Data

Tools

Indexes

Applications

Experiments

Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

npm

next

npm

The React Framework

View on github.com · View on npmjs.org

Security Advisories for next in npm

Critical
22 days ago

Next.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays GSA_kwCzR0hTQS02NzNxLW1qbTYtcjV4cs4AB_Gs

npm next
Moderate
22 days ago

next.js cache leak across root param values in nested 'use cache' functions GSA_kwCzR0hTQS1oNjk0LTdjcDktbThwM84AB_GV

npm next
Critical
22 days ago

Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used GSA_kwCzR0hTQS0yNDY0LWZocjQtdzl4d84AB_GI

npm next
High
22 days ago

Next.js: Denial of Service in App Router using Server Actions GSA_kwCzR0hTQS1wM201LTU5bXAtanY1cs4AB_GG

npm next
Moderate
about 1 month ago

Next.js: Pending `use cache` fill can leak Draft Mode content into regular responses and persisted pages GSA_kwCzR0hTQS0zdzM3LXdxMjgtOTN4N84AB7_F

npm next
Moderate
about 1 month ago

Next.js has cache poisoning of SSG and ISR pages in self-hosted applications GSA_kwCzR0hTQS00anF2LW1jM3gtbTY3Ns4AB7_E

npm next
Low
about 1 month ago

Next.js has information disclosure in development server's Model Context Protocol endpoint GSA_kwCzR0hTQS0zOXcyLXJqbTUtY2hjds4AB7_D

npm next
Moderate
about 1 month ago

Next.js has information disclosure in App Router metadata image routes via dynamicParams bypass GSA_kwCzR0hTQS1mODdnLXh2OHItN3A3eM4AB7_C

npm next
Moderate
about 1 month ago

Next.js has cache poisoning in SSG/ISR rendering that leads to cross-user content substitution and persistent denial of service GSA_kwCzR0hTQS1tY2o4LXI5bXAtdzQ3cM4AB7_B

npm next
High
about 1 month ago

Next.js has Server-Side Request Forgery in Image Optimization GSA_kwCzR0hTQS1janE5LTYycTktOGp2NM4AB7_A

npm next
Critical
about 1 month ago

Next.js: Remote Code Execution in next/og ImageResponse GSA_kwCzR0hTQS12Y3ZyLXIzanYtcGM1as4AB7Kp

npm next
Critical
2 months ago

Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used GSA_kwCzR0hTQS0yeHA5LXZ3Zmgtdnh3NM4ABu8-

npm next
Critical
2 months ago

Next.js: Unauthenticated Remote Code Execution on windows-hosted servers GSA_kwCzR0hTQS1wMjkzLXF3M2gtanIzNs4ABu8q

npm next
High
4 months ago

Next.js: Server-Side Request Forgery in Server Actions on custom servers GSA_kwCzR0hTQS04OXh2LTJtNTYtMm05eM4ABfhu

npm next
Moderate
4 months ago

Next.js: Cache confusion of response bodies for requests with bodies GSA_kwCzR0hTQS02OGczLXY5MjctZjc0Ms4ABfht

npm next
Moderate
4 months ago

Next.js: Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences GSA_kwCzR0hTQS00NjMzLTNqNDktbWg1cc4ABfhs

npm next
Moderate
4 months ago

Next.js: Unbounded Server Action payload in Edge runtime GSA_kwCzR0hTQS00YzM5LTRjY2ctNjJyM84ABfhr

npm next
High
4 months ago

Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname GSA_kwCzR0hTQS1wOWoyLWd2OTQtMndmNM4ABfhq

npm next
Moderate
4 months ago

Next.js: Denial of Service in the Image Optimization API using SVGs GSA_kwCzR0hTQS1xOHdmLTZyOGctNjNjaM4ABfhp

npm next
Moderate
4 months ago

Next.js: Unauthenticated disclosure of internal Server Function endpoints GSA_kwCzR0hTQS05NTVwLXgzbXgtamN2cM4ABfho

npm next
High
4 months ago

Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale GSA_kwCzR0hTQS02Z3BwLXhjZzMtNHcyNM4ABfhn

npm next
High
4 months ago

Next.js: Denial of Service in App Router using Server Actions GSA_kwCzR0hTQS1tOTl3LXg3aHEtN3Zmas4ABfhm

npm next
High
6 months ago

Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Up GSA_kwCzR0hTQS0yNmhoLTdjcWYtaGhjNs4ABWkf

npm next
Low
6 months ago

Next.js's Middleware / Proxy redirects can be cache-poisoned GSA_kwCzR0hTQS0zZzhoLTg2dzktd3Ztcc4ABWkY

npm next
Moderate
6 months ago

Next.js vulnerable to cross-site scripting in App Router applications using CSP nonces GSA_kwCzR0hTQS1mZmhjLTVtY2YtcGY0cc4ABWkS

