next vulnerabilities
The React Framework
- Registry
- npm
- Latest
- 16.4.3
- License
- MIT
77 known advisories
The latest version, 16.4.3, is not affected by any of them. Projects on older versions may be.
npm install next@16.4.3Security advisories for next
Next.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays
- Affected
- >=16.0.0 <16.4.1
- Fixed in
- 16.4.1
next.js cache leak across root param values in nested 'use cache' functions
- Affected
- >=16.3.0 <16.3.8
- Fixed in
- 16.3.8
Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used
- Affected
- >=10.0.0 <15.5.28 · >=16.0.0 <16.4.1
- Fixed in
- 15.5.28, 16.4.1
Next.js: Denial of Service in App Router using Server Actions
- Affected
- >=13.0.0 <15.5.28 · >=16.0.0 <16.4.1
- Fixed in
- 15.5.28, 16.4.1
Next.js: Pending `use cache` fill can leak Draft Mode content into regular responses and persisted pages
- Affected
- >=16.3.0 <16.3.8
- Fixed in
- 16.3.8
Next.js has cache poisoning of SSG and ISR pages in self-hosted applications
- Affected
- >=15.0.0 <15.5.27 · >=16.0.0 <16.3.8
- Fixed in
- 15.5.27, 16.3.8
Next.js has information disclosure in development server's Model Context Protocol endpoint
- Affected
- >=16.0.0 <16.3.8
- Fixed in
- 16.3.8
Next.js has information disclosure in App Router metadata image routes via dynamicParams bypass
- Affected
- >=16.0.0 <16.3.8
- Fixed in
- 16.3.8
Next.js has cache poisoning in SSG/ISR rendering that leads to cross-user content substitution and persistent denial of service
- Affected
- >=16.0.0 <16.3.8 · >=15.0.0 <15.5.27
- Fixed in
- 15.5.27, 16.3.8
Next.js has Server-Side Request Forgery in Image Optimization
- Affected
- >=16.0.0 <16.3.8
- Fixed in
- 16.3.8
Next.js: Remote Code Execution in next/og ImageResponse
- Affected
- >=16.2.0 <16.3.6
- Fixed in
- 16.3.6
Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used
- Affected
- >=10.0.0 <15.5.24 · >=16.0.0 <16.3.3
- Fixed in
- 15.5.24, 16.3.3
Next.js: Unauthenticated Remote Code Execution on windows-hosted servers
- Affected
- >=13.4.0 <15.5.24 · >=16.0.0 <16.3.3
- Fixed in
- 15.5.24, 16.3.3
Next.js: Server-Side Request Forgery in Server Actions on custom servers
- Affected
- >=14.1.1 <15.5.21 · >=16.0.0 <16.2.11
- Fixed in
- 15.5.21, 16.2.11
Next.js: Cache confusion of response bodies for requests with bodies
- Affected
- >=13.0.0 <15.5.21 · >=16.0.0 <16.2.11
- Fixed in
- 15.5.21, 16.2.11
Next.js: Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences
- Affected
- >=13.0.0 <15.5.21 · >=16.0.0 <16.2.11
- Fixed in
- 15.5.21, 16.2.11
Next.js: Unbounded Server Action payload in Edge runtime
- Affected
- >=13.0.0 <15.5.21 · >=16.0.0 <16.2.11
- Fixed in
- 15.5.21, 16.2.11
Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname
- Affected
- >=12.0.0 <15.5.21 · >=16.0.0 <16.2.11
- Fixed in
- 15.5.21, 16.2.11
Next.js: Denial of Service in the Image Optimization API using SVGs
- Affected
- >=15.5.0 <15.5.21 · >=16.0.0 <16.2.11
- Fixed in
- 15.5.21, 16.2.11
Next.js: Unauthenticated disclosure of internal Server Function endpoints
- Affected
- >=13.0.0 <15.5.21 · >=16.0.0 <16.2.11
- Fixed in
- 15.5.21, 16.2.11
Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale
- Affected
- >=16.0.0 <16.2.11
- Fixed in
- 16.2.11
