PatchTheCVEvercel vulnerabilities
Recent CVEs affecting vercel products. 9 tracked.
vercel has 9 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 9. Most recent: 2026-07-27. Highest priority: CVE-2026-64641 (score 46/100).
- CVE-2026-64641 HIGH 7.5 UPGRADE Next.js is a React framework for building full-stack web applications
- CVE-2026-64642 HIGH 8.2 UPGRADE Next.js is a React framework for building full-stack web applications
- CVE-2026-64649 MEDIUM 6.5 UPGRADE Next.js is a React framework for building full-stack web applications
- CVE-2026-64644 MEDIUM 5.3 UPGRADE Next.js is a React framework for building full-stack web applications
- CVE-2026-64643 MEDIUM 5.3 UPGRADE Next.js is a React framework for building full-stack web applications
- CVE-2026-64646 MEDIUM 5.3 UPGRADE Next.js is a React framework for building full-stack web applications
- CVE-2026-64645 MEDIUM 6.1 UPGRADE Next.js is a React framework for building full-stack web applications
- CVE-2026-64647 MEDIUM 5.4 UPGRADE Next.js is a React framework for building full-stack web applications
- CVE-2026-64648 MEDIUM 5.4 UPGRADE Next.js is a React framework for building full-stack web applications
FAQ
How do I fix vercel vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is vercel being exploited right now?
None of the tracked vercel CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which vercel CVE should I patch first?
CVE-2026-64641 currently ranks highest (46/100): Next.js is a React framework for building full-stack web applications.