# next (npm) vulnerabilities Source: https://junglewise.ai/threats/technologies/npm-next Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/npm-next.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 26 vulnerabilities in next (npm): 0 in the last 7 days and 12 in the last 90 days, 3 of them critical and 0 exploited in the wild. The most recent, Vercel Next.js remote code execution in use cache functions, was published on 22 October 2026. 3 vulnerabilities in the last four weeks, down 62% on the four before (8). 2 critical against 0. ## Counts - Last 7 days: 0 - Last 30 days: 3 - Last 90 days: 12 - All time: 26 (3 critical, 0 exploited in the wild) ## About next (npm) Next.js is a React framework for building web applications with server-side rendering and static site generation. ## Latest next (npm) vulnerabilities - [Vercel Next.js remote code execution in use cache functions](https://junglewise.ai/threats/next-js-unauthenticated-remote-code-execution-in-use-cache-functions-ac3e73d3) (critical, CVSS 4, published 22 Oct 2026) - [CVE-2026-94482: Next.js denial of service in App Router with Server Actions](https://junglewise.ai/threats/cve-2026-94482-next-js-denial-of-service-in-app-router-using-server-actions) (high, CVSS 4, published 22 Oct 2026) - [Next.js unauthenticated remote code execution in Image Optimization API](https://junglewise.ai/threats/next-js-unauthenticated-remote-code-execution-in-image-optimization-api-f1b22a87) (critical, CVSS 4, published 22 Oct 2026) - [CVE-2026-94544: Next.js information disclosure in Draft Mode via use cache](https://junglewise.ai/threats/cve-2026-94544-next-js-is-a-react-framework-for-building-full-stack-web) (medium, CVSS 4.2, published 2 Oct 2026) - [CVE-2026-94543: Next.js Pages Router response cache key bypass](https://junglewise.ai/threats/cve-2026-94543-next-js-is-a-react-framework-for-building-full-stack-web) (medium, CVSS 5.3, published 2 Oct 2026) - [CVE-2026-94486: Vercel Next.js information disclosure in dev server MCP endpoint](https://junglewise.ai/threats/cve-2026-94486-next-js-is-a-react-framework-for-building-full-stack-web) (medium, CVSS 5.4, published 2 Oct 2026) - [CVE-2026-94485: Vercel Next.js MCP endpoint information disclosure](https://junglewise.ai/threats/cve-2026-94485-next-js-is-a-react-framework-for-building-full-stack-web) (medium, CVSS 5.3, published 2 Oct 2026) - [CVE-2026-94484: Next.js cache key insufficiently scoped to source route](https://junglewise.ai/threats/cve-2026-94484-next-js-is-a-react-framework-for-building-full-stack-web) (medium, CVSS 4.8, published 2 Oct 2026) - [CVE-2026-94483: Vercel Next.js Image Optimization DNS resolution bypass](https://junglewise.ai/threats/cve-2026-94483-next-js-is-a-react-framework-for-building-full-stack-web) (medium, CVSS 6.5, published 2 Oct 2026) - [CVE-2026-103004: Vercel Next.js cache leak across root param values in nested use cache](https://junglewise.ai/threats/cve-2026-103004-next-js-versions-from-16-3-0-to-16-3-7-warm-use-cache-handlers) (medium, CVSS 5.3, published 1 Oct 2026) - [Next.js remote code execution in next/og ImageResponse](https://junglewise.ai/threats/next-js-remote-code-execution-in-next-og-imageresponse-a62f1779) (medium, CVSS 4, published 30 Sep 2026) - [CVE-2026-75604: Next.js unauthenticated remote code execution on Windows](https://junglewise.ai/threats/cve-2026-75604-next-js-unauthenticated-remote-code-execution-on-windows) (critical, CVSS 9, published 1 Sep 2026) - [CVE-2026-64649: Vercel Next.js SSRF in Server Actions on custom servers](https://junglewise.ai/threats/cve-2026-64649-vercel-next-js-ssrf-in-server-actions-on-custom-servers) (high, CVSS 4, published 27 Jul 2026) - [CVE-2026-64648: Vercel Next.js cache confusion in server-side fetch](https://junglewise.ai/threats/cve-2026-64648-vercel-next-js-cache-confusion-in-server-side-fetch) (medium, CVSS 4, published 27 Jul 2026) - [CVE-2026-64645: Vercel Next.js SSRF and Open Redirect in rewrites and redirects](https://junglewise.ai/threats/cve-2026-64645-vercel-next-js-ssrf-and-open-redirect-in-rewrites-and-redirects) (high, CVSS 4, published 27 Jul 2026) - [CVE-2026-64644: Vercel Next.js denial of service in Image Optimization API](https://junglewise.ai/threats/cve-2026-64644-vercel-next-js-denial-of-service-in-image-optimization-api) (medium, CVSS 4, published 27 Jul 2026) - [CVE-2026-64643: Vercel Next.js authentication bypass in Server Function endpoints](https://junglewise.ai/threats/cve-2026-64643-vercel-next-js-authentication-bypass-in-server-function-endpoints) (medium, CVSS 4, published 27 Jul 2026) - [CVE-2026-64642: Vercel Next.js authentication bypass in Turbopack middleware matcher](https://junglewise.ai/threats/cve-2026-64642-vercel-next-js-authentication-bypass-in-turbopack-middleware) (high, CVSS 4, published 27 Jul 2026) - [CVE-2026-64641: Vercel Next.js denial of service in App Router Server Actions](https://junglewise.ai/threats/cve-2026-64641-vercel-next-js-denial-of-service-in-app-router-server-actions) (high, CVSS 4, published 27 Jul 2026) - [CVE-2026-44582: Vercel Next.js cache poisoning in React Server