next vulnerabilities

npm

66 Total advisories

66 Vulnerabilities

0 Malware

Dependency scanning

Check whether next is in your codebase

Corgea flags malicious and compromised dependencies with reachability analysis, so you fix the packages that actually run in your application instead of working through the whole lockfile.

next

Vulnerabilities

Next.js Server-Side Request Forgery in Server Actions

Information exposure in Next.js dev server due to lack of origin verification

Denial of Service Vulnerability in next.js

Open Redirect in Next.js versions

Directory Traversal in Next.js

Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used

Next.js: Unauthenticated Remote Code Execution on windows-hosted servers

Next.js is vulnerable to RCE in React flight protocol

Next.js: Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences

Next.js: Server-Side Request Forgery in Server Actions on custom servers

Next.js: Denial of Service in the Image Optimization API using SVGs

Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname

Next.js: Cache confusion of response bodies for requests with bodies

Next.js: Unbounded Server Action payload in Edge runtime

Next.js: Unauthenticated disclosure of internal Server Function endpoints

Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale

Next.js: Denial of Service in App Router using Server Actions

Unexpected server crash in Next.js

Unexpected server crash in Next.js.

XSS in Image Optimization API for Next.js

Open Redirect in Next.js

Next.js vulnerable to cache poisoning in React Server Component responses

Next.js vulnerable to cache poisoning via collisions in React Server Component cache-busting

Next.js has a Denial of Service in the Image Optimization API

Next.js has cross-site scripting in beforeInteractive scripts with untrusted input

Next.js vulnerable to cross-site scripting in App Router applications using CSP nonces

Next.js vulnerable to Denial of Service via connection exhaustion in applications using Cache Components

Next.js vulnerable to server-side request forgery in applications using WebSocket upgrades

Next.js's Middleware / Proxy redirects can be cache-poisoned

Next.js has a Middleware / Proxy bypass in Pages Router applications using i18n

Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes

Next.js has a Middleware / Proxy bypass through dynamic route parameter injection

Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Up

Next.js Vulnerable to Denial of Service with Server Components

Next.js has a Denial of Service with Server Components

Next.js has Unbounded Memory Consumption via PPR Resume Endpoint

Next.js: null origin can bypass dev HMR websocket CSRF checks

Next.js: Unbounded next/image disk cache growth can exhaust storage

Next.js: Unbounded postponed resume buffering can lead to DoS

Next.js: null origin can bypass Server Actions CSRF checks

Next.js: HTTP request smuggling in rewrites

Authorization Bypass in Next.js Middleware

Next.js HTTP request deserialization can lead to DoS when using insecure React Server Components

Next.js self-hosted applications vulnerable to DoS via Image Optimizer remotePatterns configuration

Next.js Allows a Denial of Service (DoS) with Server Actions

Next.js Content Injection Vulnerability for Image Optimization

Next.js Improper Middleware Redirect Handling Leads to SSRF

Next Vulnerable to Denial of Service with Server Components

Next.js Cache Poisoning

Denial of Service condition in Next.js image optimization

Next Server Actions Source Code Exposure

Next.js Affected by Cache Key Confusion for Image Optimization API Routes

Next has a Denial of Service with Server Components - Incomplete Fix Follow-Up

Next.js has a Cache poisoning vulnerability due to omission of the Vary header

Next.js may leak x-middleware-subrequest-id to external hosts

Next.js Race Condition to Cache Poisoning

Next.js authorization bypass vulnerability

Next.JS vulnerability can lead to DoS via cache poisoning

Next.js Denial of Service (DoS) condition

Next.js Vulnerable to HTTP Request Smuggling

Next.js Directory Traversal Vulnerability

Next.js missing cache-control header may lead to CDN caching empty reply

Improper CSP in Image Optimization API for Next.js versions between 10.0.0 and 12.1.0

Directory traversal vulnerability in Next.js

Next.js has cross site scripting (XSS) vulnerability via the 404 or 500 /_error page

Remote Code Execution in next

Browse more npm advisories

Start Securing