Vulnerabilities in Vercel
76 resultsCVE-2025-32421LOWNext.js Race Condition to Cache PoisoningEPSS 0.8%CVE-2024-56332MEDIUMNext.js Vulnerable to Denial of Service (DoS) with Server ActionsEPSS 0.8%CVE-2026-44573HIGHNext.js: Middleware / Proxy bypass in Pages Router applications using i18nEPSS 0.8%CVE-2020-15242MEDIUMOpen Redirect in Next.jsEPSS 0.8%CVE-2026-44579HIGHNext.js: Denial of Service via connection exhaustion in applications using Cache ComponentsEPSS 0.7%CVE-2026-44577MEDIUMNext.js: Denial of Service in the Image Optimization APIEPSS 0.7%CVE-2024-47831MEDIUMNext.js image optimization has Denial of Service conditionEPSS 0.7%CVE-2026-27980MEDIUMNext.js: Unbounded next/image disk cache growth can exhaust storageEPSS 0.7%CVE-2026-27979MEDIUMNext.js: Unbounded postponed resume buffering can lead to DoSEPSS 0.7%CVE-2025-7074MEDIUMvercel hyper rimraf-standalone.js ignoreMap redosEPSS 0.7%CVE-2026-64644MEDIUMNext.js: Denial of Service in the Image Optimization API using SVGsEPSS 0.7%CVE-2026-44574HIGHNext.js: Middleware / Proxy bypass through dynamic route parameter injectionEPSS 0.6%CVE-2026-64642HIGHNext.js: Middleware / Proxy bypass in App Router applications using Turbopack and single localeEPSS 0.6%CVE-2025-55173MEDIUMNext.js Content Injection Vulnerability for Image OptimizationEPSS 0.6%CVE-2026-8769MEDIUMvercel ai provider-utils response-handler.ts createJsonErrorResponseHandler resource consumptionEPSS 0.6%CVE-2026-64646MEDIUMNext.js: Unbounded Server Action payload in Edge runtimeEPSS 0.5%CVE-2026-64643MEDIUMNext.js: Unauthenticated Disclosure of Internal Server Function endpointsEPSS 0.5%CVE-2026-94543MEDIUMNext.js: Cache poisoning of SSG and ISR pages in self-hosted Next.js applicationsEPSS 0.5%CVE-2024-39693HIGHNext.js Denial of Service (DoS) conditionEPSS 0.5%CVE-2025-49005LOWNext.js cache poisoning due to omission of Vary headerEPSS 0.5%