Sample Path to Dependency File: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
- ❌ next-14.2.3.tgz (Vulnerable Library)
Found in base branch: main
Vulnerability Details
Next.js is a React framework for building full-stack web applications. From 13.4.13 to before 15.5.16 and 16.2.5, self-hosted applications using the built-in Node.js server can be vulnerable to server-side request forgery through crafted WebSocket upgrade requests. An attacker can cause the server to proxy requests to arbitrary internal or external destinations, which may expose internal services or cloud metadata endpoints. Vercel-hosted deployments are not affected. This vulnerability is fixed in 15.5.16 and 16.2.5.
Publish Date: 2026-05-13
URL: CVE-2026-44578
CVSS 3 Score Details (8.6)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: None
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-c4j6-fc7j-m34r
Release Date: 2026-05-05
Fix Resolution: 15.5.16
Step up your Open Source Security Game with Mend here
CVE-2026-64649
Vulnerable Library - next-14.2.3.tgz
Library home page: https://registry.npmjs.org/next/-/next-14.2.3.tgz
Sample Path to Dependency File: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
- ❌ next-14.2.3.tgz (Vulnerable Library)
Found in base branch: main
Vulnerability Details
Next.js is a React framework for building full-stack web applications. In versions 14.1.1 through 15.5.20 and 16.0.0 through 16.2.10, when a Server Action forwards or redirects a request, an attacker can cause the server to send that outbound request to a malicious host (Server-Side Request Forgery). This requires the attacker's request to control Host-associated headers. In some configurations, it's also possible to obtain internal values that weaken middleware/proxy authorization. Applications that use Server Actions are affected when the incoming host header is not fixed to a trusted value. This typically occurs on custom servers, or on deployments not behind a proxy that pins the host. Managed hosting pins the host upstream and is not affected; next start and standalone output do the same from version 14.2 onward. This issue has been fixed in versions 15.5.21 and 16.2.11.
Publish Date: 2026-07-27
URL: CVE-2026-64649
CVSS 3 Score Details (8.2)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-89xv-2m56-2m9x
Release Date: 2026-07-23
Fix Resolution: https://github.com/vercel/next.js.git - v15.5.21,https://github.com/vercel/next.js.git - v16.2.11
Step up your Open Source Security Game with Mend here
CVE-2026-73646
Vulnerable Library - postcss-8.4.31.tgz
Library home page: https://registry.npmjs.org/postcss/-/postcss-8.4.31.tgz
Sample Path to Dependency File: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
- next-14.2.3.tgz (Root Library)
- ❌ postcss-8.4.31.tgz (Vulnerable Library)
Found in base branch: main
Vulnerability Details
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.18, lib/previous-map.js loadMap() passes attacker-controlled sourceMappingURL values to join(dirname(opts.from), annotation), and loadFile() permits traversed or absolute .map paths, allowing untrusted CSS processed without map: false to disclose sourcesContent from arbitrary reachable .map files through result.map. This issue is fixed in version 8.5.18.
Publish Date: 2026-08-17
URL: CVE-2026-73646
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: None
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Release Date: 2026-08-13
Fix Resolution: https://github.com/postcss/postcss.git - 8.5.18
Step up your Open Source Security Game with Mend here
CVE-2026-64641
Vulnerable Library - next-14.2.3.tgz
Library home page: https://registry.npmjs.org/next/-/next-14.2.3.tgz
Sample Path to Dependency File: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
- ❌ next-14.2.3.tgz (Vulnerable Library)
Found in base branch: main
Vulnerability Details
Next.js is a React framework for building full-stack web applications. In versions 13.0.0 through 15.5.20 and 16.0.0 through 16.2.10, crafted requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive CPU usage blocking processing of further requests in the same process. This issue has been fixed in versions 15.5.21 and 16.2.11.
Publish Date: 2026-07-27
URL: CVE-2026-64641
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-m99w-x7hq-7vfj
Release Date: 2026-07-23
Fix Resolution: https://github.com/vercel/next.js.git - v15.5.21,https://github.com/vercel/next.js.git - v16.2.11
Step up your Open Source Security Game with Mend here
CVE-2026-45623
Vulnerable Library - postcss-8.4.31.tgz
Library home page: https://registry.npmjs.org/postcss/-/postcss-8.4.31.tgz
Sample Path to Dependency File: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
- next-14.2.3.tgz (Root Library)
- ❌ postcss-8.4.31.tgz (Vulnerable Library)
Found in base branch: main
Vulnerability Details
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the /*# sourceMappingURL=PATH */ comment from any CSS string passed to process() and dereferences PATH against the local filesystem with no scheme, allowlist, or traversal check. An attacker who controls the CSS input can cause the host process to read any file readable by Node and leak the first ~10 bytes of its content through the resulting JSON.parse SyntaxError message. The bug also yields a precise file-existence oracle and a controllable-read primitive that may be combined with large-file targets for DoS. The behaviour is triggered with PostCSS's default options — no from, no map, no plugins required — and is therefore reachable from any pipeline that runs untrusted CSS through PostCSS (CMS themes, user-uploaded styles, browser-extension/userstyle processors, build pipelines for third-party packages, blog comment renderers, etc.). This issue has been fixed in version 8.5.12.
