next.js
v16.4.6The React Framework
- Maintenance
- Active2074 commits in 3 months · bus factor 8
- License
- MITPermissive · OSI-approved
- Security
- 30 advisories5 critical, 7 high, 17 medium, 1 low · Scorecard 6.2/10
- Supported versions
- 2 lines supportednewest 16 · oldest 15 until Jan 31, 2027 · 6 ended
144k stars · 32.8k forks · 4k open issues · last release 5 days ago · data checked 1 hour ago
Security advisories
All advisories on GitHubThe 30 most recent advisories published by the maintainers: 5 critical, 7 high, 17 medium, 1 low. Check the patched version against the one you run.
- mediumCVE-2026-119346Nov 3, 2026HttpOnly cookie exposure through internal response header on Next.js Edge runtime routes
- Affected
- >= 16.0.0, <= 16.4.4; >= 15.0.0, <= 15.5.28
- Patched in
- 16.4.5; 15.5.29
- mediumCVE-2026-119347Nov 3, 2026SVG rejection bypass in Next.js image optimization
- Affected
- >= 16.0.0, <= 16.4.4; >= 15.0.0, <= 15.5.28
- Patched in
- 16.4.5; 15.5.29
- mediumCVE-2026-119348Nov 3, 2026Cross-client response injection and disclosure in self-hosted Next.js applications forwarding fetched responses
- Affected
- >= 16.0.0, <= 16.4.4; <= 15.5.28
- Patched in
- 16.4.5; 15.5.29
- mediumCVE-2026-119349Nov 3, 2026Cross-user cache disclosure and poisoning in Next.js use cache with binary arguments
- Affected
- >= 16.0.0, <= 16.4.4
- Patched in
- 16.4.5
- mediumCVE-2026-119350Nov 3, 2026Cache poisoning of shared fallback shells in Cache Components via request-supplied placeholder route params
- Affected
- >= 16.4.0, <= 16.4.4
- Patched in
- 16.4.5
- mediumCVE-2026-119351Nov 3, 2026Cache leak across root param values in nested 'use cache' functions via delayed inner stream metadata
- Affected
- >= 16.2.0, <= 16.4.4
- Patched in
- 16.4.5
- mediumCVE-2026-119790Nov 3, 2026Information disclosure across root params in Next.js when a 'use cache' function is called through unstable_cache()
- Affected
- >= 16.3.0, <= 16.4.4
- Patched in
- 16.4.5
- highGHSA-p3m5-59mp-jv5rOct 14, 2026Denial of Service in App Router using Server Actions
- Affected
- >=13.0.0 <= 15.5.27; >= 16.0.0 <= 16.4.0
- Patched in
- 15.5.28; 16.4.1
- criticalGHSA-673q-mjm6-r5xrOct 14, 2026Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays
- Affected
- >=16.0.0 <= 16.4.0
- Patched in
- 16.4.1
- criticalCVE-2026-96889Oct 14, 2026Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used
- Affected
- >= 10.0.0 <= 15.5.27; > 16.0.0 <= 16.4.0
- Patched in
- 15.5.28; 16.4.1
- highCVE-2026-94483Sep 30, 2026Server-Side Request Forgery in Image Optimization
- Affected
- >= 16.0.0 < 16.3.?
- Patched in
- 16.3.?
- mediumCVE-2026-94485Sep 30, 2026Information disclosure in Next.js App Router metadata image routes via dynamicParams bypass
- Affected
- >= 16.0.0
- Patched in
- 16.3.?
- mediumCVE-2026-94544Sep 30, 2026Pending `use cache` fill can leak Draft Mode content into regular responses and persisted pages
- Affected
- 16.3.0
- Patched in
- 16.3.?
- mediumCVE-2026-103004Sep 30, 2026Cache leak across root param values in nested 'use cache' functions
- Affected
- 16.3.0
- Patched in
- 16.3.8
- mediumCVE-2026-94543Sep 30, 2026Cache poisoning of SSG and ISR pages in self-hosted Next.js applications
- Affected
- >= 15.0.0; >= 16.0.0
- Patched in
- 15.5.?; 16.3.?
- mediumCVE-2026-94484Sep 30, 2026Cache poisoning in Next.js SSG/ISR rendering leads to cross-user content substitution and persistent denial of service
- Affected
- >= 16.0.0; >= 15.0.0
- Patched in
- 16.3.?; 15.5.?
- lowCVE-2026-94486Sep 30, 2026Information disclosure in the Next.js development server's Model Context Protocol endpoint
- Affected
- >= 16.0.0
- Patched in
- 16.3.?
- criticalCVE-2026-94545Sep 22, 2026Remote Code Execution in next/og ImageResponse
- Affected
- >= 16.2.0 < 16.3.6
- Patched in
- 16.3.6
- criticalGHSA-2xp9-vwfh-vxw4Aug 25, 2026Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used
- Affected
- >= 10.0.0 < 15.5.24; < 16.3.3
- Patched in
- 15.5.24; 16.3.3
- criticalCVE-2026-75604Aug 25, 2026Unauthenticated Remote Code Execution on windows-hosted servers
- Affected
- >= 13.4 < 15.5.24; >= 16.0 < 16.3.3
- Patched in
- 15.5.24; 16.3.3
- highCVE-2026-64649Jul 21, 2026Server-Side Request Forgery in Server Actions on custom servers
- Affected
- >= 14.1.1 < 15.5.21; >= 16.0.0 < 16.2.11
- Patched in
- 15.5.21; 16.2.11
- mediumCVE-2026-64647Jul 21, 2026Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences
- Affected
- >=13.0.0 < 15.5.21; >= 16.0.0 < 16.2.11
- Patched in
- 15.5.21; 16.2.11
- mediumCVE-2026-64648Jul 21, 2026Cache confusion of response bodies for requests with bodies
- Affected
- >=13.0.0 < 15.5.21; >= 16.0.0 < 16.2.11
- Patched in
- 15.5.21; 16.2.11
- mediumCVE-2026-64646Jul 21, 2026Unbounded Server Action payload in Edge runtime
- Affected
- >=13.0.0 < 15.5.21; >= 16.0.0 < 16.2.11
- Patched in
- 15.5.21; 16.2.11
- mediumCVE-2026-64644Jul 21, 2026Denial of Service in the Image Optimization API using SVGs
- Affected
- >=15.5.0 < 15.5.21; >= 16.0.0 < 16.2.11
- Patched in
- 15.5.21; 16.2.11
- highCVE-2026-64645Jul 21, 2026Server-Side Request Forgery in rewrites via attacker-controlled destination hostname
- Affected
- >= 12.0.0 < 15.5.21; >= 16.0.0 < 16.2.11
- Patched in
- 15.5.21; 16.2.11
- mediumCVE-2026-64643Jul 21, 2026Unauthenticated disclosure of internal Server Function endpoints
- Affected
- >= 13.0.0 < 15.5.21; >= 16.0.0 < 16.2.11
- Patched in
- 15.5.21; 16.2.11
- highCVE-2026-64642Jul 21, 2026Middleware / Proxy bypass in App Router applications using Turbopack and single locale
- Affected
- >= 16.0.0 < 16.2.11
- Patched in
- 16.2.11
- highCVE-2026-64641Jul 21, 2026Denial of Service in App Router using Server Actions
- Affected
- >=13.0.0 < 15.5.21; >= 16.0.0 < 16.2.11
- Patched in
- 15.5.21; 16.2.11
- highCVE-2026-45109May 7, 2026Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Up
- Affected
- >= 15.2.0 < 15.5.18; >= 16.0.0 < 16.2.6
- Patched in
- 15.5.18; 16.2.6