DeutschShown in its original language — a full translation is planned for a future version.
Vercel Next.js: Mehrere Schwachstellen
view advisory published 2026-07-21
Ein Angreifer kann mehrere Schwachstellen in Vercel Next.js ausnutzen, um Daten zu manipulieren, um Informationen offenzulegen, um einen Denial of Service Angriff durchzuführen, und um Sicherheitsvorkehrungen zu umgehen.
01
describes (9)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-64649US | medium6.5 | — | ||
Next.js is a React framework for building full-stack web applications. In versions 14.1.1 through 15.5.20 and 16.0.0 through 16.2.10, when a Server Action forwards or redirects a r… | ||||
| CVE-2026-64648US | medium5.4 | — | ||
Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a server-side fetch with a request body may r… | ||||
| CVE-2026-64647US | medium5.4 | — | ||
Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a server-side fetch with a request body may re… | ||||
| CVE-2026-64646US | medium5.3 | — | ||
Next.js is a React framework for building full-stack web applications. In versions 13.0.0 through 15.5.20 and 16.0.0 through 16.2.10, requests targeting Next.js applications using… | ||||
| CVE-2026-64645US | medium6.1 | — | ||
Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a
rewrites() or redirects() rule that builds… | ||||
| CVE-2026-64644US | medium5.3 | — | ||
Next.js is a React framework for building full-stack web applications. In versions 15.5.0 through 15.5.20 and 16.0.0 through 16.2.10, when self-hosting Next.js with the default ima… | ||||
| CVE-2026-64643US | medium5.3 | — | ||
Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, Next.js applications using App Router, Server… | ||||
| CVE-2026-64642US | high8.2 | — | ||
Next.js is a React framework for building full-stack web applications. In versions 16.0.0 through 16.2.10, crafted requests targeting Next.js applications using App Router built wi… | ||||
| CVE-2026-64641US | high7.5 | — | ||
Next.js is a React framework for building full-stack web applications. In versions 13.0.0 through 15.5.20 and 16.0.0 through 16.2.10, crafted requests targeting Next.js application… | ||||
02
references
External citations — patches, advisories, analysis.
- Red Hat Security Advisory RHSA-2026:54435 vom 2026-08-12external
- GitHub Security Advisory GHSA-4633-3j49-mh5q vom 2026-07-21external
- GitHub Security Advisory GHSA-4c39-4ccg-62r3 vom 2026-07-21external
- GitHub Security Advisory GHSA-68g3-v927-f742 vom 2026-07-21external
- GitHub Security Advisory GHSA-6gpp-xcg3-4w24 vom 2026-07-21external
- GitHub Security Advisory GHSA-89xv-2m56-2m9x vom 2026-07-21external
- GitHub Security Advisory GHSA-955p-x3mx-jcvp vom 2026-07-21external
- GitHub Security Advisory GHSA-m99w-x7hq-7vfj vom 2026-07-21external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan