vercel vulnerabilities

CVEs per yearBy the year they were published

1. 20201
2. 20213
3. 20222
4. 20231
5. 20247
6. 202514
7. 202648

Newest CVEs

• CVE-2026-94482

  Next.js: Denial of Service in App Router using Server Actions

  vercel · next.js

  High8.2
• CVE-2026-109375

  Vercel deepsec before 1.1.17 Arbitrary File Write via Symlink in Sandbox Tarball Extraction

  Vercel · deepsec

  Medium4.9
• CVE-2026-94484

  Next.js: Cache poisoning in Next.js SSG/ISR rendering leads to cross-user content substitution and persistent denial of service

  vercel · next.js

  Medium6.3
• CVE-2026-94485

  Next.js: Information disclosure in Next.js App Router metadata image routes via dynamicParams bypass

  vercel · next.js

  Medium6.3
• CVE-2026-94483

  Next.js: Server-Side Request Forgery in Image Optimization

  vercel · next.js

  High8.3
• CVE-2026-94543

  Next.js: Cache poisoning of SSG and ISR pages in self-hosted Next.js applications

  vercel · next.js

  Medium6.3
• CVE-2026-94544

  Next.js: Pending `use cache` fill can leak Draft Mode content into regular responses and persisted pages

  vercel · next.js

  Medium6.3
• CVE-2026-94486

  Next.js: Information disclosure in the Next.js development server's Model Context Protocol endpoint

  vercel · next.js

  Low2.3
• CVE-2026-103004

  next.js cache leak on warm `use cache` handlers accessing root param

  vercel · next.js

  Medium6.3
• CVE-2026-94545

  Satori-generated SVG has improper escaping

  vercel · satori

  Medium5.3