Next.js vulnerabilities and fixes

CVEs that mention Next.js, ranked by priority. 10 tracked.

Next.js has 10 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 10. Most recent: 2026-10-22. Highest priority: CVE-2026-64641 (score 46/100).

• CVE-2026-64641 HIGH 7.5 UPGRADE Next.js is a React framework for building full-stack web applications
• CVE-2026-64642 HIGH 8.2 UPGRADE Next.js is a React framework for building full-stack web applications
• CVE-2026-94482 HIGH 8.2 Next.js is a React framework for building full-stack web applications
• CVE-2026-64649 MEDIUM 6.5 UPGRADE Next.js is a React framework for building full-stack web applications
• CVE-2026-64644 MEDIUM 5.3 UPGRADE Next.js is a React framework for building full-stack web applications
• CVE-2026-64643 MEDIUM 5.3 UPGRADE Next.js is a React framework for building full-stack web applications
• CVE-2026-64646 MEDIUM 5.3 UPGRADE Next.js is a React framework for building full-stack web applications
• CVE-2026-64645 MEDIUM 6.1 UPGRADE Next.js is a React framework for building full-stack web applications
• CVE-2026-64647 MEDIUM 5.4 UPGRADE Next.js is a React framework for building full-stack web applications
• CVE-2026-64648 MEDIUM 5.4 UPGRADE Next.js is a React framework for building full-stack web applications

FAQ

How do I fix Next.js vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is Next.js being exploited right now?

None of the tracked Next.js CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which Next.js CVE should I patch first?

CVE-2026-64641 currently ranks highest (46/100): Next.js is a React framework for building full-stack web applications.

← Back to latest CVEs