Publish Date: 2026-07-27
URL: CVE-2026-45623
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: None
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Release Date: 2026-07-23
Fix Resolution: postcss - 8.5.12,https://github.com/postcss/postcss.git - 8.5.12
Step up your Open Source Security Game with Mend here
CVE-2026-44573
Vulnerable Library - next-14.2.3.tgz
Library home page: https://registry.npmjs.org/next/-/next-14.2.3.tgz
Sample Path to Dependency File: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
- ❌ next-14.2.3.tgz (Vulnerable Library)
Found in base branch: main
Vulnerability Details
Next.js is a React framework for building full-stack web applications. From 12.2.0 to before 15.5.16 and 16.2.5, Applications using the Pages Router with i18n configured and middleware/proxy-based authorization can allow unauthorized access to protected page data through locale-less /_next/data//.json requests. In affected configurations, middleware does not run for the unprefixed data route, allowing an attacker to retrieve SSR JSON for protected pages without passing the intended authorization checks. This vulnerability is fixed in 15.5.16 and 16.2.5.
Publish Date: 2026-05-13
URL: CVE-2026-44573
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: None
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-36qx-fr4f-26g5
Release Date: 2026-05-05
Fix Resolution: 15.5.16
Step up your Open Source Security Game with Mend here
CVE-2024-51479
Vulnerable Library - next-14.2.3.tgz
Library home page: https://registry.npmjs.org/next/-/next-14.2.3.tgz
Sample Path to Dependency File: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
- ❌ next-14.2.3.tgz (Vulnerable Library)
Found in base branch: main
Vulnerability Details
Next.js is a React framework for building full-stack web applications. In affected versions if a Next.js application is performing authorization in middleware based on pathname, it was possible for this authorization to be bypassed for pages directly under the application's root directory. For example: * [Not affected] "https://example.com/" * [Affected] "https://example.com/foo" * [Not affected] "https://example.com/foo/bar". This issue is patched in Next.js "14.2.15" and later. If your Next.js application is hosted on Vercel, this vulnerability has been automatically mitigated, regardless of Next.js version. There are no official workarounds for this vulnerability.
Publish Date: 2024-12-17
URL: CVE-2024-51479
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: None
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-7gfc-8cq8-jh5f
Release Date: 2024-12-17
Fix Resolution: 14.2.15
Step up your Open Source Security Game with Mend here
CVE-2024-46982
Vulnerable Library - next-14.2.3.tgz
Library home page: https://registry.npmjs.org/next/-/next-14.2.3.tgz
Sample Path to Dependency File: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
- ❌ next-14.2.3.tgz (Vulnerable Library)
Found in base branch: main
Vulnerability Details
Next.js is a React framework for building full-stack web applications. By sending a crafted HTTP request, it is possible to poison the cache of a non-dynamic server-side rendered route in the pages router (this does not affect the app router). When this crafted request is sent it could coerce Next.js to cache a route that is meant to not be cached and send a "Cache-Control: s-maxage=1, stale-while-revalidate" header which some upstream CDNs may cache as well. To be potentially affected all of the following must apply: 1. Next.js between 13.5.1 and 14.2.9, 2. Using pages router, & 3. Using non-dynamic server-side rendered routes e.g. "pages/dashboard.tsx" not "pages/blog/[slug].tsx". This vulnerability was resolved in Next.js v13.5.7, v14.2.10, and later. We recommend upgrading regardless of whether you can reproduce the issue or not. There are no official or recommended workarounds for this issue, we recommend that users patch to a safe version.
Mend Note: The description of this vulnerability differs from MITRE.
Publish Date: 2024-09-17
URL: CVE-2024-46982
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-gp8f-8m3g-qvj9
Release Date: 2024-09-17
Fix Resolution: 14.2.10
Step up your Open Source Security Game with Mend here
CVE-2026-64648
Vulnerable Library - next-14.2.3.tgz
Library home page: https://registry.npmjs.org/next/-/next-14.2.3.tgz
Sample Path to Dependency File: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
- ❌ next-14.2.3.tgz (Vulnerable Library)
Found in base branch: main
Vulnerability Details
Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a server-side fetch with a request body may return a cached response body from a different request to the same URL but different body. Confidential data in the POST's response body would then leak to unauthorized requests. Though the request itself will not be deduped. This only applies to fetch calls with a request that has a different init than the one passed to fetch. A safe request would be: fetch(new Request(init), init). An unsafe request would be: fetch(new Request(init), aDifferentInit). This issue has been fixed in versions 15.5.21 and 16.2.11.
Publish Date: 2026-07-27
URL: CVE-2026-64648
CVSS 3 Score Details (7.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-68g3-v927-f742
Release Date: 2026-07-23
Fix Resolution: https://github.com/vercel/next.js.git - v16.2.11,https://github.com/vercel/next.js.git - v15.5.21
Step up your Open Source Security Game with Mend here
CVE-2026-29057
Vulnerable Library - next-14.2.3.tgz
Library home page: https://registry.npmjs.org/next/-/next-14.2.3.tgz
Sample Path to Dependency File: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
- ❌ next-14.2.3.tgz (Vulnerable Library)
Found in base branch: main
Vulnerability Details
Summary When Next.js rewrites proxy traffic to an external backend, a crafted "DELETE"/"OPTIONS" request using "Transfer-Encoding: chunked" could trigger request boundary disagreement between the proxy and backend. This could allow request smuggling through rewritten routes. Impact An attacker could smuggle a second request to unintended backend routes (for example, internal/admin endpoints), bypassing assumptions that only the configured rewrite destination/path is reachable. This does not impact applications hosted on providers that handle rewrites at the CDN level, such as Vercel. Patches The vulnerability originated in an upstream library vendored by Next.js. It is fixed by updating that dependency’s behavior so "content-length: 0" is added only when both "content-length" and "transfer-encoding" are absent, and "transfer-encoding" is no longer removed in that code path. Workarounds If upgrade is not immediately possible: - Block chunked "DELETE"/"OPTIONS" requests on rewritten routes at your edge/proxy. - Enforce authentication/authorization on backend routes per our "security guidance" (https://nextjs.org/docs/app/guides/data-security).
