vercel next.js

Name: vercel next.js
Brand: vercel

productEU

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

critical

by severity

0critical9high25medium0low

updated 2026-10-28

vulnerabilities (64)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2025-55182US	—OT critical	99.8% (100th)	KEV	15.1.9	2025-12-03	15 versions
CVE-2025-29927US	—OT high	99.2% (100th)	Exploit	14.2.25	2025-03-21	19 versions
CVE-2025-55183US	—	64.2% (99th)	Exploit	15.4.10	2025-12-11	10 versions
CVE-2024-46982US	—	59.2% (99th)	Exploit	13.5.7	2024-09-17	4 versions
CVE-2026-44578US	—	35.5% (98th)	Exploit	16.2.5	2026-05-13	6 versions
CVE-2024-34351US	high7.5	5.45% (93rd)	Exploit	14.1.1	2024-05-14	13.4.0, → 14.1.1
CVE-2026-75604US	—	2.10% (82nd)	Exploit	15.5.24	2026-09-01	5 versions
CVE-2026-23869US	—	1.55% (75th)	Exploit	16.2.3	2026-04-08	2 versions
CVE-2026-23870US	—	1.53% (75th)	Exploit	16.2.5	2026-05-06	2 versions
CVE-2026-94545US	—	1.08% (65th)	Exploit	16.3.6	2026-09-30	2 versions
CVE-2025-32421US	—	0.80% (57th)	Exploit	15.1.6	2025-05-14	4 versions
CVE-2026-44579US	—	0.75% (55th)	Exploit	16.2.5	2026-05-13	6 versions
CVE-2026-96889US	high7.8	0.53% (45th)	Exploit	15.5.28	2026-09-23	4 versions
CVE-2026-29057US	medium6.5	0.45% (39th)	Exploit	16.1.7	2026-03-18	6 versions
CVE-2026-27978US	medium4.3	0.21% (11th)	Exploit	16.1.7	2026-03-18	3 versions
CVE-2025-66478US	—	—	Exploit	15.1.9	2025-12-03	7 versions
CVE-2021-43803US	medium4.3	47.3% (99th)	—	11.1.3	2021-12-10	2 versions
CVE-2025-67779US	—	20.0% (97th)	—	16.1.0-canary.19	2025-12-12	10 versions
CVE-2024-51479US	—OT elevated	4.00% (90th)	—	14.2.15	2024-12-17	2 versions
CVE-2025-57822US	high8.2	2.58% (85th)	—	15.4.5	2025-08-29	6 versions
CVE-2022-23646US	high7.5	1.80% (78th)	—	12.1.0	2022-02-17	10.0.0, → 12.1.0
CVE-2026-44575US	—OT elevated	1.59% (76th)	—	16.2.5	2026-05-13	6 versions
CVE-2024-34350US	—	1.19% (68th)	—	13.5.1	2024-05-14	13.4.0, → 13.5.1
CVE-2022-36046US	medium5.3	1.19% (68th)	—	no fix	2022-08-31	≤ = 12.2.3
CVE-2021-39178US	medium6.1	1.14% (66th)	—	11.1.1	2021-08-31	10.0.0, → 11.1.1
CVE-2025-49826US	—	1.13% (66th)	—	15.2.0	2025-07-03	3 versions
CVE-2021-37699US	medium6.1	1.03% (64th)	—	no fix	2021-08-12	≤ < 11.1.0
CVE-2026-64641US	high7.5	0.86% (58th)	—	16.2.11	2026-07-27	4 versions
CVE-2024-56332US	—	0.80% (57th)	—	14.2.21	2025-01-03	6 versions
CVE-2026-44573US	—OT elevated	0.80% (56th)	—	15.5.16	2026-05-13	6 versions
CVE-2020-15242US	medium6.1	0.77% (56th)	—	9.5.4	2020-10-08	9.5.0, → 9.5.4
CVE-2026-44577US	—	0.74% (54th)	—	15.5.16	2026-05-13	6 versions
CVE-2024-47831US	high7.5	0.73% (54th)	—	14.2.7	2024-10-14	2 versions
CVE-2026-27980US	high7.5	0.71% (53rd)	—	15.5.13	2026-03-18	3 versions
CVE-2026-27979US	high7.5	0.69% (53rd)	—	16.1.7	2026-03-18	4 versions
CVE-2026-64644US	medium5.3	0.67% (52nd)	—	15.5.21	2026-07-27	4 versions
CVE-2026-44574US	—OT elevated	0.64% (50th)	—	16.2.5	2026-05-13	6 versions
CVE-2026-64642US	high8.2	0.64% (50th)	—	16.2.11	2026-07-27	3 versions
CVE-2026-45109US	—OT elevated	0.60% (49th)	—	16.2.6	2026-05-13	4 versions
CVE-2025-55173US	—	0.60% (49th)	—	15.4.5	2025-08-29	4 versions
CVE-2026-64646US	medium5.3	0.52% (44th)	—	16.2.11	2026-07-27	4 versions
CVE-2026-64643US	medium5.3	0.51% (43rd)	—	16.2.11	2026-07-27	4 versions
CVE-2026-94543US	medium5.3	0.51% (43rd)	—	16.3.8	2026-10-02	2 versions
CVE-2025-49005US	—	0.49% (42nd)	—	15.2.0	2025-07-03	4 versions
CVE-2024-39693US	—	0.49% (42nd)	—	13.5.0	2024-07-10	13.3.1, → 13.5.0
CVE-2026-64649US	medium6.5	0.46% (40th)	—	16.2.11	2026-07-27	4 versions
CVE-2025-30218US	medium5.9	0.43% (37th)	—	no fix	2025-04-02	8 versions
CVE-2026-64645US	medium6.1	0.41% (36th)	—	15.5.21	2026-07-27	4 versions
CVE-2025-57752US	—	0.35% (28th)	—	15.4.5	2025-08-29	4 versions
CVE-2026-64648US	medium5.4	0.34% (27th)	—	15.5.21	2026-07-27	4 versions

showing 50 of 64

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-770Allocation of Resources Without Limits or Throttling7 CVEs
CWE-524Use of Cache Containing Sensitive Information6 CVEs
CWE-918Server-Side Request Forgery (SSRF)6 CVEs
CWE-400Uncontrolled Resource Consumption5 CVEs
CWE-502Deserialization of Untrusted Data5 CVEs
CWE-444Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')4 CVEs
CWE-285Improper Authorization3 CVEs
CWE-288Authentication Bypass Using an Alternate Path or Channel3 CVEs

sources (4)

Which sources assert this record, and when.

DECERT-Bund (BSI CSAF)49 CVEs
EUEU Vulnerability Database (ENISA)48 CVEs
RUBDU (FSTEC Data Security Threats Database)28 CVEs
NLNCSC-NL (CSAF)2 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan