CompaniesVercelMonthly reportsMay 2026
Vercel in May 2026: incidents, uptime and changes
19incidents posted
2labelled major or critical
99.89%free of major/critical
94.07%free of any incident
0price changes
0notable page changes
Vendor-reported outage time 49 min, incident time 44 h 5 min. Derived from the incidents the vendor posted on its own status page, not measured by us. A minute counts as an outage minute when a major or critical incident (as the vendor labelled it) was open; incident minutes include minor ones too. Maintenance and incidents marked "no impact" are left out, overlapping incidents are merged, a resolved incident counts for at most 7 days, and one still open with no resolution counts for at most 24 hours. Last 90 days.
By vendor label: Major 2 · Minor 14 · No impact listed 3
Major and critical incidents 2
| Incident | Impact | Started | Duration | Status | Day |
|---|---|---|---|---|---|
| Request Failures in ICN1 (Seoul, South Korea) | Major | 0 min | resolved | 05-04 | |
| Increased error rate in Workflows | Major | 49 min | resolved | 05-05 |
Other incidents 17
CVEs published
- CVE-2026-44479 Vercel: Non-interactive mode includes CLI arguments in suggested command output (CVSS 5.5)
- CVE-2026-44572 Next.js: Middleware / Proxy redirects can be cache-poisoned (CVSS 3.7)
- CVE-2026-44573 Next.js: Middleware / Proxy bypass in Pages Router applications using i18n (CVSS 7.5)
- CVE-2026-44575 Next.js: Middleware / Proxy bypass in App Router applications via segment-prefetch routes (CVSS 7.5)
- CVE-2026-44574 Next.js: Middleware / Proxy bypass through dynamic route parameter injection (CVSS 8.1)
- CVE-2026-44576 Next.js: Cache poisoning in React Server Component responses (CVSS 5.4)
- CVE-2026-44577 Next.js: Denial of Service in the Image Optimization API (CVSS 5.9)
- CVE-2026-44578 Next.js: Server-side request forgery in applications using WebSocket upgrades (CVSS 8.6)
- CVE-2026-44579 Next.js: Denial of Service via connection exhaustion in applications using Cache Components (CVSS 7.5)
- CVE-2026-44580 Next.js: Cross-site scripting in beforeInteractive scripts with untrusted input (CVSS 6.1)
- CVE-2026-44581 Next.js: Cross-site scripting in App Router applications using CSP nonces (CVSS 4.7)
- CVE-2026-44582 Next.js: Cache poisoning via collisions in React Server Component cache-busting (CVSS 3.7)
- CVE-2026-45109 Next.js: Middleware / Proxy bypass in App Router applications via segment-prefetch routes (CVSS 7.5)
- CVE-2026-45772 Turborepo: Unexpected local code execution during Yarn Berry detection (CVSS 9.8)
- CVE-2026-46508 Turborepo: VSCode Extension command injection (CVSS 7.8)
- CVE-2026-45773 Turborepo: Login callback CSRF/session fixation (CVSS 6.5)
- CVE-2026-8767 vercel ai PR Branch Name Interpolation prettier-on-automerge.yml run os command injection (CVSS 5.0)
- CVE-2026-8768 vercel ai provider-utils download-blob.ts validateDownloadUrl server-side request forgery (CVSS 7.3)
- CVE-2026-8769 vercel ai provider-utils response-handler.ts createJsonErrorResponseHandler resource consumption (CVSS 4.3)
Cite this
Vercel posted 19 status incidents in May 2026 (2 major or critical); 0 price changes and 0 notable page changes observed.
- Title
- Vercel in May 2026
- Vendor
- Vercel
- Date
- URL
- https://rewindex.com/company/vercel/2026/05