Publish Date: 2026-03-18
URL: CVE-2026-29057
CVSS 3 Score Details (6.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Release Date: 2026-03-18
Fix Resolution: https://github.com/vercel/next.js.git - v16.1.7,https://github.com/vercel/next.js.git - v15.5.13
Step up your Open Source Security Game with Mend here
CVE-2025-57822
Vulnerable Library - next-14.2.3.tgz
Library home page: https://registry.npmjs.org/next/-/next-14.2.3.tgz
Sample Path to Dependency File: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
- ❌ next-14.2.3.tgz (Vulnerable Library)
Found in base branch: main
Vulnerability Details
Next.js is a React framework for building full-stack web applications. Prior to versions 14.2.32 and 15.4.7, when next() was used without explicitly passing the request object, it could lead to SSRF in self-hosted applications that incorrectly forwarded user-supplied headers. This vulnerability has been fixed in Next.js versions 14.2.32 and 15.4.7. All users implementing custom middleware logic in self-hosted environments are strongly encouraged to upgrade and verify correct usage of the next() function.
Mend Note: The description of this vulnerability differs from MITRE.
Publish Date: 2025-08-29
URL: CVE-2025-57822
CVSS 3 Score Details (6.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-4342-x723-ch2f
Release Date: 2025-08-29
Fix Resolution: 14.2.32
Step up your Open Source Security Game with Mend here
CVE-2025-57752
Vulnerable Library - next-14.2.3.tgz
Library home page: https://registry.npmjs.org/next/-/next-14.2.3.tgz
Sample Path to Dependency File: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
- ❌ next-14.2.3.tgz (Vulnerable Library)
Found in base branch: main
Vulnerability Details
Next.js is a React framework for building full-stack web applications. In versions before 14.2.31 and from 15.0.0 to before 15.4.5, Next.js Image Optimization API routes are affected by cache key confusion. When images returned from API routes vary based on request headers (such as Cookie or Authorization), these responses could be incorrectly cached and served to unauthorized users due to a cache key confusion bug. This vulnerability has been fixed in Next.js versions 14.2.31 and 15.4.5. All users are encouraged to upgrade if they use API routes to serve images that depend on request headers and have image optimization enabled.
Publish Date: 2025-08-29
URL: CVE-2025-57752
CVSS 3 Score Details (6.2)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: None
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-g5qg-72qw-gw5v
Release Date: 2025-08-29
Fix Resolution: 14.2.31
Step up your Open Source Security Game with Mend here
CVE-2026-44580
Vulnerable Library - next-14.2.3.tgz
Library home page: https://registry.npmjs.org/next/-/next-14.2.3.tgz
Sample Path to Dependency File: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
- ❌ next-14.2.3.tgz (Vulnerable Library)
Found in base branch: main
Vulnerability Details
Next.js is a React framework for building full-stack web applications. From 13.0.0 to before 15.5.16 and 16.2.5, applications that use beforeInteractive scripts together with untrusted content can be vulnerable to cross-site scripting. In affected versions, serialized script content was not escaped safely before being embedded into the document, which could allow attacker-controlled input to break out of the intended script context and execute arbitrary JavaScript in a visitor's browser. This vulnerability is fixed in 15.5.16 and 16.2.5.
Publish Date: 2026-05-13
URL: CVE-2026-44580
CVSS 3 Score Details (6.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-gx5p-jg67-6x7h
Release Date: 2026-05-11
Fix Resolution: next - 15.5.16,next - 16.2.5
Step up your Open Source Security Game with Mend here
CVE-2026-41305
Vulnerable Library - postcss-8.4.31.tgz
Library home page: https://registry.npmjs.org/postcss/-/postcss-8.4.31.tgz
Sample Path to Dependency File: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
- next-14.2.3.tgz (Root Library)
- ❌ postcss-8.4.31.tgz (Vulnerable Library)
Found in base branch: main
Vulnerability Details
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Versions prior to 8.5.10 do not escape "</style>" sequences when stringifying CSS ASTs. When user-submitted CSS is parsed and re-stringified for embedding in HTML "<style>" tags, "</style>" in CSS values breaks out of the style context, enabling XSS. Version 8.5.10 fixes the issue.
Publish Date: 2026-04-24
URL: CVE-2026-41305
CVSS 3 Score Details (6.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-qx2v-qp2m-jg93
Release Date: 2026-04-24
Fix Resolution: postcss - 8.5.10,https://github.com/postcss/postcss.git - 8.5.10
Step up your Open Source Security Game with Mend here
CVE-2026-44577
Vulnerable Library - next-14.2.3.tgz
Library home page: https://registry.npmjs.org/next/-/next-14.2.3.tgz
Sample Path to Dependency File: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
- ❌ next-14.2.3.tgz (Vulnerable Library)
Found in base branch: main
Vulnerability Details
Next.js is a React framework for building full-stack web applications. From 10.0.0 to before 15.5.16 and 16.2.5, when self-hosting Next.js with the default image loader, the Image Optimization API fetches local images entirely into memory without enforcing a maximum size limit. An attacker could cause out-of-memory conditions by requesting large local assets from the /_next/image endpoint that match the images.localPatterns configuration (by default, all patterns are allowed). This vulnerability is fixed in 15.5.16 and 16.2.5.
