Companies/Vercel/CVEs

Vercel CVEs

84 vulnerabilities mapped to Vercel’s software or packages, 1 of them in CISA’s Known Exploited Vulnerabilities catalog, newest first. Not a statement that the hosted service was exposed.

CVEs mapped to a company Rewindex tracks (by CVE affected-product data, NVD CPE, vendor advisories and package feeds), every entry in CISA’s Known Exploited Vulnerabilities catalog, and CVEs named in a tracked status incident. Other CVEs are not listed. Same list on the all-vendor CVE index.

• 2026-10-22

  CVE-2026-94482 Next.js: Denial of Service in App Router using Server Actions

  CVSS 8.2 highEPSS 0.37%

• 2026-10-12

  CVE-2026-109375 Vercel deepsec before 1.1.17 Arbitrary File Write via Symlink in Sandbox Tarball Extraction

  CVSS 6.1 mediumEPSS 0.32%

• 2026-10-02

  CVE-2026-94484 Next.js: Cache poisoning in Next.js SSG/ISR rendering leads to cross-user content substitution and persistent denial of service

  CVSS 4.8 mediumEPSS 0.24%

• 2026-10-02

  CVE-2026-94485 Next.js: Information disclosure in Next.js App Router metadata image routes via dynamicParams bypass

  CVSS 5.3 mediumEPSS 0.17%

• 2026-10-02

  CVE-2026-94483 Next.js: Server-Side Request Forgery in Image Optimization

  CVSS 6.5 mediumEPSS 0.33%

• 2026-10-02

  CVE-2026-94543 Next.js: Cache poisoning of SSG and ISR pages in self-hosted Next.js applications

  CVSS 5.3 mediumEPSS 0.51%

• 2026-10-02

  CVE-2026-94544 Next.js: Pending `use cache` fill can leak Draft Mode content into regular responses and persisted pages

  CVSS 4.2 mediumEPSS 0.18%

• 2026-10-02

  CVE-2026-94486 Next.js: Information disclosure in the Next.js development server's Model Context Protocol endpoint

  CVSS 5.4 mediumEPSS 0.11%

• 2026-10-01

  CVE-2026-103004 next.js cache leak on warm `use cache` handlers accessing root param

  CVSS 5.3 mediumEPSS 0.25%

• 2026-09-30

  CVE-2026-94545 Satori-generated SVG has improper escaping

  CVSS 5.3 mediumEPSS 1.1%

• 2026-09-01

  CVE-2026-75604 Next.js: Unauthenticated Remote Code Execution on windows-hosted servers

  CVSS 9.0 criticalEPSS 2.1%

• 2026-07-27

  CVE-2026-64649 Next.js: Server-Side Request Forgery in Server Actions on Custom Servers

  CVSS 6.5 mediumEPSS 0.46%

• 2026-07-27

  CVE-2026-64648 Next.js: Response Body Cache Confusion for Requests Containing Bodies

  CVSS 5.4 mediumEPSS 0.34%

• 2026-07-27

  CVE-2026-64647 Next.js: Response Body Cache Confusion with Invalid UTF-8 Request Bodies

  CVSS 5.4 mediumEPSS 0.32%

• 2026-07-27

  CVE-2026-64646 Next.js: Unbounded Server Action payload in Edge runtime

  CVSS 5.3 mediumEPSS 0.52%

• 2026-07-27

  CVE-2026-64644 Next.js: Denial of Service in the Image Optimization API using SVGs

  CVSS 5.3 mediumEPSS 0.67%

• 2026-07-27

  CVE-2026-64643 Next.js: Unauthenticated Disclosure of Internal Server Function endpoints

  CVSS 5.3 mediumEPSS 0.51%

• 2026-07-27

  CVE-2026-64642 Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale

  CVSS 8.2 highEPSS 0.63%

• 2026-07-27

  CVE-2026-64641 Next.js: Denial of Service in App Router using Server Actions

  CVSS 7.5 highEPSS 0.86%

• 2026-07-27

  CVE-2026-64645 Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname

  CVSS 6.1 mediumEPSS 0.41%

• 2026-07-20

  CVE-2026-64650 AI SDK Codex Harness Tool Relay Authorization Bypass

  CVSS 6.3 mediumEPSS 0.17%

• 2026-07-20

  CVE-2026-64651 AI SDK OpenCode Harness Tool Relay Authorization Bypass

  CVSS 6.3 mediumEPSS 0.17%

• 2026-05-17

  CVE-2026-8769 vercel ai provider-utils response-handler.ts createJsonErrorResponseHandler resource consumption

  CVSS 4.3 mediumEPSS 0.56%

• 2026-05-17

  CVE-2026-8768 vercel ai provider-utils download-blob.ts validateDownloadUrl server-side request forgery

