NE
Product
next.js
On CISA KEVExploited in the wildRansomware-linked
65
CVEs
1
On KEV
10.0
Max CVSS
8
New 30D
Severity mix
Critical 3High 27Medium 32Low 3
Watch
Add next.js to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-55182 RansomwareIn wildKEV | 10.0 | Dec 3 | Meta React Server Components Remote Code Execution Vulnerability Affected: 15.0.0 before 15.0.5; 15.1.0 before 15.1.9; 15.2.0 before 15.2.6; 15.3.0 before 15.3.6; 15.4.0 before 15.4.8; 15.5.0 before 15.5.7; +34 more |
| CVE-2025-29927 | 9.1 | Mar 21 | Authorization Bypass in Next.js Middleware Affected: >= 11.1.4, < 12.3.5; >= 14.0.0, < 14.2.25; >= 15.0.0, < 15.2.3; >= 13.0.0, < 13.5.9 |
| CVE-2026-75604 | 9.0 | Sep 1 | Next.js: Unauthenticated Remote Code Execution on windows-hosted servers Affected: >= 13.4.0, < 15.5.24; >= 16.0.0, < 16.3.3 |
Showing 3