Publish Date: 2026-05-13
URL: CVE-2026-44577
CVSS 3 Score Details (5.9)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-h64f-5h5j-jqjh
Release Date: 2026-05-11
Fix Resolution: next - 15.5.16,next - 16.2.5
Step up your Open Source Security Game with Mend here
CVE-2025-59471
Vulnerable Library - next-14.2.3.tgz
Library home page: https://registry.npmjs.org/next/-/next-14.2.3.tgz
Sample Path to Dependency File: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
- ❌ next-14.2.3.tgz (Vulnerable Library)
Found in base branch: main
Vulnerability Details
A denial of service vulnerability exists in self-hosted Next.js applications that have "remotePatterns" configured for the Image Optimizer. The image optimization endpoint ("/_next/image") loads external images entirely into memory without enforcing a maximum size limit, allowing an attacker to cause out-of-memory conditions by requesting optimization of arbitrarily large images. This vulnerability requires that "remotePatterns" is configured to allow image optimization from external domains and that the attacker can serve or control a large image on an allowed domain. Strongly consider upgrading to 15.5.10 or 16.1.5 to reduce risk and prevent availability issues in Next applications.
Publish Date: 2026-01-26
URL: CVE-2025-59471
CVSS 3 Score Details (5.9)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-9g9p-9gw9-jx7f
Release Date: 2026-01-26
Fix Resolution: next - 15.5.10,next - 16.1.5
Step up your Open Source Security Game with Mend here
CVE-2024-47831
Vulnerable Library - next-14.2.3.tgz
Library home page: https://registry.npmjs.org/next/-/next-14.2.3.tgz
Sample Path to Dependency File: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
- ❌ next-14.2.3.tgz (Vulnerable Library)
Found in base branch: main
Vulnerability Details
Next.js is a React Framework for the Web. Cersions on the 10.x, 11.x, 12.x, 13.x, and 14.x branches before version 14.2.7 contain a vulnerability in the image optimization feature which allows for a potential Denial of Service (DoS) condition which could lead to excessive CPU consumption. Neither the "next.config.js" file that is configured with "images.unoptimized" set to "true" or "images.loader" set to a non-default value nor the Next.js application that is hosted on Vercel are affected. This issue was fully patched in Next.js "14.2.7". As a workaround, ensure that the "next.config.js" file has either "images.unoptimized", "images.loader" or "images.loaderFile" assigned.
Mend Note: The description of this vulnerability differs from MITRE.
Publish Date: 2024-10-14
URL: CVE-2024-47831
CVSS 3 Score Details (5.9)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-g77x-44xx-532m
Release Date: 2024-10-14
Fix Resolution: 14.2.7
Step up your Open Source Security Game with Mend here
CVE-2026-44576
Vulnerable Library - next-14.2.3.tgz
Library home page: https://registry.npmjs.org/next/-/next-14.2.3.tgz
Sample Path to Dependency File: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
- ❌ next-14.2.3.tgz (Vulnerable Library)
Found in base branch: main
Vulnerability Details
Next.js is a React framework for building full-stack web applications. From 14.2.0 to before 15.5.16 and 16.2.5, applications using React Server Components can be vulnerable to cache poisoning when shared caches do not correctly partition response variants. Under affected conditions, an attacker can cause an RSC response to be served from the original URL and poison shared cache entries so later visitors receive component payloads instead of the expected HTML. This vulnerability is fixed in 15.5.16 and 16.2.5.
Publish Date: 2026-05-13
URL: CVE-2026-44576
CVSS 3 Score Details (5.4)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: Low
- Availability Impact: Low
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-wfc6-r584-vfw7
Release Date: 2026-05-11
Fix Resolution: next - 16.2.5,next - 15.5.16
Step up your Open Source Security Game with Mend here
CVE-2026-69153
Vulnerable Library - postcss-8.4.31.tgz
Library home page: https://registry.npmjs.org/postcss/-/postcss-8.4.31.tgz
Sample Path to Dependency File: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
- next-14.2.3.tgz (Root Library)
- ❌ postcss-8.4.31.tgz (Vulnerable Library)
Found in base branch: main
Vulnerability Details
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile() to read an unintended source-map file by supplying an absolute or directory-traversal sourceMappingURL. The resulting map’s sources and sourcesContent may then be exposed to the application. This issue is fixed in version 8.5.19.
Publish Date: 2026-08-03
URL: CVE-2026-69153
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: None
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Release Date: 2026-08-03
Fix Resolution: https://github.com/postcss/postcss.git - 8.5.23
Step up your Open Source Security Game with Mend here
CVE-2026-64646
Vulnerable Library - next-14.2.3.tgz
Library home page: https://registry.npmjs.org/next/-/next-14.2.3.tgz
Sample Path to Dependency File: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
- ❌ next-14.2.3.tgz (Vulnerable Library)
Found in base branch: main
Vulnerability Details
Next.js is a React framework for building full-stack web applications. In versions 13.0.0 through 15.5.20 and 16.0.0 through 16.2.10, requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive memory consumption if that Server Actions uses the Edge runtime. This issue has been fixed in versions 15.5.21 and 16.2.11.
Publish Date: 2026-07-27
URL: CVE-2026-64646
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: Low
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-4c39-4ccg-62r3
Release Date: 2026-07-23
Fix Resolution: https://github.com/vercel/next.js.git - v15.5.21,https://github.com/vercel/next.js.git - v16.2.11
Step up your Open Source Security Game with Mend here
Library home page: https://registry.npmjs.org/next/-/next-14.2.3.tgz
Sample Path to Dependency File: /package.json
Path to vulnerable library: /package.json
Vulnerabilities
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
Vulnerable Library - next-14.2.3.tgz
Library home page: https://registry.npmjs.org/next/-/next-14.2.3.tgz
Sample Path to Dependency File: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
Found in base branch: main
Vulnerability Details
A vulnerability in the underlying libheif library used by sharp which Next.js uses for image optimization can lead to remote code execution when AVIF files are optimized.
Until a fix has propagated, optimization of AVIF files is disabled.
