Next.js is a React framework for building full-stack web applications. From 15.4.0 to before 15.5.16 and 16.2.5, applications that rely on middleware to protect dynamic routes can be vulnerable to authorization bypass. In affected deployments, specially crafted query parameters can alter the dynamic route value seen by the page while leaving the visible path unchanged, which can allow protected content to be rendered without passing the expected middleware check. This vulnerability is fixed in 15.5.16 and 16.2.5.
Certain React Server Components packages used by Next.js versions 13.x, 14.x, 15.x (prior to 15.5.16), and 16.x (prior to 16.2.5) with the App Router are vulnerable to a denial of service. An attacker can send a specially crafted HTTP request to an App Router Server Function endpoint that triggers excessive CPU usage during deserialization, causing service disruption. This vulnerability is tracked as CVE-2026-23870 and has a high severity rating.
Next.js is a React framework for building full-stack web applications. Starting in version 10.0.0 and prior to version 16.1.7, the default Next.js image optimization disk cache (`/_next/image`) did not have a configurable upper bound, allowing unbounded cache growth. An attacker could generate many unique image-optimization variants and exhaust disk space, causing denial of service. This is fixed in version 16.1.7 by adding an LRU-backed disk cache with `images.maximumDiskCacheSize`, including eviction of least-recently-used entries when the limit is exceeded. Setting `maximumDiskCacheSize: 0` disables disk caching. If upgrading is not immediately possible, periodically clean `.next/cache/images` and/or reduce variant cardinality (e.g., tighten values for `images.localPatterns`, `images.remotePatterns`, and `images.qualities`).
CVE-2026-27977 is a low-severity vulnerability affecting development mode in Next.js versions 16.0.1 up to but not including 16.1.7. It involves missing origin validation in WebSocket connections used for Hot Module Replacement (HMR) during development. Specifically, the dev server's WebSocket endpoint could treat an 'Origin: null' header as a bypass, allowing attacker-controlled or sandboxed contexts to connect unexpectedly if the dev server is exposed to untrusted networks. This could enable an attacker to interact with development WebSocket traffic, potentially leaking sensitive information or manipulating the development environment. The issue is fixed in version 16.
CVE-2025-13984 is a medium severity vulnerability in Drupal's Next.js integration involving a permissive cross-domain security policy that allows untrusted domains. This misconfiguration enables Cross-Site Scripting (XSS) attacks by permitting malicious domains to execute scripts in the context of trusted sites. The vulnerability affects Next.js versions from 0.0.0 before 1.6.4 and from 2.0.
CVE-2025-55182, known as React2Shell, is a critical vulnerability in React Server Components affecting React versions 19.x and Next.js versions 15.x and 16.x when using App Router. It has a maximum CVSS score of 10.0. Multiple China state-nexus threat groups, including Earth Lamia and Jackpot Panda, rapidly exploited this vulnerability within hours of its public disclosure on December 3, 2025. Public exploit code is available through Metasploit and Exploit-DB, and the vulnerability has been added to the CISA KEV catalog. Fixed versions include React 20.0.0 and Next.js 17.0.0 and later.
Next.js is a React framework for building full-stack web applications. In Next.js App Router from 15.3.0 to before 15.3.3 and Vercel CLI from 41.4.1 to 42.2.0, a cache poisoning vulnerability was found. The issue allowed page requests for HTML content to return a React Server Component (RSC) payload instead under certain conditions. When deployed to Vercel, this would only impact the browser cache, and would not lead to the CDN being poisoned. When self-hosted and deployed externally, this could lead to cache poisoning if the CDN does not properly distinguish between RSC / HTML in the cache keys. This issue has been resolved in Next.js 15.3.3.
Next.js is a React framework for building full-stack web applications. In versions starting from 13.0 to before 14.2.30 and 15.0.0 to before 15.2.2, Next.js may have allowed limited source code exposure when the dev server was running with the App Router enabled. The vulnerability only affects local development environments and requires the user to visit a malicious webpage while npm run dev is active. This issue has been patched in versions 14.2.30 and 15.2.2.