CVE watch.
The vulnerabilities that reach apps built with AI: what each one lets a stranger do, which versions are affected, and the version that fixes it. Not sure which Next.js you run? The version checker tells you in one paste.
- CVE-2026-94482high 8.2CVE-2026-94482: the Next.js Server Actions denial of service, who is affected and the fixNext.js App Router, Server Actions. Fixed in 15.5.28 and 16.4.1. No fix on 13.x, 14.x or 15.0 to 15.4. Latest releases: 16.4.5 and 15.5.29.
- GHSA-2464-fhr4-w9xwcritical 9.5GHSA-2464-fhr4-w9xw: the Next.js SVG image optimizer RCE, who is affected and the fixNext.js Image Optimization API (/_next/image), through sharp and librsvg. Fixed in 16.4.1 and 15.5.28 (or sharp 0.35.5 or later). Latest releases: 16.4.5 and 15.5.29.
- GHSA-673q-mjm6-r5xrcritical 9.5GHSA-673q-mjm6-r5xr: the Next.js use cache RCE, who is affected and how to fix itNext.js Cache Components (use cache functions, App Router). Fixed in 16.4.1. Next.js 15 and older are not listed as affected. Latest releases: 16.4.5 and 15.5.29.
- CVE-2026-94483high 8.3CVE-2026-94483: the Next.js image optimizer SSRF, who is affected and how to fix itNext.js Image Optimization (next/image, /_next/image). Fixed in 16.3.8. Next.js 15 and older are not listed as affected. Latest releases: 16.4.5 and 15.5.29.
- CVE-2026-44575high 7.5CVE-2026-44575: the Next.js middleware bypass through segment-prefetch URLsNext.js middleware and proxy (App Router). Fixed in 15.5.16, 16.2.5 (with middleware.ts built by Turbopack: 15.5.18, 16.2.6, CVE-2026-45109). Current patches: 16.4.5 or 15.5.29.
- CVE-2026-27978medium 5.3CVE-2026-27978: the Next.js Server Action CSRF bypass with Origin: nullNext.js Server Actions. Fixed in 16.1.7. Current patch: 16.4.5.
- CVE-2026-23864high 7.5CVE-2026-23864: the React Server Components DoS, affected versions and fixReact Server Components (react-server-dom-webpack, -parcel, -turbopack) and the Next.js App Router. Fixed in React 19.0.4, 19.1.5, 19.2.4; Next.js 15.0.8, 15.1.12, 15.2.9, 15.3.9, 15.4.11, 15.5.10, 16.0.11, 16.1.5 (no fix on 13.x or 14.x). Current patches: Next.js 16.4.5 or 15.5.29.
- CVE-2025-55184high 7.5CVE-2025-55184: the React Server Components denial of service, and how to fix itReact Server Components (react-server-dom-webpack, -parcel, -turbopack) and the Next.js App Router. Fixed in Complete fix (with CVE-2025-67779): React 19.0.3, 19.1.4, 19.2.3; Next.js 14.2.35, 15.0.7, 15.1.11, 15.2.8, 15.3.8, 15.4.10, 15.5.9, 16.0.10. Current patches: Next.js 16.4.5 or 15.5.29.
- CVE-2025-55183medium 5.3CVE-2025-55183: React Server Components source code exposure, and how to fix itReact Server Components (react-server-dom-webpack, -parcel, -turbopack) and the Next.js App Router. Fixed in React 19.0.2, 19.1.3, 19.2.2; Next.js 15.0.6, 15.1.10, 15.2.7, 15.3.7, 15.4.9, 15.5.8, 16.0.9 (GitHub advisory; the Next.js blog and NVD list one patch later, 15.0.7 to 16.0.10, which also fixes CVE-2025-67779). Current patches: Next.js 16.4.5 or 15.5.29.
- CVE-2025-67779high 7.5CVE-2025-67779: the incomplete React Server Components DoS fix, and what to install nowReact Server Components (react-server-dom-webpack, -parcel, -turbopack) and the Next.js App Router. Fixed in React 19.0.3, 19.1.4, 19.2.3; Next.js 14.2.35, 15.0.7, 15.1.11, 15.2.8, 15.3.8, 15.4.10, 15.5.9, 16.0.10. Current patches: Next.js 16.4.5 or 15.5.29.
- CVE-2025-55182critical 10.0React2ShellCVE-2025-55182 (React2Shell): which versions are affected and how to fix itReact Server Components (react-server-dom-webpack, -parcel, -turbopack) and the Next.js App Router. Fixed in React 19.0.1, 19.1.2, 19.2.1; Next.js 15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7, 16.0.7. Current patches: Next.js 16.4.5 or 15.5.29.
- CVE-2025-48757critical 9.3CVE-2025-48757: the Lovable RLS flaw, who is affected and how to fix itLovable-generated apps with a Supabase database (row level security). Fixed in No fixed version: Lovable is a hosted service. Each project fixes its own RLS policies; Lovable added a security scan on 2025-04-24.
- CVE-2025-29927critical 9.1CVE-2025-29927: the Next.js middleware bypass, who is affected and how to fix itNext.js middleware. Fixed in 15.2.3, 14.2.25, 13.5.9, 12.3.5 (follow-up fix: 15.2.4, 14.2.26, 13.5.10, 12.3.6). Current patches: 16.4.5 or 15.5.29.
- CVE-2024-34351high 7.5CVE-2024-34351: the Next.js Server Actions SSRF, who is affected and how to fix itNext.js Server Actions. Fixed in 14.1.1 (no fix on the 13.x line). Current patches: 16.4.5 or 15.5.29.