Publish Date: 2026-08-24
URL: WS-2026-0029
CVSS 3 Score Details (10.0)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-2xp9-vwfh-vxw4
Release Date: 2026-08-24
Fix Resolution: 15.5.24
Step up your Open Source Security Game with Mend here
Vulnerable Library - next-14.2.3.tgz
Library home page: https://registry.npmjs.org/next/-/next-14.2.3.tgz
Sample Path to Dependency File: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
Found in base branch: main
Vulnerability Details
Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a
rewrites() or redirects() rule that builds its external destination hostname from request-controlled input can be pointed at an arbitrary hostname, regardless of the rule's hostname suffix. For a rewrite, Next.js proxies the request to that arbitrary host and serves the response from the application's origin, leading to Server-Side Request forgery. A redirects() rule configured this way is vulnerable to an Open Redirect. This issue has been fixed in versions 15.5.21 and 16.2.11.
Publish Date: 2026-07-27
URL: CVE-2026-64645
CVSS 3 Score Details (9.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-p9j2-gv94-2wf4
Release Date: 2026-07-23
Fix Resolution: https://github.com/vercel/next.js.git - v15.5.21,https://github.com/vercel/next.js.git - v16.2.11
Step up your Open Source Security Game with Mend here
Vulnerable Library - next-14.2.3.tgz
Library home page: https://registry.npmjs.org/next/-/next-14.2.3.tgz
Sample Path to Dependency File: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
Found in base branch: main
Vulnerability Details
Next.js is a React framework for building full-stack web applications. Starting in version 1.11.4 and prior to versions 12.3.5, 13.5.9, 14.2.25, and 15.2.3, it is possible to bypass authorization checks within a Next.js application, if the authorization check occurs in middleware. If patching to a safe version is infeasible, it is recommend that you prevent external user requests which contain the x-middleware-subrequest header from reaching your Next.js application. This vulnerability is fixed in 12.3.5, 13.5.9, 14.2.25, and 15.2.3.
Mend Note: The description of this vulnerability differs from MITRE.
Publish Date: 2025-03-21
URL: CVE-2025-29927
CVSS 3 Score Details (9.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-f82v-jwr5-mffw
Release Date: 2025-03-21
Fix Resolution: 14.2.25
Step up your Open Source Security Game with Mend here
Vulnerable Library - next-14.2.3.tgz
Library home page: https://registry.npmjs.org/next/-/next-14.2.3.tgz
Sample Path to Dependency File: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
Found in base branch: main
Vulnerability Details
A vulnerability in applications using Pages and App router without Cache Component can lead to remote code execution when the server is hosted on machines using a Windows filesystem.
Publish Date: 2026-08-24
URL: CVE-2026-75604
CVSS 3 Score Details (9.0)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-p293-qw3h-jr36
Release Date: 2026-08-24
Fix Resolution: 15.5.24
Step up your Open Source Security Game with Mend here
Vulnerable Library - next-14.2.3.tgz
Library home page: https://registry.npmjs.org/next/-/next-14.2.3.tgz
Sample Path to Dependency File: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
Found in base branch: main
Vulnerability Details
Next.js is a React framework for building full-stack web applications. From 13.4.13 to before 15.5.16 and 16.2.5, self-hosted applications using the built-in Node.js server can be vulnerable to server-side request forgery through crafted WebSocket upgrade requests. An attacker can cause the server to proxy requests to arbitrary internal or external destinations, which may expose internal services or cloud metadata endpoints. Vercel-hosted deployments are not affected. This vulnerability is fixed in 15.5.16 and 16.2.5.
Publish Date: 2026-05-13
URL: CVE-2026-44578
CVSS 3 Score Details (8.6)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: None
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-c4j6-fc7j-m34r
Release Date: 2026-05-05
Fix Resolution: 15.5.16
Step up your Open Source Security Game with Mend here
Vulnerable Library - next-14.2.3.tgz
Library home page: https://registry.npmjs.org/next/-/next-14.2.3.tgz
Sample Path to Dependency File: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
Found in base branch: main
Vulnerability Details
Next.js is a React framework for building full-stack web applications. In versions 14.1.1 through 15.5.20 and 16.0.0 through 16.2.10, when a Server Action forwards or redirects a request, an attacker can cause the server to send that outbound request to a malicious host (Server-Side Request Forgery). This requires the attacker's request to control Host-associated headers. In some configurations, it's also possible to obtain internal values that weaken middleware/proxy authorization. Applications that use Server Actions are affected when the incoming host header is not fixed to a trusted value. This typically occurs on custom servers, or on deployments not behind a proxy that pins the host. Managed hosting pins the host upstream and is not affected; next start and standalone output do the same from version 14.2 onward. This issue has been fixed in versions 15.5.21 and 16.2.11.
Publish Date: 2026-07-27
URL: CVE-2026-64649
CVSS 3 Score Details (8.2)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-89xv-2m56-2m9x
Release Date: 2026-07-23
Fix Resolution: https://github.com/vercel/next.js.git - v15.5.21,https://github.com/vercel/next.js.git - v16.2.11
Step up your Open Source Security Game with Mend here
Vulnerable Library - postcss-8.4.31.tgz
Library home page: https://registry.npmjs.org/postcss/-/postcss-8.4.31.tgz
Sample Path to Dependency File: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
Found in base branch: main
Vulnerability Details
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.18, lib/previous-map.js loadMap() passes attacker-controlled sourceMappingURL values to join(dirname(opts.from), annotation), and loadFile() permits traversed or absolute .map paths, allowing untrusted CSS processed without map: false to disclose sourcesContent from arbitrary reachable .map files through result.map. This issue is fixed in version 8.5.18.