npm next
Low
6 months ago

Next.js vulnerable to cache poisoning via collisions in React Server Component cache-busting GSA_kwCzR0hTQS12ZnY2LTkyZmYtajk0Oc4ABWkR

npm next
Moderate
6 months ago

Next.js has cross-site scripting in beforeInteractive scripts with untrusted input GSA_kwCzR0hTQS1neDVwLWpnNjctNng3aM4ABWkQ

npm next
High
6 months ago

Next.js vulnerable to Denial of Service via connection exhaustion in applications using Cache Components GSA_kwCzR0hTQS1tZzY2LW1yaDktbThqeM4ABWkP

npm next
Moderate
6 months ago

Next.js has a Denial of Service in the Image Optimization API GSA_kwCzR0hTQS1oNjRmLTVoNWotanFqaM4ABWkO

npm next
High
6 months ago

Next.js vulnerable to server-side request forgery in applications using WebSocket upgrades GSA_kwCzR0hTQS1jNGo2LWZjN2otbTM0cs4ABWkN

npm next
Moderate
6 months ago

Next.js vulnerable to cache poisoning in React Server Component responses GSA_kwCzR0hTQS13ZmM2LXI1ODQtdmZ3N84ABWkL

npm next
High
6 months ago

Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes GSA_kwCzR0hTQS0yNjdjLTZncnItaDUzZs4ABWkK

npm next
High
6 months ago

Next.js has a Middleware / Proxy bypass through dynamic route parameter injection GSA_kwCzR0hTQS00OTJ2LWM2cHAtbXFxds4ABWkM

npm next
High
6 months ago

Next.js has a Middleware / Proxy bypass in Pages Router applications using i18n GSA_kwCzR0hTQS0zNnF4LWZyNGYtMjZnNc4ABWkJ

npm next
High
6 months ago

Next.js Vulnerable to Denial of Service with Server Components GSA_kwCzR0hTQS04aDhxLTY4NzMtcTVmas4ABWj8

npm next
High
7 months ago

Next.js has a Denial of Service with Server Components GSA_kwCzR0hTQS1xNGdmLThteDYtdjV2M84ABVFA

npm next
Moderate
8 months ago

Next.js: HTTP request smuggling in rewrites GSA_kwCzR0hTQS1nZ3YzLTdwNDctcGZ2OM4ABTwK

npm next
Moderate
8 months ago

Next.js: Unbounded next/image disk cache growth can exhaust storage GSA_kwCzR0hTQS0zeDRjLTd4cTYtOXBxOM4ABTwJ

npm next
Moderate
8 months ago

Next.js: Unbounded postponed resume buffering can lead to DoS GSA_kwCzR0hTQS1oMjd4LWc2dzQtMjRncc4ABTwI

npm next
Moderate
8 months ago

Next.js: null origin can bypass Server Actions CSRF checks GSA_kwCzR0hTQS1tcTU5LW0yNjkteHZjeM4ABTwB

npm next
Low
8 months ago

Next.js: null origin can bypass dev HMR websocket CSRF checks GSA_kwCzR0hTQS1qY2M3LTl3cG0tbWozNs4ABTwA

npm next
High
10 months ago

Next.js HTTP request deserialization can lead to DoS when using insecure React Server Components GSA_kwCzR0hTQS1oMjVtLTI2cWMtd2NqZs4ABRq_

npm next
Moderate
10 months ago

Next.js has Unbounded Memory Consumption via PPR Resume Endpoint GSA_kwCzR0hTQS01ZjdxLWpwcWMtd3A3aM4ABRqt

npm next
Moderate
10 months ago

Next.js self-hosted applications vulnerable to DoS via Image Optimizer remotePatterns configuration GSA_kwCzR0hTQS05ZzlwLTlndzktang3Zs4ABRon

npm next
High
11 months ago

Next has a Denial of Service with Server Components - Incomplete Fix Follow-Up GSA_kwCzR0hTQS01ajU5LXhnZzItcjljNM4ABPpW

npm next
Moderate
11 months ago

Next Server Actions Source Code Exposure GSA_kwCzR0hTQS13MzdtLTdmaHctZm12Oc4ABPmd

npm next
High
11 months ago

Next Vulnerable to Denial of Service with Server Components GSA_kwCzR0hTQS1td3Y2LTMyNTgtcTUyY84ABPmc

npm next
Critical
11 months ago

Next.js is vulnerable to RCE in React flight protocol GSA_kwCzR0hTQS05cXI5LWg1Z2YtMzRtcM4ABPJf

npm next
Moderate
about 1 year ago

Next.js Affected by Cache Key Confusion for Image Optimization API Routes GSA_kwCzR0hTQS1nNXFnLTcycXctZ3c1ds4ABLk_

npm next
Moderate
about 1 year ago

Next.js Content Injection Vulnerability for Image Optimization GSA_kwCzR0hTQS14djU3LTRtcjktd2c4ds4ABLk-

