2026-10
“Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used”osv.dev ›
“Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes”osv.dev ›
“Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Up”osv.dev ›
“Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used”osv.dev ›
“Next.js has information disclosure in development server's Model Context Protocol endpoint”osv.dev ›
“Next.js: Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences”osv.dev ›
“Next.js: Unauthenticated Remote Code Execution in use cache functions returning typed arrays”osv.dev ›
“Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale”osv.dev ›
“Next.js self-hosted applications vulnerable to DoS via Image Optimizer remotePatterns configuration”osv.dev ›
“Next.js vulnerable to server-side request forgery in applications using WebSocket upgrades”osv.dev ›
“Next.js has information disclosure in App Router metadata image routes via dynamicParams bypass”osv.dev ›
“Next.js vulnerable to cross-site scripting in App Router applications using CSP nonces”osv.dev ›
“Next.js HTTP request deserialization can lead to DoS when using insecure React Server Components”osv.dev ›
“Next.js has cache poisoning in SSG/ISR rendering that leads to cross-user content substitution and persistent denial of service”osv.dev ›
“Next.js vulnerable to Denial of Service via connection exhaustion in applications using Cache Components”osv.dev ›
“Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname”osv.dev ›
“Next.js vulnerable to cache poisoning via collisions in React Server Component cache-busting”osv.dev ›
“Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation)”osv.dev ›
2026-11