Next.js versions 13.0.0 up to but excluding 15.5.28, and 16.0.0 up to but excluding 16.4.1, have a vulnerability in App Router applications using Server Actions. Crafted requests can cause excessive CPU usage and block processing of further requests in the same process. Applications using the Pages Router or App Router without Server Actions are not affected. The issue is fixed in versions 15.5.28 and 16.4.1.
CVE-2026-94544 is a medium severity vulnerability in Vercel's Next.js framework affecting versions >=16.3.0 and <16.3.8. It involves the use of a shared cache for pending `use cache` fills that does not distinguish between Draft Mode and regular requests. This can cause unpublished draft content to be served to unauthenticated users or published content to be served in draft previews. Additionally, if a regular request prerenders a page during this overlap, unpublished content may be persisted and served to all visitors until the page is revalidated.
Next.js is a React framework for building full-stack web applications. From 15.2.0 to before 15.5.18 and 16.2.6, it was found that the fix addressing CVE-2026-44575 did not apply to middleware.ts with Turbopack. This vulnerability is fixed in 15.5.18 and 16.2.6.
Next.js is a React framework for building full-stack web applications. From 15.2.0 to before 15.5.16 and 16.2.5, App Router applications that rely on middleware or proxy-based checks for authorization can allow unauthorized access through transport-specific route variants used for segment prefetching. In affected configurations, specially crafted .rsc and segment-prefetch URLs can resolve to the same page without being matched by the intended middleware rule, which can allow protected content to be reached without the expected authorization check. This vulnerability is fixed in 15.5.16 and 16.2.5.
Next.js is a React framework for building full-stack web applications. From 12.2.0 to before 15.5.16 and 16.2.5, Applications using the Pages Router with i18n configured and middleware/proxy-based authorization can allow unauthorized access to protected page data through locale-less /_next/data/<buildId>/<page>.json requests. In affected configurations, middleware does not run for the unprefixed data route, allowing an attacker to retrieve SSR JSON for protected pages without passing the intended authorization checks. This vulnerability is fixed in 15.5.16 and 16.2.5.
Next.js is a React framework for building full-stack web applications. Starting in version 9.5.0 and prior to versions 15.5.13 and 16.1.7, when Next.js rewrites proxy traffic to an external backend, a crafted `DELETE`/`OPTIONS` request using `Transfer-Encoding: chunked` could trigger request boundary disagreement between the proxy and backend. This could allow request smuggling through rewritten routes. An attacker could smuggle a second request to unintended backend routes (for example, internal/admin endpoints), bypassing assumptions that only the configured rewrite destination/path is reachable. This does not impact applications hosted on providers that handle rewrites at the CDN level, such as Vercel. The vulnerability originated in an upstream library vendored by Next.js. It is fixed in Next.js 15.5.13 and 16.1.7 by updating that dependency’s behavior so `content-length: 0` is added only when both `content-length` and `transfer-encoding` are absent, and `transfer-encoding` is no longer removed in that code path. If upgrading is not immediately possible, block chunked `DELETE`/`OPTIONS` requests on rewritten routes at the edge/proxy, and/or enforce authentication/authorization on backend routes.
CVE-2025-59471 is a denial of service vulnerability affecting self-hosted Next.js applications using the Image Optimizer with remotePatterns configured for external domains. The vulnerability arises because the image optimization endpoint loads external images fully into memory without size limits, allowing attackers to cause out-of-memory conditions by requesting large images. Exploitation requires that remotePatterns allow external domains and that attackers control or serve large images from these domains. The vulnerability affects Next.js versions 10.0 through 16.0. No authentication or user interaction is needed, but the attack complexity is high due to the need to control large images on allowed domains. The CVSS score is 5.