DeutschShown in its original language — a full translation is planned for a future version.
Vercel Next.js: Mehrere Schwachstellen
view advisory published 2026-05-06
Ein Angreifer kann mehrere Schwachstellen in Vercel Next.js ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Cross-Site-Scripting-Angriffe durchzuführen, Daten zu manipulieren, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand zu verursachen.
01
describes (12)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-44582US | — | — | ||
Next.js is a React framework for building full-stack web applications. From 13.4.6 to before 15.5.16 and 16.2.5, React Server Component responses can be vulnerable to cache poisoni… | ||||
| CVE-2026-44581US | — | — | ||
Next.js is a React framework for building full-stack web applications. From 13.4.0 to before 15.5.16 and 16.2.5, App Router applications that rely on CSP nonces can be vulnerable t… | ||||
| CVE-2026-44580US | — | — | ||
Next.js is a React framework for building full-stack web applications. From 13.0.0 to before 15.5.16 and 16.2.5, applications that use beforeInteractive scripts together with untru… | ||||
| CVE-2026-44579US | — | Exploit | ||
Next.js is a React framework for building full-stack web applications. From to before 15.5.16 and 16.2.5, applications using Partial Prerendering through the Cache Components feat… | ||||
| CVE-2026-44578US | — | Exploit | ||
Next.js is a React framework for building full-stack web applications. From 13.4.13 to before 15.5.16 and 16.2.5, self-hosted applications using the built-in Node.js server can be… | ||||
| CVE-2026-44577US | — | — | ||
Next.js is a React framework for building full-stack web applications. From 10.0.0 to before 15.5.16 and 16.2.5, when self-hosting Next.js with the default image loader, the Image… | ||||
| CVE-2026-44576US | — | — | ||
Next.js is a React framework for building full-stack web applications. From 14.2.0 to before 15.5.16 and 16.2.5, applications using React Server Components can be vulnerable to cac… | ||||
| CVE-2026-44575US | —OT elevated | — | ||
Next.js is a React framework for building full-stack web applications. From 15.2.0 to before 15.5.16 and 16.2.5, App Router applications that rely on middleware or proxy-based chec… | ||||
| CVE-2026-44574US | —OT elevated | — | ||
Next.js is a React framework for building full-stack web applications. From 15.4.0 to before 15.5.16 and 16.2.5, applications that rely on middleware to protect dynamic routes can… | ||||
| CVE-2026-44573US | —OT elevated | — | ||
Next.js is a React framework for building full-stack web applications. From 12.2.0 to before 15.5.16 and 16.2.5, Applications using the Pages Router with i18n configured and middle… | ||||
| CVE-2026-44572US | medium5.9 | — | ||
Next.js is a React framework for building full-stack web applications. From 12.2.0 to before 15.5.16 and 16.2.5, an external client could send a x-nextjs-data header on a normal re… | ||||
| CVE-2026-23870US | — | Exploit | ||
A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to server crashes, out-of-memory excep… | ||||
02
references
External citations — patches, advisories, analysis.
- Red Hat Security Advisory RHSA-2026:34608 vom 2026-07-02external
- Red Hat Security Advisory RHSA-2026:37272 vom 2026-07-09external
- Red Hat Security Advisory RHSA-2026:54435 vom 2026-08-12external
- GitHub Security Advisory GHSA-267c-6grr-h53f vom 2026-05-06external
- GitHub Security Advisory GHSA-36qx-fr4f-26g5 vom 2026-05-06external
- GitHub Security Advisory GHSA-3g8h-86w9-wvmq vom 2026-05-06external
- GitHub Security Advisory GHSA-492v-c6pp-mqqv vom 2026-05-06external
- GitHub Security Advisory GHSA-8h8q-6873-q5fj vom 2026-05-06external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan