Next.js vulnerabilities

Next.js before 2.4.1 has a directory traversal vulnerability in the /_next and /static request namespace, allowing attackers to obtain sensitive information.

Next.js, a React framework for full-stack applications, versions 13.4.0 through 15.5.24 and 16.3.3, on Windows-hosted servers does not properly escape backslashes in route segments when constructing cache paths, allowing a remote attacker to traverse outside the cache root and expose private data, including the server-reference-manifest encryption key. Disclosure of this key can enable remote code execution. Fixed in versions 15.5.24 and 16.3.3.

Next.js versions from 13.4.13 to before 15.5.16 and 16.2.5 are vulnerable to server-side request forgery (SSRF) via crafted WebSocket upgrade requests. An attacker can force the server to proxy requests to arbitrary internal or external destinations, potentially exposing internal services or cloud metadata endpoints.

A vulnerability in applications using the App router with the Cache Component can lead to remote code execution. The application must have a `use cache` function that returns multiple typed arrays.

Next.js from 13.0.0 until 15.5.28 and 16.4.1 has a vulnerability where crafted requests targeting App Router applications with at least one Server Action can cause excessive CPU consumption and block processing of further requests in the same process. Applications using the Pages Router and App Router applications without Server Actions are not affected. The issue is fixed in versions 15.5.28 and 16.4.1.

Next.js versions 16.3.0 through 16.3.8 share cache fills for the same key without separating Draft Mode requests from regular requests. An overlapping regular request can receive unauthenticated unpublished content from an editor's Draft Mode fill, while an overlapping Draft Mode request can receive published content from a regular fill. When the regular request prerenders a page, the draft-dependent content can persist in the generated page and be served to later visitors until revalidation. Sites are affected when Cache Components or experimental.useCache is enabled and cached functions return draft-dependent content. This issue is fixed in version 16.3.8.

Next.js versions 15.0.0 through 15.5.27 and 16.3.8 for self-hosted applications using the Pages Router with statically generated or Incremental Static Regeneration pages can key a response cache entry without sufficiently binding it to the source route. A request can replace one page's cache entry with content from a different route, causing the affected page to serve incorrect content to every visitor until revalidation. Applications deployed on Vercel are not affected. This issue is fixed in versions 15.5.27 and 16.3.8.

Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, the next dev development server exposes a Model Context Protocol endpoint without reliably restricting cross-site requests. A malicious website visited by a developer can reach the endpoint and read the project's disk location, source code snippets from error reports, route inventory, and development logs. Production deployments do not serve this endpoint. This issue is fixed in version 16.3.8.

Next.js versions 16.0.0 through 16.3.8 in the `next dev` development server expose a Model Context Protocol endpoint without reliably restricting cross-site requests. A malicious website visited by a developer can reach the endpoint and read the project's disk location, source code snippets from error reports, route inventory, and development logs. Production deployments do not serve this endpoint. This issue is fixed in version 16.3.8.

Next.js versions 15.0.0 through 15.5.27 and 16.3.8 for applications with a root-level catch-all page and statically generated or Incremental Static Regeneration routes can use a shared response cache key that is insufficiently scoped to the source route. A single unauthenticated crafted request can poison that cache, causing cross-user content substitution or persistent denial of service until the poisoned entry is revalidated or replaced. This issue is fixed in versions 15.5.27 and 16.3.8.

Next.js from 16.0.0 to 16.3.8 has a vulnerability in image optimization that allows bypassing the allow-list and accessing private IP addresses. An attacker can control DNS resolution for a remote URL that matches images.remotePatterns.

Vulnerability in Next.js versions 16.3.0 to 16.3.7 causes incorrect cache keying for 'use cache' handlers, potentially leaking return values across different root params.

In Next.js, when a Server Action forwards or redirects a request, an attacker can cause the server to send that outbound request to a malicious host (SSRF). In some configurations, it's also possible to obtain internal values that weaken middleware/proxy authorization.

Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a server-side fetch with a request body may return a cached response body from a different request to the same URL but different body. Confidential data in the POST's response body would then leak to unauthorized requests. This issue has been fixed in versions 15.5.21 and 16.2.11.

In Next.js versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a server-side fetch with a request body may return a cached response body from a different request to the same URL but different body. This leads to leakage of confidential POST response data to unauthorized requests. The issue only occurs with request bodies using a charset other than UTF-8.

In Next.js versions 13.0.0 through 15.5.20 and 16.0.0 through 16.2.10, requests targeting applications using App Router with at least one Server Action can lead to excessive memory consumption if that Server Action uses the Edge runtime.

Next.js versions 12.0.0-15.5.20 and 16.0.0-16.2.10 have a vulnerability in rewrites()/redirects() rules with external hostnames from requests. Attackers can point requests to arbitrary hosts, causing SSRF (rewrite) or Open Redirect (redirect).

In Next.js versions 15.5.0 through 15.5.20 and 16.0.0 through 16.2.10, when self-hosting with the default image loader, the Image Optimization API can optimize remotely hosted images if configured (not enabled by default). If those images contain malicious content, they can cause CPU exhaustion in /_next/image endpoints. Only config.images.remotePatterns is affected.

In Next.js versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, applications using App Router and Server Actions can disclose Server Action IDs to unauthenticated users via publicly served client artifacts. This disclosure is typically a recon primitive but increases risk when combined with other weaknesses.

Next.js versions 16.0.0-16.2.10 have a vulnerability in applications using App Router with Turbopack and a single entry in config.i18n.locales. Crafted requests can bypass middleware/proxy-based authentication.

Next.js versions 13.0.0-15.5.20 and 16.0.0-16.2.10 have a vulnerability in applications using App Router with at least one Server Action. Crafted requests can cause excessive CPU usage, blocking further request processing.

A vulnerability in Next.js involves incomplete application of the fix for CVE-2026-44575 in middleware.ts when using Turbopack. It affects versions from 15.2.0 to before 15.5.18 and 16.2.6.

In Next.js from 13.4.6 to before 15.5.16 and 16.2.5, React Server Component responses can be vulnerable to cache poisoning in deployments relying on shared caches with insufficient response partitioning. Collisions in the _rsc cache-busting value can allow an attacker to poison cache entries so users receive the wrong response variant for a given URL.

Next.js is a React framework for building full-stack web applications. From 13.4.0 to before 15.5.16 and 16.2.5, App Router applications that rely on CSP nonces can be vulnerable to stored cross-site scripting when deployed behind shared caches. Malformed nonce values derived from request headers could be reflected into rendered HTML in an unsafe way, allowing an attacker to poison cached responses and cause script execution for later visitors.

Next.js is a React framework for building full-stack web applications. From 13.0.0 to before 15.5.16 and 16.2.5, applications that use beforeInteractive scripts together with untrusted content can be vulnerable to cross-site scripting. Serialized script content was not escaped safely before being embedded into the document, which could allow attacker-controlled input to break out of the intended script context and execute arbitrary JavaScript in a visitor's browser.

Next.js, a React framework for building full-stack web applications, is vulnerable to connection exhaustion via crafted POST requests to a server action. This affects applications using Partial Prerendering through the Cache Components feature, where a malicious request can cause a request-body handling deadlock, leaving connections open for an extended period.

Next.js versions from 10.0.0 to before 15.5.16 and 16.2.5, when self-hosted with the default image loader, do not enforce a maximum size limit for local assets fetched by the Image Optimization API. An attacker can request large files via the /_next/image endpoint, causing out-of-memory conditions.

In Next.js applications using React Server Components from 14.2.0 to before 15.5.16 and 16.2.5, shared caches that do not correctly partition response variants can be poisoned. An attacker can cause an RSC response to be served from the original URL so later visitors receive component payloads instead of expected HTML.

A vulnerability in Next.js from version 15.2.0 to 15.5.16 and 16.2.5 allows bypassing authorization checks in applications using App Router. Specially crafted .rsc and segment-prefetch requests can reach protected pages without passing through middleware rules.

Next.js versions from 15.4.0 to 15.5.15 and 16.2.0 to 16.2.4 contain a vulnerability that allows authorization bypass in applications using middleware to protect dynamic routes. Specially crafted query parameters can alter the dynamic route value seen by the page while leaving the visible path unchanged, enabling protected content to be rendered without passing the expected middleware check.

A vulnerability in Next.js allows unauthorized access to SSR data of protected pages by bypassing middleware. It affects versions from 12.2.0 to before 15.5.16 and 16.2.5 with i18n and middleware-based authorization configured.

Next.js in versions 12.2.0 through 15.5.15 and 16.2.4 allows an external client to send an x-nextjs-data header on a normal request to a path handled by middleware that returns a redirect. The middleware may treat the request as a data request and replace the Location header with the internal x-nextjs-redirect header, which browsers do not follow. If the application is behind a CDN or reverse proxy caching 3xx responses without varying on this header, a single attacker request can poison the cache and cause denial of service for that redirect path.

In Next.js prior to versions 14.2.32 and 15.4.7, using next() without explicitly passing the request object could lead to SSRF in self-hosted applications that incorrectly forwarded user-supplied headers. The vulnerability is fixed in versions 14.2.32 and 15.4.7.

Next.js before 14.2.31 and 15.0.0 to before 15.4.5 is affected by cache key confusion in the Image Optimization API routes. Responses from API routes that vary by request headers (e.g., Cookie or Authorization) could be incorrectly cached and served to unauthorized users.

Next.js Image Optimization in versions before 14.2.31 and from 15.0.0 to before 15.4.5 is vulnerable to content injection. An attacker could supply external image sources that trigger file downloads with arbitrary content and filenames, which could be abused for phishing or malicious file delivery.