DeutschIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
Vercel Next.js: Mehrere Schwachstellen
Advisory ansehen veröffentlicht 2026-07-21
Ein Angreifer kann mehrere Schwachstellen in Vercel Next.js ausnutzen, um Daten zu manipulieren, um Informationen offenzulegen, um einen Denial of Service Angriff durchzuführen, und um Sicherheitsvorkehrungen zu umgehen.
01
beschreibt (9)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-64649US | medium6.5 | — | ||
Next.js is a React framework for building full-stack web applications. In versions 14.1.1 through 15.5.20 and 16.0.0 through 16.2.10, when a Server Action forwards or redirects a r… | ||||
| CVE-2026-64648US | medium5.4 | — | ||
Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a server-side fetch with a request body may r… | ||||
| CVE-2026-64647US | medium5.4 | — | ||
Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a server-side fetch with a request body may re… | ||||
| CVE-2026-64646US | medium5.3 | — | ||
Next.js is a React framework for building full-stack web applications. In versions 13.0.0 through 15.5.20 and 16.0.0 through 16.2.10, requests targeting Next.js applications using… | ||||
| CVE-2026-64645US | medium6.1 | — | ||
Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a
rewrites() or redirects() rule that builds… | ||||
| CVE-2026-64644US | medium5.3 | — | ||
Next.js is a React framework for building full-stack web applications. In versions 15.5.0 through 15.5.20 and 16.0.0 through 16.2.10, when self-hosting Next.js with the default ima… | ||||
| CVE-2026-64643US | medium5.3 | — | ||
Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, Next.js applications using App Router, Server… | ||||
| CVE-2026-64642US | high8.2 | — | ||
Next.js is a React framework for building full-stack web applications. In versions 16.0.0 through 16.2.10, crafted requests targeting Next.js applications using App Router built wi… | ||||
| CVE-2026-64641US | high7.5 | — | ||
Next.js is a React framework for building full-stack web applications. In versions 13.0.0 through 15.5.20 and 16.0.0 through 16.2.10, crafted requests targeting Next.js application… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- Red Hat Security Advisory RHSA-2026:54435 vom 2026-08-12external
- GitHub Security Advisory GHSA-4633-3j49-mh5q vom 2026-07-21external
- GitHub Security Advisory GHSA-4c39-4ccg-62r3 vom 2026-07-21external
- GitHub Security Advisory GHSA-68g3-v927-f742 vom 2026-07-21external
- GitHub Security Advisory GHSA-6gpp-xcg3-4w24 vom 2026-07-21external
- GitHub Security Advisory GHSA-89xv-2m56-2m9x vom 2026-07-21external
- GitHub Security Advisory GHSA-955p-x3mx-jcvp vom 2026-07-21external
- GitHub Security Advisory GHSA-m99w-x7hq-7vfj vom 2026-07-21external
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan