PatchTheCVEnext.js vulnerabilities and fixes
Recent CVEs affecting next.js, with upgrade or downgrade steps. 9 tracked.
Also searched as: next js, nextjs.
next.js has 9 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 9. Most recent: 2026-07-27. Highest priority: CVE-2026-64641 (score 46/100).
- CVE-2026-64641 HIGH 7.5 UPGRADE Next.js is a React framework for building full-stack web applications
- CVE-2026-64642 HIGH 8.2 UPGRADE Next.js is a React framework for building full-stack web applications
- CVE-2026-64649 MEDIUM 6.5 UPGRADE Next.js is a React framework for building full-stack web applications
- CVE-2026-64644 MEDIUM 5.3 UPGRADE Next.js is a React framework for building full-stack web applications
- CVE-2026-64643 MEDIUM 5.3 UPGRADE Next.js is a React framework for building full-stack web applications
- CVE-2026-64646 MEDIUM 5.3 UPGRADE Next.js is a React framework for building full-stack web applications
- CVE-2026-64645 MEDIUM 6.1 UPGRADE Next.js is a React framework for building full-stack web applications
- CVE-2026-64647 MEDIUM 5.4 UPGRADE Next.js is a React framework for building full-stack web applications
- CVE-2026-64648 MEDIUM 5.4 UPGRADE Next.js is a React framework for building full-stack web applications
FAQ
How do I fix next.js vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is next.js being exploited right now?
None of the tracked next.js CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which next.js CVE should I patch first?
CVE-2026-64641 currently ranks highest (46/100): Next.js is a React framework for building full-stack web applications.