Publish Date: 2026-08-17
URL: CVE-2026-73646
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: None
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2026-08-13
Fix Resolution: https://github.com/postcss/postcss.git - 8.5.18
Step up your Open Source Security Game with Mend here
Vulnerable Library - next-14.2.3.tgz
Library home page: https://registry.npmjs.org/next/-/next-14.2.3.tgz
Sample Path to Dependency File: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
Found in base branch: main
Vulnerability Details
Next.js is a React framework for building full-stack web applications. In versions 13.0.0 through 15.5.20 and 16.0.0 through 16.2.10, crafted requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive CPU usage blocking processing of further requests in the same process. This issue has been fixed in versions 15.5.21 and 16.2.11.
Publish Date: 2026-07-27
URL: CVE-2026-64641
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-m99w-x7hq-7vfj
Release Date: 2026-07-23
Fix Resolution: https://github.com/vercel/next.js.git - v15.5.21,https://github.com/vercel/next.js.git - v16.2.11
Step up your Open Source Security Game with Mend here
Vulnerable Library - postcss-8.4.31.tgz
Library home page: https://registry.npmjs.org/postcss/-/postcss-8.4.31.tgz
Sample Path to Dependency File: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
Found in base branch: main
Vulnerability Details
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the /*# sourceMappingURL=PATH */ comment from any CSS string passed to process() and dereferences PATH against the local filesystem with no scheme, allowlist, or traversal check. An attacker who controls the CSS input can cause the host process to read any file readable by Node and leak the first ~10 bytes of its content through the resulting JSON.parse SyntaxError message. The bug also yields a precise file-existence oracle and a controllable-read primitive that may be combined with large-file targets for DoS. The behaviour is triggered with PostCSS's default options — no from, no map, no plugins required — and is therefore reachable from any pipeline that runs untrusted CSS through PostCSS (CMS themes, user-uploaded styles, browser-extension/userstyle processors, build pipelines for third-party packages, blog comment renderers, etc.). This issue has been fixed in version 8.5.12.
Publish Date: 2026-07-27
URL: CVE-2026-45623
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: None
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2026-07-23
Fix Resolution: postcss - 8.5.12,https://github.com/postcss/postcss.git - 8.5.12
Step up your Open Source Security Game with Mend here
Vulnerable Library - next-14.2.3.tgz
Library home page: https://registry.npmjs.org/next/-/next-14.2.3.tgz
Sample Path to Dependency File: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
Found in base branch: main
Vulnerability Details
Next.js is a React framework for building full-stack web applications. From 12.2.0 to before 15.5.16 and 16.2.5, Applications using the Pages Router with i18n configured and middleware/proxy-based authorization can allow unauthorized access to protected page data through locale-less /_next/data//.json requests. In affected configurations, middleware does not run for the unprefixed data route, allowing an attacker to retrieve SSR JSON for protected pages without passing the intended authorization checks. This vulnerability is fixed in 15.5.16 and 16.2.5.
Publish Date: 2026-05-13
URL: CVE-2026-44573
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: None
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-36qx-fr4f-26g5
Release Date: 2026-05-05
Fix Resolution: 15.5.16
Step up your Open Source Security Game with Mend here
Vulnerable Library - next-14.2.3.tgz
Library home page: https://registry.npmjs.org/next/-/next-14.2.3.tgz
Sample Path to Dependency File: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
Found in base branch: main
Vulnerability Details
Next.js is a React framework for building full-stack web applications. In affected versions if a Next.js application is performing authorization in middleware based on pathname, it was possible for this authorization to be bypassed for pages directly under the application's root directory. For example: * [Not affected] "https://example.com/" * [Affected] "https://example.com/foo" * [Not affected] "https://example.com/foo/bar". This issue is patched in Next.js "14.2.15" and later. If your Next.js application is hosted on Vercel, this vulnerability has been automatically mitigated, regardless of Next.js version. There are no official workarounds for this vulnerability.
Publish Date: 2024-12-17
URL: CVE-2024-51479
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: None
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-7gfc-8cq8-jh5f
Release Date: 2024-12-17
Fix Resolution: 14.2.15
Step up your Open Source Security Game with Mend here
Vulnerable Library - next-14.2.3.tgz
Library home page: https://registry.npmjs.org/next/-/next-14.2.3.tgz
Sample Path to Dependency File: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
Found in base branch: main
Vulnerability Details
Next.js is a React framework for building full-stack web applications. By sending a crafted HTTP request, it is possible to poison the cache of a non-dynamic server-side rendered route in the pages router (this does not affect the app router). When this crafted request is sent it could coerce Next.js to cache a route that is meant to not be cached and send a "Cache-Control: s-maxage=1, stale-while-revalidate" header which some upstream CDNs may cache as well. To be potentially affected all of the following must apply: 1. Next.js between 13.5.1 and 14.2.9, 2. Using pages router, & 3. Using non-dynamic server-side rendered routes e.g. "pages/dashboard.tsx" not "pages/blog/[slug].tsx". This vulnerability was resolved in Next.js v13.5.7, v14.2.10, and later. We recommend upgrading regardless of whether you can reproduce the issue or not. There are no official or recommended workarounds for this issue, we recommend that users patch to a safe version.
Mend Note: The description of this vulnerability differs from MITRE.
Publish Date: 2024-09-17
URL: CVE-2024-46982
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-gp8f-8m3g-qvj9
Release Date: 2024-09-17
Fix Resolution: 14.2.10
Step up your Open Source Security Game with Mend here
Vulnerable Library - next-14.2.3.tgz
Library home page: https://registry.npmjs.org/next/-/next-14.2.3.tgz
Sample Path to Dependency File: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
Found in base branch: main
Vulnerability Details
Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a server-side fetch with a request body may return a cached response body from a different request to the same URL but different body. Confidential data in the POST's response body would then leak to unauthorized requests. Though the request itself will not be deduped. This only applies to fetch calls with a request that has a different init than the one passed to fetch. A safe request would be: fetch(new Request(init), init). An unsafe request would be: fetch(new Request(init), aDifferentInit). This issue has been fixed in versions 15.5.21 and 16.2.11.