  CVSS 7.3 highEPSS 0.46%

• 2026-05-17

  CVE-2026-8767 vercel ai PR Branch Name Interpolation prettier-on-automerge.yml run os command injection

  CVSS 5.0 mediumEPSS 7.0%

• 2026-05-15

  CVE-2026-45773 Turborepo: Login callback CSRF/session fixation

  CVSS 6.5 mediumEPSS 0.12%

• 2026-05-15

  CVE-2026-46508 Turborepo: VSCode Extension command injection

  CVSS 7.8 highEPSS 0.16%

• 2026-05-15

  CVE-2026-45772 Turborepo: Unexpected local code execution during Yarn Berry detection

  CVSS 9.8 criticalEPSS 0.39%

• 2026-05-13

  CVE-2026-45109 Next.js: Middleware / Proxy bypass in App Router applications via segment-prefetch routes

  CVSS 7.5 highEPSS 0.60%

• 2026-05-13

  CVE-2026-44582 Next.js: Cache poisoning via collisions in React Server Component cache-busting

  CVSS 3.7 lowEPSS 0.22%

• 2026-05-13

  CVE-2026-44581 Next.js: Cross-site scripting in App Router applications using CSP nonces

  CVSS 4.7 mediumEPSS 0.22%

• 2026-05-13

  CVE-2026-44580 Next.js: Cross-site scripting in beforeInteractive scripts with untrusted input

  CVSS 6.1 mediumEPSS 0.21%

• 2026-05-13

  CVE-2026-44579 Next.js: Denial of Service via connection exhaustion in applications using Cache Components

  CVSS 7.5 highEPSS 0.75%

• 2026-05-13

  CVE-2026-44578 Next.js: Server-side request forgery in applications using WebSocket upgrades

  CVSS 8.6 highEPSS 35.5%

• 2026-05-13

  CVE-2026-44577 Next.js: Denial of Service in the Image Optimization API

  CVSS 5.9 mediumEPSS 0.74%

• 2026-05-13

  CVE-2026-44576 Next.js: Cache poisoning in React Server Component responses

  CVSS 5.4 mediumEPSS 0.30%

• 2026-05-13

  CVE-2026-44574 Next.js: Middleware / Proxy bypass through dynamic route parameter injection

  CVSS 8.1 highEPSS 0.64%

• 2026-05-13

  CVE-2026-44575 Next.js: Middleware / Proxy bypass in App Router applications via segment-prefetch routes

  CVSS 7.5 highEPSS 1.6%

• 2026-05-13

  CVE-2026-44573 Next.js: Middleware / Proxy bypass in Pages Router applications using i18n

  CVSS 7.5 highEPSS 0.80%

• 2026-05-13

  CVE-2026-44572 Next.js: Middleware / Proxy redirects can be cache-poisoned

  CVSS 3.7 lowEPSS 0.28%

• 2026-05-13

  CVE-2026-44479 Vercel: Non-interactive mode includes CLI arguments in suggested command output

  CVSS 5.5 mediumEPSS 0.16%

• 2026-03-18

  CVE-2026-29057 Next.js: HTTP request smuggling in rewrites

  CVSS 6.5 mediumEPSS 0.45%

• 2026-03-18

  CVE-2026-27980 Next.js: Unbounded next/image disk cache growth can exhaust storage

  CVSS 7.5 highEPSS 0.71%

• 2026-03-18

  CVE-2026-27979 Next.js: Unbounded postponed resume buffering can lead to DoS

  CVSS 7.5 highEPSS 0.69%

• 2026-03-17

  CVE-2026-27978 Next.js: null origin can bypass Server Actions CSRF checks

  CVSS 4.3 mediumEPSS 0.21%

• 2026-03-17

  CVE-2026-27977 Next.js: null origin can bypass dev HMR websocket CSRF checks

  CVSS 5.4 mediumEPSS 0.18%

• 2026-01-26

  CVE-2025-59472

  CVSS 5.9 mediumEPSS 0.43%

• 2026-01-26

  CVE-2025-59471

  CVSS 5.9 mediumEPSS 0.49%

• 2025-12-11

  CVE-2025-67779

  CVSS 7.5 highEPSS 20.0%

• 2025-12-11

  CVE-2025-55184

  CVSS 7.5 highEPSS 66.6%

All vendors’ CVEs · JSON · Markdown

• CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (opens in new tab)
• This product uses data from the NVD API but is not endorsed or certified by the NVD. (opens in new tab)
• Known Exploited Vulnerabilities catalog from CISA. (opens in new tab)
• EPSS scores from FIRST (Exploit Prediction Scoring System). (opens in new tab)