Next.js: Denial of Service in App Router using Server Actions
- Affected
- >=13.0.0 <15.5.21 · >=16.0.0 <16.2.11
- Fixed in
- 15.5.21, 16.2.11
Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Up
- Affected
- >=15.2.0 <15.5.18 · >=16.0.0 <16.2.6
- Fixed in
- 15.5.18, 16.2.6
Next.js's Middleware / Proxy redirects can be cache-poisoned
- Affected
- >=12.2.0 <15.5.16 · >=16.0.0 <16.2.5
- Fixed in
- 15.5.16, 16.2.5
Next.js vulnerable to cross-site scripting in App Router applications using CSP nonces
- Affected
- >=13.4.0 <15.5.16 · >=16.0.0 <16.2.5
- Fixed in
- 15.5.16, 16.2.5
Next.js vulnerable to cache poisoning via collisions in React Server Component cache-busting
- Affected
- >=13.4.6 <15.5.16 · >=16.0.0 <16.2.5
- Fixed in
- 15.5.16, 16.2.5
Next.js has cross-site scripting in beforeInteractive scripts with untrusted input
- Affected
- >=13.0.0 <15.5.16 · >=16.0.0 <16.2.5
- Fixed in
- 15.5.16, 16.2.5
Next.js vulnerable to Denial of Service via connection exhaustion in applications using Cache Components
- Affected
- >=15.0.0 <15.5.16 · >=16.0.0 <16.2.5
- Fixed in
- 15.5.16, 16.2.5
Next.js has a Denial of Service in the Image Optimization API
- Affected
- >=10.0.0 <15.5.16 · >=16.0.0 <16.2.5
- Fixed in
- 15.5.16, 16.2.5
Next.js vulnerable to server-side request forgery in applications using WebSocket upgrades
- Affected
- >=13.4.13 <15.5.16 · >=16.0.0 <16.2.5
- Fixed in
- 15.5.16, 16.2.5
Next.js vulnerable to cache poisoning in React Server Component responses
- Affected
- >=14.2.0 <15.5.16 · >=16.0.0 <16.2.5
- Fixed in
- 15.5.16, 16.2.5
Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes
- Affected
- >=15.2.0 <15.5.16 · >=16.0.0 <16.2.5
- Fixed in
- 15.5.16, 16.2.5
Next.js has a Middleware / Proxy bypass through dynamic route parameter injection
- Affected
- >=15.4.0 <15.5.16 · >=16.0.0 <16.2.5
- Fixed in
- 15.5.16, 16.2.5
Next.js has a Middleware / Proxy bypass in Pages Router applications using i18n
- Affected
- >=12.2.0 <15.5.16 · >=16.0.0 <16.2.5
- Fixed in
- 15.5.16, 16.2.5
Next.js Vulnerable to Denial of Service with Server Components
- Affected
- >=13.0.0 <15.5.16 · >=16.0.0 <16.2.5
- Fixed in
- 15.5.16, 16.2.5
Next.js has a Denial of Service with Server Components
- Affected
- >=13.0.0 <15.5.15 · >=16.0.0-beta.0 <16.2.3
- Fixed in
- 15.5.15, 16.2.3
Next.js: HTTP request smuggling in rewrites
- Affected
- >=16.0.0-beta.0 <16.1.7 · >=9.5.0 <15.5.13
- Fixed in
- 15.5.13, 16.1.7
Next.js: Unbounded next/image disk cache growth can exhaust storage
- Affected
- >=16.0.0-beta.0 <16.1.7 · >=10.0.0 <15.5.14
- Fixed in
- 15.5.14, 16.1.7
Next.js: Unbounded postponed resume buffering can lead to DoS
- Affected
- >=16.0.1 <16.1.7
- Fixed in
- 16.1.7
Next.js: null origin can bypass Server Actions CSRF checks
- Affected
- >=16.0.1 <16.1.7
- Fixed in
- 16.1.7
Next.js: null origin can bypass dev HMR websocket CSRF checks
- Affected
- >=16.0.1 <16.1.7
- Fixed in
- 16.1.7
Next.js HTTP request deserialization can lead to DoS when using insecure React Server Components
- Affected
- >=13.0.0 <15.0.8 · >=15.1.1-canary.0 <15.1.12 · >=15.2.0-canary.0 <15.2.9 · >=15.3.0-canary.0 <15.3.9 · >=15.4.0-canary.0 <15.4.11 · >=15.5.1-canary.0 <15.5.10 · >=15.6.0-canary.0 <15.6.0-canary.61 · >=16.0.0-beta.0 <16.0.11 · >=16.1.0-canary.0 <16.1.5