Publish Date: 2026-07-27
URL: CVE-2026-64648
CVSS 3 Score Details (7.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-68g3-v927-f742
Release Date: 2026-07-23
Fix Resolution: https://github.com/vercel/next.js.git - v16.2.11,https://github.com/vercel/next.js.git - v15.5.21
Step up your Open Source Security Game with Mend here
Vulnerable Library - next-14.2.3.tgz
Library home page: https://registry.npmjs.org/next/-/next-14.2.3.tgz
Sample Path to Dependency File: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
Found in base branch: main
Vulnerability Details
Summary When Next.js rewrites proxy traffic to an external backend, a crafted "DELETE"/"OPTIONS" request using "Transfer-Encoding: chunked" could trigger request boundary disagreement between the proxy and backend. This could allow request smuggling through rewritten routes. Impact An attacker could smuggle a second request to unintended backend routes (for example, internal/admin endpoints), bypassing assumptions that only the configured rewrite destination/path is reachable. This does not impact applications hosted on providers that handle rewrites at the CDN level, such as Vercel. Patches The vulnerability originated in an upstream library vendored by Next.js. It is fixed by updating that dependency’s behavior so "content-length: 0" is added only when both "content-length" and "transfer-encoding" are absent, and "transfer-encoding" is no longer removed in that code path. Workarounds If upgrade is not immediately possible: - Block chunked "DELETE"/"OPTIONS" requests on rewritten routes at your edge/proxy. - Enforce authentication/authorization on backend routes per our "security guidance" (https://nextjs.org/docs/app/guides/data-security).
Publish Date: 2026-03-18
URL: CVE-2026-29057
CVSS 3 Score Details (6.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2026-03-18
Fix Resolution: https://github.com/vercel/next.js.git - v16.1.7,https://github.com/vercel/next.js.git - v15.5.13
Step up your Open Source Security Game with Mend here
Vulnerable Library - next-14.2.3.tgz
Library home page: https://registry.npmjs.org/next/-/next-14.2.3.tgz
Sample Path to Dependency File: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
Found in base branch: main
Vulnerability Details
Next.js is a React framework for building full-stack web applications. Prior to versions 14.2.32 and 15.4.7, when next() was used without explicitly passing the request object, it could lead to SSRF in self-hosted applications that incorrectly forwarded user-supplied headers. This vulnerability has been fixed in Next.js versions 14.2.32 and 15.4.7. All users implementing custom middleware logic in self-hosted environments are strongly encouraged to upgrade and verify correct usage of the next() function.
Mend Note: The description of this vulnerability differs from MITRE.
Publish Date: 2025-08-29
URL: CVE-2025-57822
CVSS 3 Score Details (6.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-4342-x723-ch2f
Release Date: 2025-08-29
Fix Resolution: 14.2.32
Step up your Open Source Security Game with Mend here
Vulnerable Library - next-14.2.3.tgz
Library home page: https://registry.npmjs.org/next/-/next-14.2.3.tgz
Sample Path to Dependency File: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
Found in base branch: main
Vulnerability Details
Next.js is a React framework for building full-stack web applications. In versions before 14.2.31 and from 15.0.0 to before 15.4.5, Next.js Image Optimization API routes are affected by cache key confusion. When images returned from API routes vary based on request headers (such as Cookie or Authorization), these responses could be incorrectly cached and served to unauthorized users due to a cache key confusion bug. This vulnerability has been fixed in Next.js versions 14.2.31 and 15.4.5. All users are encouraged to upgrade if they use API routes to serve images that depend on request headers and have image optimization enabled.
Publish Date: 2025-08-29
URL: CVE-2025-57752
CVSS 3 Score Details (6.2)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: None
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-g5qg-72qw-gw5v
Release Date: 2025-08-29
Fix Resolution: 14.2.31
Step up your Open Source Security Game with Mend here
Vulnerable Library - next-14.2.3.tgz
Library home page: https://registry.npmjs.org/next/-/next-14.2.3.tgz
Sample Path to Dependency File: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
Found in base branch: main
Vulnerability Details
Next.js is a React framework for building full-stack web applications. From 13.0.0 to before 15.5.16 and 16.2.5, applications that use beforeInteractive scripts together with untrusted content can be vulnerable to cross-site scripting. In affected versions, serialized script content was not escaped safely before being embedded into the document, which could allow attacker-controlled input to break out of the intended script context and execute arbitrary JavaScript in a visitor's browser. This vulnerability is fixed in 15.5.16 and 16.2.5.
Publish Date: 2026-05-13
URL: CVE-2026-44580
CVSS 3 Score Details (6.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-gx5p-jg67-6x7h
Release Date: 2026-05-11
Fix Resolution: next - 15.5.16,next - 16.2.5
Step up your Open Source Security Game with Mend here
Vulnerable Library - postcss-8.4.31.tgz
Library home page: https://registry.npmjs.org/postcss/-/postcss-8.4.31.tgz
Sample Path to Dependency File: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
Found in base branch: main
Vulnerability Details
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Versions prior to 8.5.10 do not escape "</style>" sequences when stringifying CSS ASTs. When user-submitted CSS is parsed and re-stringified for embedding in HTML "<style>" tags, "</style>" in CSS values breaks out of the style context, enabling XSS. Version 8.5.10 fixes the issue.