npm next
Moderate
about 1 year ago

Next.js Improper Middleware Redirect Handling Leads to SSRF GSA_kwCzR0hTQS00MzQyLXg3MjMtY2gyZs4ABLk9

npm next
High
over 1 year ago

Next.JS vulnerability can lead to DoS via cache poisoning GSA_kwCzR0hTQS02N3JyLTg0eG0tNGM3cs4ABJr3

npm next
Low
over 1 year ago

Next.js has a Cache poisoning vulnerability due to omission of the Vary header GSA_kwCzR0hTQS1yMmZjLWNjcjgtOTZjNM4ABJr2

npm next
Low
over 1 year ago

Information exposure in Next.js dev server due to lack of origin verification GSA_kwCzR0hTQS0zaDUyLTI2OXAtY3A5cs4ABIet

npm next
Low
over 1 year ago

Next.js Race Condition to Cache Poisoning GSA_kwCzR0hTQS1xcGp2LXY1OXgtM3FjNM4ABH4w

npm next
Low
over 1 year ago

Next.js may leak x-middleware-subrequest-id to external hosts GSA_kwCzR0hTQS0yMjNqLTRybTgtbXJtZs4ABGV7

npm next
Critical
over 1 year ago

Authorization Bypass in Next.js Middleware GSA_kwCzR0hTQS1mODJ2LWp3cjUtbWZmd84ABFxH

npm next
Moderate
almost 2 years ago

Next.js Allows a Denial of Service (DoS) with Server Actions GSA_kwCzR0hTQS03bTI3LTdnaGMtNDR3Oc4ABC8r

npm next
High
almost 2 years ago

Next.js authorization bypass vulnerability GSA_kwCzR0hTQS03Z2ZjLThjcTgtamg1Zs4ABChV

npm next
Moderate
about 2 years ago

Denial of Service condition in Next.js image optimization GSA_kwCzR0hTQS1nNzd4LTQ0eHgtNTMybc4ABAQO

npm next
High
about 2 years ago

Next.js Cache Poisoning GSA_kwCzR0hTQS1ncDhmLThtM2ctcXZqOc4AA_nS

npm next
High
over 2 years ago

Next.js Denial of Service (DoS) condition GSA_kwCzR0hTQS1mcTU0LTJqNTItamM0Ms4AA9w6

npm next
High
over 2 years ago

Next.js Server-Side Request Forgery in Server Actions GSA_kwCzR0hTQS1mcjVoLXJxcDgtbWo2Z84AA74P

npm next
High
over 2 years ago

Next.js Vulnerable to HTTP Request Smuggling GSA_kwCzR0hTQS03N3I1LWd3M2otMm1wZs4AA74O

npm next
Low
about 3 years ago

Next.js missing cache-control header may lead to CDN caching empty reply GSA_kwCzR0hTQS1jNTloLXI2cDgtcTl3Y84AA2m9

npm next
Moderate
about 4 years ago

Unexpected server crash in Next.js GSA_kwCzR0hTQS13ZmY0LWZwd2ctcXF2M84AAui2

npm next
Moderate
over 4 years ago

Improper CSP in Image Optimization API for Next.js versions between 10.0.0 and 12.1.0 GSA_kwCzR0hTQS1mbXZtLXg4bXYtNDdtas0s0Q

npm next
Moderate
almost 5 years ago

Denial of Service Vulnerability in next.js GSA_kwCzR0hTQS13cjY2LXZyd20tNWc1eM0nOg

npm next
High
almost 5 years ago

Unexpected server crash in Next.js. GSA_kwCzR0hTQS0yNW1wLWc2ZnYtbXF4eM0ZPg

npm next
High
about 5 years ago

XSS in Image Optimization API for Next.js MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTlncjMtNzg5Ny1wcDdt

npm next
Moderate
over 5 years ago

Open Redirect in Next.js MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXZ4ZjUtd3h3cC1tN2c5

npm next
Moderate
about 6 years ago

Open Redirect in Next.js versions MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXg1NnAtYzhjZy1xNDM1

npm next
High
about 6 years ago

Remote Code Execution in next MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTV2ajgtM3YyaC1oMzh2

npm next
Moderate
over 6 years ago

Directory Traversal in Next.js MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWZxNzctN3A3ci04M3Jq

npm next
Moderate
about 8 years ago

Next.js has cross site scripting (XSS) vulnerability via the 404 or 500 /_error page MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXF3OTYtbW0yZy1jOG03

npm next
High
almost 9 years ago

Directory traversal vulnerability in Next.js MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLW0zNHgtd2dyaC1nODk3

npm next
High
almost 9 years ago

Next.js Directory Traversal Vulnerability MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTNmNWMtNHF4ai12bXBm

npm next

Match affected ranges for this package. Potential advisories inferred from related packages are excluded.

Filter by Severity

Moderate 33 High 28 Low 9 Critical 7