- Fixed in
- 15.0.8, 15.1.12, 15.2.9, 15.3.9, 15.4.11, 15.5.10, 15.6.0-canary.61, 16.0.11, 16.1.5
Next.js has Unbounded Memory Consumption via PPR Resume Endpoint
- Affected
- >=16.0.0-beta.0 <16.1.5 · >=15.0.0-canary.0 <=15.0.0-canary.205 · >=15.0.1-canary.0 <=15.0.1-canary.3 · >=15.0.2-canary.0 <=15.0.2-canary.11 · >=15.0.3-canary.0 <=15.0.3-canary.9 · >=15.0.4-canary.0 <=15.0.4-canary.52 · >=15.1.1-canary.0 <=15.1.1-canary.27 · >=15.2.0-canary.0 <=15.2.0-canary.77 · >=15.2.1-canary.0 <=15.2.1-canary.6 · >=15.2.2-canary.0 <=15.2.2-canary.7 · >=15.3.0-canary.0 <=15.3.0-canary.46 · >=15.3.1-canary.0 <=15.3.1-canary.15 · >=15.4.0-canary.0 <=15.4.0-canary.130 · >=15.4.2-canary.0 <=15.4.2-canary.56 · >=15.5.1-canary.0 <=15.5.1-canary.39 · >=15.6.0-canary.0 <15.6.0-canary.61
- Fixed in
- 15.6.0-canary.61, 16.1.5
Next.js self-hosted applications vulnerable to DoS via Image Optimizer remotePatterns configuration
- Affected
- >=10.0.0 <15.5.10 · >=15.6.0-canary.0 <16.1.5
- Fixed in
- 15.5.10, 16.1.5
Next has a Denial of Service with Server Components - Incomplete Fix Follow-Up
- Affected
- >=13.3.1-canary.0 <14.2.35 · >=15.0.6 <15.0.7 · >=15.1.10 <15.1.11 · >=15.2.7 <15.2.8 · >=15.3.7 <15.3.8 · >=15.4.9 <15.4.10 · >=15.5.8 <15.5.9 · >=15.6.0-canary.59 <15.6.0-canary.60 · >=16.0.9 <16.0.10 · >=16.1.0-canary.17 <16.1.0-canary.19
- Fixed in
- 14.2.35, 15.0.7, 15.1.11, 15.2.8, 15.3.8, 15.4.10, 15.5.9, 15.6.0-canary.60, 16.0.10, 16.1.0-canary.19
Next Server Actions Source Code Exposure
- Affected
- >=15.0.0-canary.0 <15.0.6 · >=15.1.1-canary.0 <15.1.10 · >=15.2.0-canary.0 <15.2.7 · >=15.3.0-canary.0 <15.3.7 · >=15.4.0-canary.0 <15.4.9 · >=15.5.1-canary.0 <15.5.8 · >=15.6.0-canary.0 <15.6.0-canary.59 · >=16.0.0-beta.0 <16.0.9 · >=16.1.0-canary.0 <16.1.0-canary.17
- Fixed in
- 15.0.6, 15.1.10, 15.2.7, 15.3.7, 15.4.9, 15.5.8, 15.6.0-canary.59, 16.0.9, 16.1.0-canary.17
Next Vulnerable to Denial of Service with Server Components
- Affected
- >=13.3.0 <14.2.34 · >=15.0.0-canary.0 <15.0.6 · >=15.1.1-canary.0 <15.1.10 · >=15.2.0-canary.0 <15.2.7 · >=15.3.0-canary.0 <15.3.7 · >=15.4.0-canary.0 <15.4.9 · >=15.5.1-canary.0 <15.5.8 · >=15.6.0-canary.0 <15.6.0-canary.59 · >=16.0.0-beta.0 <16.0.9 · >=16.1.0-canary.0 <16.1.0-canary.17
- Fixed in
- 14.2.34, 15.0.6, 15.1.10, 15.2.7, 15.3.7, 15.4.9, 15.5.8, 15.6.0-canary.59, 16.0.9, 16.1.0-canary.17
Next.js is vulnerable to RCE in React flight protocol
- Affected
- >=14.3.0-canary.77 <15.0.5 · >=15.1.0-canary.0 <15.1.9 · >=15.2.0-canary.0 <15.2.6 · >=15.3.0-canary.0 <15.3.6 · >=15.4.0-canary.0 <15.4.8 · >=15.5.0-canary.0 <15.5.7 · >=16.0.0-canary.0 <16.0.7
- Fixed in
- 15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7, 16.0.7
Next.js Affected by Cache Key Confusion for Image Optimization API Routes
- Affected
- >=0.9.9 <14.2.31 · >=15.0.0 <15.4.5
- Fixed in
- 14.2.31, 15.4.5
Next.js Content Injection Vulnerability for Image Optimization
- Affected
- >=0.9.9 <14.2.31 · >=15.0.0 <15.4.5
- Fixed in
- 14.2.31, 15.4.5
Next.js Improper Middleware Redirect Handling Leads to SSRF
- Affected
- >=0.9.9 <14.2.32 · >=15.0.0-canary.0 <15.4.7
- Fixed in
- 14.2.32, 15.4.7
Next.JS vulnerability can lead to DoS via cache poisoning
- Affected
- >=15.0.4-canary.51 <15.1.8
- Fixed in
