# Vercel Next.js vulnerabilities Source: https://junglewise.ai/threats/technologies/next-js Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/next-js.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 83 vulnerabilities in Vercel Next.js: 0 in the last 7 days and 14 in the last 90 days, 5 of them critical and 1 exploited in the wild. The most recent, Vercel Next.js remote code execution in use cache functions, was published on 22 October 2026. 3 vulnerabilities in the last four weeks, down 62% on the four before (8). 2 critical against 0. ## Counts - Last 7 days: 0 - Last 30 days: 3 - Last 90 days: 14 - All time: 83 (5 critical, 1 exploited in the wild) ## About Vercel Next.js Next.js is a React-based web framework for building server-rendered and static web applications. ## Latest Vercel Next.js vulnerabilities - [Vercel Next.js remote code execution in use cache functions](https://junglewise.ai/threats/next-js-unauthenticated-remote-code-execution-in-use-cache-functions-ac3e73d3) (critical, CVSS 4, published 22 Oct 2026) - [CVE-2026-94482: Next.js denial of service in App Router with Server Actions](https://junglewise.ai/threats/cve-2026-94482-next-js-denial-of-service-in-app-router-using-server-actions) (high, CVSS 4, published 22 Oct 2026) - [Next.js unauthenticated remote code execution in Image Optimization API](https://junglewise.ai/threats/next-js-unauthenticated-remote-code-execution-in-image-optimization-api-f1b22a87) (critical, CVSS 4, published 22 Oct 2026) - [CVE-2026-94544: Next.js information disclosure in Draft Mode via use cache](https://junglewise.ai/threats/cve-2026-94544-next-js-is-a-react-framework-for-building-full-stack-web) (medium, CVSS 4.2, published 2 Oct 2026) - [CVE-2026-94543: Next.js Pages Router response cache key bypass](https://junglewise.ai/threats/cve-2026-94543-next-js-is-a-react-framework-for-building-full-stack-web) (medium, CVSS 5.3, published 2 Oct 2026) - [CVE-2026-94486: Vercel Next.js information disclosure in dev server MCP endpoint](https://junglewise.ai/threats/cve-2026-94486-next-js-is-a-react-framework-for-building-full-stack-web) (medium, CVSS 5.4, published 2 Oct 2026) - [CVE-2026-94485: Vercel Next.js MCP endpoint information disclosure](https://junglewise.ai/threats/cve-2026-94485-next-js-is-a-react-framework-for-building-full-stack-web) (medium, CVSS 5.3, published 2 Oct 2026) - [CVE-2026-94484: Next.js cache key insufficiently scoped to source route](https://junglewise.ai/threats/cve-2026-94484-next-js-is-a-react-framework-for-building-full-stack-web) (medium, CVSS 4.8, published 2 Oct 2026) - [CVE-2026-94483: Vercel Next.js Image Optimization DNS resolution bypass](https://junglewise.ai/threats/cve-2026-94483-next-js-is-a-react-framework-for-building-full-stack-web) (medium, CVSS 6.5, published 2 Oct 2026) - [CVE-2026-103004: Vercel Next.js cache leak across root param values in nested use cache](https://junglewise.ai/threats/cve-2026-103004-next-js-versions-from-16-3-0-to-16-3-7-warm-use-cache-handlers) (medium, CVSS 5.3, published 1 Oct 2026) - [Next.js remote code execution in next/og ImageResponse](https://junglewise.ai/threats/next-js-remote-code-execution-in-next-og-imageresponse-a62f1779) (medium, CVSS 4, published 30 Sep 2026) - [Next.js heap buffer overflow in image optimization via malicious AVIF](https://junglewise.ai/threats/next-js-heap-buffer-overflow-in-image-optimization-via-malicious-avif-90b951e0) (critical, CVSS 9.5, published 8 Sep 2026) - [CVE-2026-75604: Next.js unauthenticated remote code execution on Windows](https://junglewise.ai/threats/cve-2026-75604-next-js-unauthenticated-remote-code-execution-on-windows) (critical, CVSS 9, published 1 Sep 2026) - [Next.js and libheif RCE in HEIF/AVIF image processing](https://junglewise.ai/threats/next-js-and-libheif-rce-in-heif-avif-image-processing-eebb5345) (info, CVSS 9.8, published 25 Aug 2026) - [CVE-2026-64649: Vercel Next.js SSRF in Server Actions on custom servers](https://junglewise.ai/threats/cve-2026-64649-vercel-next-js-ssrf-in-server-actions-on-custom-servers) (high, CVSS 4, published 27 Jul 2026) - [CVE-2026-64648: Vercel Next.js cache confusion in server-side fetch](https://junglewise.ai/threats/cve-2026-64648-vercel-next-js-cache-confusion-in-server-side-fetch) (medium, CVSS 4, published 27 Jul 2026) - [CVE-2026-64647: Vercel Next.js cache confusion in server-side fetch requests](https://junglewise.ai/threats/cve-2026-64647-vercel-next-js-cache-confusion-in-server-side-fetch-requests) (medium, CVSS 4, published 27 Jul 2026) - [CVE-2026-64646: Vercel Next.js denial of service in Server Actions Edge runtime](https://junglewise.ai/threats/cve-2026-64646-vercel-next-js-denial-of-service-in-server-actions-edge-runtime) (medium, CVSS 