Is next 13.0 vulnerable?
npm · 8 releases from 13.0.0 to 13.0.7 · latest next is 16.4.4 · checked 2 Nov 2026
Yes: 29 known advisories
Yes. next 13.0.7, the last 13.0 release, is affected by 29 known security advisories (3 critical, 8 high, 14 medium, 4 low), including CVE-2025-29927, CVE-2026-94482, CVE-2026-64645. Upgrade to 15.5.28 or later to fix all of them.
npm install next@15.5.28Advisories affecting next 13.0.7
Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used
- Affected
- >=10.0.0 <15.5.28 · >=16.0.0 <16.4.1
- Fixed in
- 15.5.28, 16.4.1
Next.js: Denial of Service in App Router using Server Actions
- Affected
- >=13.0.0 <15.5.28 · >=16.0.0 <16.4.1
- Fixed in
- 15.5.28, 16.4.1
Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used
- Affected
- >=10.0.0 <15.5.24 · >=16.0.0 <16.3.3
- Fixed in
- 15.5.24, 16.3.3
Next.js: Cache confusion of response bodies for requests with bodies
- Affected
- >=13.0.0 <15.5.21 · >=16.0.0 <16.2.11
- Fixed in
- 15.5.21, 16.2.11
Next.js: Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences
- Affected
- >=13.0.0 <15.5.21 · >=16.0.0 <16.2.11
- Fixed in
- 15.5.21, 16.2.11
Next.js: Unbounded Server Action payload in Edge runtime
- Affected
- >=13.0.0 <15.5.21 · >=16.0.0 <16.2.11
- Fixed in
- 15.5.21, 16.2.11
Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname
- Affected
- >=12.0.0 <15.5.21 · >=16.0.0 <16.2.11
- Fixed in
- 15.5.21, 16.2.11
Next.js: Unauthenticated disclosure of internal Server Function endpoints
- Affected
- >=13.0.0 <15.5.21 · >=16.0.0 <16.2.11
- Fixed in
- 15.5.21, 16.2.11
Next.js: Denial of Service in App Router using Server Actions
- Affected
- >=13.0.0 <15.5.21 · >=16.0.0 <16.2.11
- Fixed in
- 15.5.21, 16.2.11
Next.js's Middleware / Proxy redirects can be cache-poisoned
- Affected
- >=12.2.0 <15.5.16 · >=16.0.0 <16.2.5
- Fixed in
- 15.5.16, 16.2.5
Next.js has cross-site scripting in beforeInteractive scripts with untrusted input
- Affected
- >=13.0.0 <15.5.16 · >=16.0.0 <16.2.5
- Fixed in
- 15.5.16, 16.2.5
Next.js has a Denial of Service in the Image Optimization API
- Affected
- >=10.0.0 <15.5.16 · >=16.0.0 <16.2.5
- Fixed in
- 15.5.16, 16.2.5
Next.js has a Middleware / Proxy bypass in Pages Router applications using i18n
- Affected
- >=12.2.0 <15.5.16 · >=16.0.0 <16.2.5
- Fixed in
- 15.5.16, 16.2.5
Next.js Vulnerable to Denial of Service with Server Components
- Affected
- >=13.0.0 <15.5.16 · >=16.0.0 <16.2.5
- Fixed in
- 15.5.16, 16.2.5
Next.js has a Denial of Service with Server Components
- Affected
- >=13.0.0 <15.5.15 · >=16.0.0-beta.0 <16.2.3
- Fixed in
- 15.5.15, 16.2.3
Next.js: HTTP request smuggling in rewrites
- Affected
- >=16.0.0-beta.0 <16.1.7 · >=9.5.0 <15.5.13
- Fixed in
- 15.5.13, 16.1.7
Next.js: Unbounded next/image disk cache growth can exhaust storage
- Affected
- >=16.0.0-beta.0 <16.1.7 · >=10.0.0 <15.5.14
- Fixed in
- 15.5.14, 16.1.7
Next.js HTTP request deserialization can lead to DoS when using insecure React Server Components
- Affected
- >=13.0.0 <15.0.8 · >=15.1.1-canary.0 <15.1.12 · >=15.2.0-canary.0 <15.2.9 · >=15.3.0-canary.0 <15.3.9 · >=15.4.0-canary.0 <15.4.11 · >=15.5.1-canary.0 <15.5.10 · >=15.6.0-canary.0 <15.6.0-canary.61 · >=16.0.0-beta.0 <16.0.11 · >=16.1.0-canary.0 <16.1.5
- Fixed in
- 15.0.8, 15.1.12, 15.2.9, 15.3.9, 15.4.11, 15.5.10, 15.6.0-canary.61, 16.0.11, 16.1.5
Next.js self-hosted applications vulnerable to DoS via Image Optimizer remotePatterns configuration
- Affected
- >=10.0.0 <15.5.10 · >=15.6.0-canary.0 <16.1.5
- Fixed in
- 15.5.10, 16.1.5
Next.js Affected by Cache Key Confusion for Image Optimization API Routes
- Affected
- >=0.9.9 <14.2.31 · >=15.0.0 <15.4.5
- Fixed in
- 14.2.31, 15.4.5
Next.js Content Injection Vulnerability for Image Optimization
- Affected
- >=0.9.9 <14.2.31 · >=15.0.0 <15.4.5
- Fixed in
- 14.2.31, 15.4.5
Next.js Improper Middleware Redirect Handling Leads to SSRF
- Affected
- >=0.9.9 <14.2.32 · >=15.0.0-canary.0 <15.4.7
- Fixed in
- 14.2.32, 15.4.7
Information exposure in Next.js dev server due to lack of origin verification
- Affected
- >=15.0.0 <15.2.2 · >=13.0 <14.2.30
- Fixed in
- 14.2.30, 15.2.2
Next.js Race Condition to Cache Poisoning
- Affected
- >=0.9.9 <14.2.24 · >=15.0.0 <15.1.6
- Fixed in
- 14.2.24, 15.1.6
Authorization Bypass in Next.js Middleware
- Affected
- >=13.0.0 <13.5.9 · >=14.0.0 <14.2.25 · >=15.0.0 <15.2.3 · >=12.0.0 <12.3.5
- Fixed in
- 12.3.5, 13.5.9, 14.2.25, 15.2.3
Next.js Allows a Denial of Service (DoS) with Server Actions
- Affected
- >=13.0.0 <13.5.8 · >=14.0.0 <14.2.21 · >=15.0.0 <15.1.2
- Fixed in
- 13.5.8, 14.2.21, 15.1.2
Next.js authorization bypass vulnerability
- Affected
- >=9.5.5 <14.2.15
- Fixed in
- 14.2.15
Denial of Service condition in Next.js image optimization
- Affected
- >=10.0.0 <14.2.7
- Fixed in
- 14.2.7
Next.js missing cache-control header may lead to CDN caching empty reply
- Affected
- >=0.9.9 <13.4.20-canary.13
- Fixed in
- 13.4.20-canary.13
Which of your client projects are still on next 13.0?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact next version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other next versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the npm registry. Refreshed daily.