- 15.1.8
Next.js has a Cache poisoning vulnerability due to omission of the Vary header
- Affected
- >=15.3.0 <15.3.3
- Fixed in
- 15.3.3
Information exposure in Next.js dev server due to lack of origin verification
- Affected
- >=15.0.0 <15.2.2 · >=13.0 <14.2.30
- Fixed in
- 14.2.30, 15.2.2
Next.js Race Condition to Cache Poisoning
- Affected
- >=0.9.9 <14.2.24 · >=15.0.0 <15.1.6
- Fixed in
- 14.2.24, 15.1.6
Next.js may leak x-middleware-subrequest-id to external hosts
- Affected
- >=12.3.5 <12.3.6 · >=13.5.9 <13.5.10 · >=14.2.25 <14.2.26 · >=15.2.3 <15.2.4
- Fixed in
- 12.3.6, 13.5.10, 14.2.26, 15.2.4
Authorization Bypass in Next.js Middleware
- Affected
- >=13.0.0 <13.5.9 · >=14.0.0 <14.2.25 · >=15.0.0 <15.2.3 · >=12.0.0 <12.3.5
- Fixed in
- 12.3.5, 13.5.9, 14.2.25, 15.2.3
Next.js Allows a Denial of Service (DoS) with Server Actions
- Affected
- >=13.0.0 <13.5.8 · >=14.0.0 <14.2.21 · >=15.0.0 <15.1.2
- Fixed in
- 13.5.8, 14.2.21, 15.1.2
Next.js authorization bypass vulnerability
- Affected
- >=9.5.5 <14.2.15
- Fixed in
- 14.2.15
Denial of Service condition in Next.js image optimization
- Affected
- >=10.0.0 <14.2.7
- Fixed in
- 14.2.7
Next.js Cache Poisoning
- Affected
- >=13.5.1 <13.5.7 · >=14.0.0 <14.2.10
- Fixed in
- 13.5.7, 14.2.10
Next.js Denial of Service (DoS) condition
- Affected
- >=13.3.1 <13.5.0
- Fixed in
- 13.5.0
Next.js Server-Side Request Forgery in Server Actions
- Affected
- >=13.4.0 <14.1.1
- Fixed in
- 14.1.1
Next.js Vulnerable to HTTP Request Smuggling
- Affected
- >=13.4.0 <13.5.1
- Fixed in
- 13.5.1
Next.js missing cache-control header may lead to CDN caching empty reply
- Affected
- >=0.9.9 <13.4.20-canary.13
- Fixed in
- 13.4.20-canary.13
Unexpected server crash in Next.js
- Affected
- >=12.2.3 <12.2.4
- Fixed in
- 12.2.4
Improper CSP in Image Optimization API for Next.js versions between 10.0.0 and 12.1.0
- Affected
- >=10.0.0 <12.1.0
- Fixed in
- 12.1.0
Denial of Service Vulnerability in next.js
- Affected
- >=12.0.0 <12.0.9
- Fixed in
- 12.0.9
Unexpected server crash in Next.js.
- Affected
- >=12.0.0 <12.0.5 · >=0.9.9 <11.1.3
- Fixed in
- 11.1.3, 12.0.5
XSS in Image Optimization API for Next.js
- Affected
- >=10.0.0 <11.1.1
- Fixed in
- 11.1.1
Open Redirect in Next.js
- Affected
- >=0.9.9 <11.1.0
- Fixed in
- 11.1.0
Open Redirect in Next.js versions
- Affected
- >=9.5.0 <9.5.4
- Fixed in
- 9.5.4
Remote Code Execution in next
- Affected
- >=0.9.9 <5.1.0
- Fixed in
- 5.1.0
Directory Traversal in Next.js
- Affected
- >=0.9.9 <9.3.2
- Fixed in
- 9.3.2
Next.js has cross site scripting (XSS) vulnerability via the 404 or 500 /_error page
- Affected
- >=7.0.0 <7.0.2
- Fixed in
- 7.0.2
Directory traversal vulnerability in Next.js
- Affected
- >=1.0.0 <4.2.3
- Fixed in
- 4.2.3
Next.js Directory Traversal Vulnerability
- Affected
- >=1.0.0 <2.4.1
- Fixed in
- 2.4.1
Which of your client projects still run an old next?
NPMscan reads the package-lock.json, yarn.lock and pnpm-lock.yaml in every GitHub repo you pick and checks each installed version against these advisories, including the packages your packages pull in. Each finding comes with the command that fixes it.
Other npm packages
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily. Package details from the npm registry.