Next.js vulnerabilities

Next.js before 2.4.1 has a directory traversal vulnerability in the /_next and /static request namespace, allowing attackers to obtain sensitive information.

Next.js versions from 13.4.13 to before 15.5.16 and 16.2.5 are vulnerable to server-side request forgery (SSRF) via crafted WebSocket upgrade requests. An attacker can force the server to proxy requests to arbitrary internal or external destinations, potentially exposing internal services or cloud metadata endpoints.

In Next.js, when a Server Action forwards or redirects a request, an attacker can cause the server to send that outbound request to a malicious host (SSRF). In some configurations, it's also possible to obtain internal values that weaken middleware/proxy authorization.

Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a server-side fetch with a request body may return a cached response body from a different request to the same URL but different body. Confidential data in the POST's response body would then leak to unauthorized requests. This issue has been fixed in versions 15.5.21 and 16.2.11.

In Next.js versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a server-side fetch with a request body may return a cached response body from a different request to the same URL but different body. This leads to leakage of confidential POST response data to unauthorized requests. The issue only occurs with request bodies using a charset other than UTF-8.

In Next.js versions 13.0.0 through 15.5.20 and 16.0.0 through 16.2.10, requests targeting applications using App Router with at least one Server Action can lead to excessive memory consumption if that Server Action uses the Edge runtime.

Next.js versions 12.0.0-15.5.20 and 16.0.0-16.2.10 have a vulnerability in rewrites()/redirects() rules with external hostnames from requests. Attackers can point requests to arbitrary hosts, causing SSRF (rewrite) or Open Redirect (redirect).

In Next.js versions 15.5.0 through 15.5.20 and 16.0.0 through 16.2.10, when self-hosting with the default image loader, the Image Optimization API can optimize remotely hosted images if configured (not enabled by default). If those images contain malicious content, they can cause CPU exhaustion in /_next/image endpoints. Only config.images.remotePatterns is affected.

In Next.js versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, applications using App Router and Server Actions can disclose Server Action IDs to unauthenticated users via publicly served client artifacts. This disclosure is typically a recon primitive but increases risk when combined with other weaknesses.

Next.js versions 16.0.0-16.2.10 have a vulnerability in applications using App Router with Turbopack and a single entry in config.i18n.locales. Crafted requests can bypass middleware/proxy-based authentication.

Next.js versions 13.0.0-15.5.20 and 16.0.0-16.2.10 have a vulnerability in applications using App Router with at least one Server Action. Crafted requests can cause excessive CPU usage, blocking further request processing.

A vulnerability in Next.js involves incomplete application of the fix for CVE-2026-44575 in middleware.ts when using Turbopack. It affects versions from 15.2.0 to before 15.5.18 and 16.2.6.

Next.js, a React framework for building full-stack web applications, is vulnerable to connection exhaustion via crafted POST requests to a server action. This affects applications using Partial Prerendering through the Cache Components feature, where a malicious request can cause a request-body handling deadlock, leaving connections open for an extended period.

Next.js versions from 10.0.0 to before 15.5.16 and 16.2.5, when self-hosted with the default image loader, do not enforce a maximum size limit for local assets fetched by the Image Optimization API. An attacker can request large files via the /_next/image endpoint, causing out-of-memory conditions.

A vulnerability in Next.js from version 15.2.0 to 15.5.16 and 16.2.5 allows bypassing authorization checks in applications using App Router. Specially crafted .rsc and segment-prefetch requests can reach protected pages without passing through middleware rules.

Next.js versions from 15.4.0 to 15.5.15 and 16.2.0 to 16.2.4 contain a vulnerability that allows authorization bypass in applications using middleware to protect dynamic routes. Specially crafted query parameters can alter the dynamic route value seen by the page while leaving the visible path unchanged, enabling protected content to be rendered without passing the expected middleware check.

A vulnerability in Next.js allows unauthorized access to SSR data of protected pages by bypassing middleware. It affects versions from 12.2.0 to before 15.5.16 and 16.2.5 with i18n and middleware-based authorization configured.