Publish Date: 2026-04-24
URL: CVE-2026-41305
CVSS 3 Score Details (6.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-qx2v-qp2m-jg93
Release Date: 2026-04-24
Fix Resolution: postcss - 8.5.10,https://github.com/postcss/postcss.git - 8.5.10
Step up your Open Source Security Game with Mend here
Vulnerable Library - next-14.2.3.tgz
Library home page: https://registry.npmjs.org/next/-/next-14.2.3.tgz
Sample Path to Dependency File: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
Found in base branch: main
Vulnerability Details
Next.js is a React framework for building full-stack web applications. From 10.0.0 to before 15.5.16 and 16.2.5, when self-hosting Next.js with the default image loader, the Image Optimization API fetches local images entirely into memory without enforcing a maximum size limit. An attacker could cause out-of-memory conditions by requesting large local assets from the /_next/image endpoint that match the images.localPatterns configuration (by default, all patterns are allowed). This vulnerability is fixed in 15.5.16 and 16.2.5.
Publish Date: 2026-05-13
URL: CVE-2026-44577
CVSS 3 Score Details (5.9)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-h64f-5h5j-jqjh
Release Date: 2026-05-11
Fix Resolution: next - 15.5.16,next - 16.2.5
Step up your Open Source Security Game with Mend here
Vulnerable Library - next-14.2.3.tgz
Library home page: https://registry.npmjs.org/next/-/next-14.2.3.tgz
Sample Path to Dependency File: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
Found in base branch: main
Vulnerability Details
A denial of service vulnerability exists in self-hosted Next.js applications that have "remotePatterns" configured for the Image Optimizer. The image optimization endpoint ("/_next/image") loads external images entirely into memory without enforcing a maximum size limit, allowing an attacker to cause out-of-memory conditions by requesting optimization of arbitrarily large images. This vulnerability requires that "remotePatterns" is configured to allow image optimization from external domains and that the attacker can serve or control a large image on an allowed domain. Strongly consider upgrading to 15.5.10 or 16.1.5 to reduce risk and prevent availability issues in Next applications.
Publish Date: 2026-01-26
URL: CVE-2025-59471
CVSS 3 Score Details (5.9)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-9g9p-9gw9-jx7f
Release Date: 2026-01-26
Fix Resolution: next - 15.5.10,next - 16.1.5
Step up your Open Source Security Game with Mend here
Vulnerable Library - next-14.2.3.tgz
Library home page: https://registry.npmjs.org/next/-/next-14.2.3.tgz
Sample Path to Dependency File: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
Found in base branch: main
Vulnerability Details
Next.js is a React Framework for the Web. Cersions on the 10.x, 11.x, 12.x, 13.x, and 14.x branches before version 14.2.7 contain a vulnerability in the image optimization feature which allows for a potential Denial of Service (DoS) condition which could lead to excessive CPU consumption. Neither the "next.config.js" file that is configured with "images.unoptimized" set to "true" or "images.loader" set to a non-default value nor the Next.js application that is hosted on Vercel are affected. This issue was fully patched in Next.js "14.2.7". As a workaround, ensure that the "next.config.js" file has either "images.unoptimized", "images.loader" or "images.loaderFile" assigned.
Mend Note: The description of this vulnerability differs from MITRE.
Publish Date: 2024-10-14
URL: CVE-2024-47831
CVSS 3 Score Details (5.9)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-g77x-44xx-532m
Release Date: 2024-10-14
Fix Resolution: 14.2.7
Step up your Open Source Security Game with Mend here
Vulnerable Library - next-14.2.3.tgz
Library home page: https://registry.npmjs.org/next/-/next-14.2.3.tgz
Sample Path to Dependency File: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
Found in base branch: main
Vulnerability Details
Next.js is a React framework for building full-stack web applications. From 14.2.0 to before 15.5.16 and 16.2.5, applications using React Server Components can be vulnerable to cache poisoning when shared caches do not correctly partition response variants. Under affected conditions, an attacker can cause an RSC response to be served from the original URL and poison shared cache entries so later visitors receive component payloads instead of the expected HTML. This vulnerability is fixed in 15.5.16 and 16.2.5.
Publish Date: 2026-05-13
URL: CVE-2026-44576
CVSS 3 Score Details (5.4)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: Low
- Availability Impact: Low
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-wfc6-r584-vfw7
Release Date: 2026-05-11
Fix Resolution: next - 16.2.5,next - 15.5.16
Step up your Open Source Security Game with Mend here
Vulnerable Library - postcss-8.4.31.tgz
Library home page: https://registry.npmjs.org/postcss/-/postcss-8.4.31.tgz
Sample Path to Dependency File: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
Found in base branch: main
Vulnerability Details
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile() to read an unintended source-map file by supplying an absolute or directory-traversal sourceMappingURL. The resulting map’s sources and sourcesContent may then be exposed to the application. This issue is fixed in version 8.5.19.
Publish Date: 2026-08-03
URL: CVE-2026-69153
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: None
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2026-08-03
Fix Resolution: https://github.com/postcss/postcss.git - 8.5.23
Step up your Open Source Security Game with Mend here
Vulnerable Library - next-14.2.3.tgz
Library home page: https://registry.npmjs.org/next/-/next-14.2.3.tgz
Sample Path to Dependency File: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
Found in base branch: main
Vulnerability Details
Next.js is a React framework for building full-stack web applications. In versions 13.0.0 through 15.5.20 and 16.0.0 through 16.2.10, requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive memory consumption if that Server Actions uses the Edge runtime. This issue has been fixed in versions 15.5.21 and 16.2.11.
Publish Date: 2026-07-27
URL: CVE-2026-64646
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: Low
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-4c39-4ccg-62r3
Release Date: 2026-07-23
Fix Resolution: https://github.com/vercel/next.js.git - v15.5.21,https://github.com/vercel/next.js.git - v16.2.11
Step up your Open Source Security Game with Mend here