Components](https://junglewise.ai/threats/cve-2026-44582-vercel-next-js-cache-poisoning-in-react-server-components) (low, CVSS 3.7, published 13 May 2026) - [CVE-2026-44581: Vercel Next.js stored XSS in App Router via CSP nonce reflection](https://junglewise.ai/threats/cve-2026-44581-vercel-next-js-xss-in-app-router-via-csp-nonces) (medium, CVSS 4.7, published 13 May 2026) - [CVE-2026-44580: Vercel Next.js cross-site scripting in beforeInteractive scripts](https://junglewise.ai/threats/cve-2026-44580-vercel-next-js-xss-in-beforeinteractive-scripts) (medium, CVSS 6.1, published 13 May 2026) - [CVE-2026-44579: Vercel Next.js connection exhaustion in Cache Components](https://junglewise.ai/threats/cve-2026-44579-vercel-next-js-connection-exhaustion-in-cache-components) (high, CVSS 7.5, published 13 May 2026) - [CVE-2026-44578: Vercel Next.js SSRF via WebSocket upgrade requests](https://junglewise.ai/threats/cve-2026-44578-vercel-next-js-ssrf-via-websocket-upgrade-requests) (high, CVSS 8.6, published 13 May 2026) - [CVE-2026-44577: Vercel Next.js denial of service in Image Optimization API](https://junglewise.ai/threats/cve-2026-44577-vercel-next-js-denial-of-service-in-image-optimization-api) (medium, CVSS 5.9, published 13 May 2026) ## Most severe next (npm) vulnerabilities - [CVE-2026-75604: Next.js unauthenticated remote code execution on Windows](https://junglewise.ai/threats/cve-2026-75604-next-js-unauthenticated-remote-code-execution-on-windows) (critical, CVSS 9, published 1 Sep 2026) - [Vercel Next.js remote code execution in use cache functions](https://junglewise.ai/threats/next-js-unauthenticated-remote-code-execution-in-use-cache-functions-ac3e73d3) (critical, CVSS 4, published 22 Oct 2026) - [Next.js unauthenticated remote code execution in Image Optimization API](https://junglewise.ai/threats/next-js-unauthenticated-remote-code-execution-in-image-optimization-api-f1b22a87) (critical, CVSS 4, published 22 Oct 2026) - [CVE-2026-44578: Vercel Next.js SSRF via WebSocket upgrade requests](https://junglewise.ai/threats/cve-2026-44578-vercel-next-js-ssrf-via-websocket-upgrade-requests) (high, CVSS 8.6, published 13 May 2026) - [CVE-2026-44579: Vercel Next.js connection exhaustion in Cache Components](https://junglewise.ai/threats/cve-2026-44579-vercel-next-js-connection-exhaustion-in-cache-components) (high, CVSS 7.5, published 13 May 2026) - [CVE-2026-64641: Vercel Next.js denial of service in App Router Server Actions](https://junglewise.ai/threats/cve-2026-64641-vercel-next-js-denial-of-service-in-app-router-server-actions) (high, CVSS 4, published 27 Jul 2026) - [CVE-2026-64642: Vercel Next.js authentication bypass in Turbopack middleware matcher](https://junglewise.ai/threats/cve-2026-64642-vercel-next-js-authentication-bypass-in-turbopack-middleware) (high, CVSS 4, published 27 Jul 2026) - [CVE-2026-64649: Vercel Next.js SSRF in Server Actions on custom servers](https://junglewise.ai/threats/cve-2026-64649-vercel-next-js-ssrf-in-server-actions-on-custom-servers) (high, CVSS 4, published 27 Jul 2026) - [CVE-2026-64645: Vercel Next.js SSRF and Open Redirect in rewrites and redirects](https://junglewise.ai/threats/cve-2026-64645-vercel-next-js-ssrf-and-open-redirect-in-rewrites-and-redirects) (high, CVSS 4, published 27 Jul 2026) - [CVE-2026-94482: Next.js denial of service in App Router with Server Actions](https://junglewise.ai/threats/cve-2026-94482-next-js-denial-of-service-in-app-router-using-server-actions) (high, CVSS 4, published 22 Oct 2026) ## Vulnerabilities per week 3 vulnerabilities in the last four weeks, down 62% on the four before (8). 2 critical against 0. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 1 | 1 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 8 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 3 | 2 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other npm technologies - [openclaw (npm)](https://junglewise.ai/threats/technologies/npm-openclaw): 214 vulnerabilities - [flowise (npm)](https://junglewise.ai/threats/technologies/flowise): 133 vulnerabilities - [parse-server (npm)](https://junglewise.ai/threats/technologies/parse-server): 117 vulnerabilities - [vm2 (npm)](https://junglewise.ai/threats/technologies/vm2): 111 vulnerabilities - [electron (npm)](https://junglewise.ai/threats/technologies/electron): 77 vulnerabilities - [ghost (npm)](https://junglewise.ai/threats/technologies/ghost): 74 vulnerabilities - [n8n (npm)](https://junglewise.ai/threats/technologies/npm-n8n): 64 vulnerabilities - [hono (npm)](https://junglewise.ai/threats/technologies/hono): 62 vulnerabilities - [directus (npm)](https://junglewise.ai/threats/technologies/directus): 61 vulnerabilities - [nocodb (npm)](https://junglewise.ai/threats/technologies/nocodb): 54 vulnerabilities - [undici (npm)](https://junglewise.ai/threats/technologies/undici): 53 vulnerabilities - [@budibase/server (npm)](https://junglewise.ai/threats/technologies/budibase-server): 42 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "next (npm) vulnerabilities", https://junglewise.ai/threats/technologies/npm-next, 13 November 2026.