4, published 27 Jul 2026) - [CVE-2026-64645: Vercel Next.js SSRF and Open Redirect in rewrites and redirects](https://junglewise.ai/threats/cve-2026-64645-vercel-next-js-ssrf-and-open-redirect-in-rewrites-and-redirects) (high, CVSS 4, published 27 Jul 2026) - [CVE-2026-64644: Vercel Next.js denial of service in Image Optimization API](https://junglewise.ai/threats/cve-2026-64644-vercel-next-js-denial-of-service-in-image-optimization-api) (medium, CVSS 4, published 27 Jul 2026) - [CVE-2026-64643: Vercel Next.js authentication bypass in Server Function endpoints](https://junglewise.ai/threats/cve-2026-64643-vercel-next-js-authentication-bypass-in-server-function-endpoints) (medium, CVSS 4, published 27 Jul 2026) - [CVE-2026-64642: Vercel Next.js authentication bypass in Turbopack middleware matcher](https://junglewise.ai/threats/cve-2026-64642-vercel-next-js-authentication-bypass-in-turbopack-middleware) (high, CVSS 4, published 27 Jul 2026) - [CVE-2026-64641: Vercel Next.js denial of service in App Router Server Actions](https://junglewise.ai/threats/cve-2026-64641-vercel-next-js-denial-of-service-in-app-router-server-actions) (high, CVSS 4, published 27 Jul 2026) - [CVE-2026-45109: Vercel Next.js authentication bypass in middleware with Turbopack](https://junglewise.ai/threats/cve-2026-45109-vercel-next-js-authentication-bypass-in-middleware-with-turbopack) (high, CVSS 7.5, published 13 May 2026) - [CVE-2026-44582: Vercel Next.js cache poisoning in React Server Components](https://junglewise.ai/threats/cve-2026-44582-vercel-next-js-cache-poisoning-in-react-server-components) (low, CVSS 3.7, published 13 May 2026) ## Most severe Vercel Next.js vulnerabilities - [CVE-2025-55182: React Server Components are Vulnerable to RCE](https://junglewise.ai/threats/cve-2025-55182-meta-react-server-components-remote-code-execution) (critical, exploited in the wild, CVSS 10, published 3 Dec 2025) - [Next.js heap buffer overflow in image optimization via malicious AVIF](https://junglewise.ai/threats/next-js-heap-buffer-overflow-in-image-optimization-via-malicious-avif-90b951e0) (critical, CVSS 9.5, published 8 Sep 2026) - [CVE-2026-75604: Next.js unauthenticated remote code execution on Windows](https://junglewise.ai/threats/cve-2026-75604-next-js-unauthenticated-remote-code-execution-on-windows) (critical, CVSS 9, published 1 Sep 2026) - [Vercel Next.js remote code execution in use cache functions](https://junglewise.ai/threats/next-js-unauthenticated-remote-code-execution-in-use-cache-functions-ac3e73d3) (critical, CVSS 4, published 22 Oct 2026) - [Next.js unauthenticated remote code execution in Image Optimization API](https://junglewise.ai/threats/next-js-unauthenticated-remote-code-execution-in-image-optimization-api-f1b22a87) (critical, CVSS 4, published 22 Oct 2026) - [CVE-2026-44578: Vercel Next.js SSRF via WebSocket upgrade requests](https://junglewise.ai/threats/cve-2026-44578-vercel-next-js-ssrf-via-websocket-upgrade-requests) (high, CVSS 8.6, published 13 May 2026) - [CVE-2026-44574: Vercel Next.js authorization bypass in dynamic route middleware](https://junglewise.ai/threats/cve-2026-44574-vercel-next-js-authorization-bypass-in-dynamic-route-middleware) (high, CVSS 8.1, published 13 May 2026) - [CVE-2026-23870: Facebook React Denial of Service in React Server Components](https://junglewise.ai/threats/cve-2026-23870-facebook-react-denial-of-service-in-react-server-components) (high, CVSS 7.5, published 6 May 2026) - [CVE-2026-45109: Vercel Next.js authentication bypass in middleware with Turbopack](https://junglewise.ai/threats/cve-2026-45109-vercel-next-js-authentication-bypass-in-middleware-with-turbopack) (high, CVSS 7.5, published 13 May 2026) - [CVE-2026-44579: Vercel Next.js connection exhaustion in Cache Components](https://junglewise.ai/threats/cve-2026-44579-vercel-next-js-connection-exhaustion-in-cache-components) (high, CVSS 7.5, published 13 May 2026) ## Vulnerabilities per week 3 vulnerabilities in the last four weeks, down 62% on the four before (8). 2 critical against 0. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 1 | 0 | 0 | | 31 Aug 2026 | 1 | 1 | 0 | | 7 Sep 2026 | 1 | 1 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 8 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 3 | 2 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other Vercel technologies - [Vercel AI SDK](https://junglewise.ai/threats/technologies/ai-sdk): 3 vulnerabilities - [Vercel Turbo](https://junglewise.ai/threats/technologies/turbo): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Vercel Next.js vulnerabilities", https://junglewise.ai/threats/technologies/next-js, 9 November 2026.