# Vercel CVEs > Vercel: 84 CVEs mapped to its software or packages (1 in CISA KEV), newest first, with CVSS and EPSS. Canonical: https://rewindex.com/company/vercel/cves Last updated: 2026-10-22T15:22:10Z 84 CVEs map to Vercel (1 in CISA KEV), newest first. Page 1. Query: `?sev=critical|high|medium|low&kev=yes|no&min_cvss=0..10&q=&page=N`. Company profile: [Vercel](https://rewindex.com/company/vercel.md) Scope: CVEs mapped to a company Rewindex tracks (by CVE affected-product data, NVD CPE, vendor advisories and package feeds), every entry in CISA’s Known Exploited Vulnerabilities catalog, and CVEs named in a tracked status incident. Other CVEs are not listed. A mapped CVE is not a statement that Vercel’s hosted service was exposed. | Published (UTC) | CVE | Title | CVSS | KEV | | --- | --- | --- | --- | --- | | 2026-10-22 | [CVE-2026-94482](https://rewindex.com/cve/CVE-2026-94482.md) | Next.js: Denial of Service in App Router using Server Actions | 8.2 high | | | 2026-10-12 | [CVE-2026-109375](https://rewindex.com/cve/CVE-2026-109375.md) | Vercel deepsec before 1.1.17 Arbitrary File Write via Symlink in Sandbox Tarball Extraction | 6.1 medium | | | 2026-10-02 | [CVE-2026-94484](https://rewindex.com/cve/CVE-2026-94484.md) | Next.js: Cache poisoning in Next.js SSG/ISR rendering leads to cross-user content substitution and persistent denial of service | 4.8 medium | | | 2026-10-02 | [CVE-2026-94485](https://rewindex.com/cve/CVE-2026-94485.md) | Next.js: Information disclosure in Next.js App Router metadata image routes via dynamicParams bypass | 5.3 medium | | | 2026-10-02 | [CVE-2026-94483](https://rewindex.com/cve/CVE-2026-94483.md) | Next.js: Server-Side Request Forgery in Image Optimization | 6.5 medium | | | 2026-10-02 | [CVE-2026-94543](https://rewindex.com/cve/CVE-2026-94543.md) | Next.js: Cache poisoning of SSG and ISR pages in self-hosted Next.js applications | 5.3 medium | | | 2026-10-02 | [CVE-2026-94544](https://rewindex.com/cve/CVE-2026-94544.md) | Next.js: Pending \`use cache\` fill can leak Draft Mode content into regular responses and persisted pages | 4.2 medium | | | 2026-10-02 | [CVE-2026-94486](https://rewindex.com/cve/CVE-2026-94486.md) | Next.js: Information disclosure in the Next.js development server's Model Context Protocol endpoint | 5.4 medium | | | 2026-10-01 | [CVE-2026-103004](https://rewindex.com/cve/CVE-2026-103004.md) | next.js cache leak on warm \`use cache\` handlers accessing root param | 5.3 medium | | | 2026-09-30 | [CVE-2026-94545](https://rewindex.com/cve/CVE-2026-94545.md) | Satori-generated SVG has improper escaping | 5.3 medium | | | 2026-09-01 | [CVE-2026-75604](https://rewindex.com/cve/CVE-2026-75604.md) | Next.js: Unauthenticated Remote Code Execution on windows-hosted servers | 9.0 critical | | | 2026-07-27 | [CVE-2026-64649](https://rewindex.com/cve/CVE-2026-64649.md) | Next.js: Server-Side Request Forgery in Server Actions on Custom Servers | 6.5 medium | | | 2026-07-27 | [CVE-2026-64648](https://rewindex.com/cve/CVE-2026-64648.md) | Next.js: Response Body Cache Confusion for Requests Containing Bodies | 5.4 medium | | | 2026-07-27 | [CVE-2026-64647](https://rewindex.com/cve/CVE-2026-64647.md) | Next.js: Response Body Cache Confusion with Invalid UTF-8 Request Bodies | 5.4 medium | | | 2026-07-27 | [CVE-2026-64646](https://rewindex.com/cve/CVE-2026-64646.md) | Next.js: Unbounded Server Action payload in Edge runtime | 5.3 medium | | | 2026-07-27 | [CVE-2026-64644](https://rewindex.com/cve/CVE-2026-64644.md) | Next.js: Denial of Service in the Image Optimization API using SVGs | 5.3 medium | | | 2026-07-27 | [CVE-2026-64643](https://rewindex.com/cve/CVE-2026-64643.md) | Next.js: Unauthenticated Disclosure of Internal Server Function endpoints | 5.3 medium | | | 2026-07-27 | [CVE-2026-64642](https://rewindex.com/cve/CVE-2026-64642.md) | Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale | 8.2 high | | | 2026-07-27 | [CVE-2026-64641](https://rewindex.com/cve/CVE-2026-64641.md) | Next.js: Denial of Service in App Router using Server Actions | 7.5 high | | | 2026-07-27 | [CVE-2026-64645](https://rewindex.com/cve/CVE-2026-64645.md) | Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname | 6.1 medium | | | 2026-07-20 | [CVE-2026-64650](https://rewindex.com/cve/CVE-2026-64650.md) | AI SDK Codex Harness Tool Relay Authorization Bypass | 6.3 medium | | | 2026-07-20 | [CVE-2026-64651](https://rewindex.com/cve/CVE-2026-64651.md) | AI SDK OpenCode Harness Tool Relay Authorization Bypass | 6.3 medium | | | 2026-05-17 | [CVE-2026-8769](https://rewindex.com/cve/CVE-2026-8769.md) | vercel ai provider-utils response-handler.ts createJsonErrorResponseHandler resource consumption | 4.3 medium | | | 2026-05-17 | [CVE-2026-8768](https://rewindex.com/cve/CVE-2026-8768.md) | vercel ai provider-utils download-blob.ts validateDownloadUrl server-side request forgery | 7.3 high | | | 2026-05-17 | [CVE-2026-8767](https://rewindex.com/cve/CVE-2026-8767.md) | vercel ai PR Branch Name Interpolation prettier-on-automerge.yml run os command injection | 5.0 medium | | | 2026-05-15 | [CVE-2026-45773](https://rewindex.com/cve/CVE-2026-45773.md) | Turborepo: Login callback CSRF/session fixation | 6.5 medium | | | 2026-05-15 | [CVE-2026-46508](https://rewindex.com/cve/CVE-2026-46508.md) | Turborepo: VSCode Extension command injection | 7.8 high | | | 2026-05-15 | [CVE-2026-45772](https://rewindex.com/cve/CVE-2026-45772.md) | Turborepo: Unexpected local code execution during Yarn Berry detection | 9.8 critical | | | 2026-05-13 | [CVE-2026-45109](https://rewindex.com/cve/CVE-2026-45109.md) | Next.js: Middleware / Proxy bypass in App Router applications via segment-prefetch routes | 7.5 high | | | 2026-05-13 | [CVE-2026-44582](https://rewindex.com/cve/CVE-2026-44582.md) | Next.js: Cache poisoning via collisions in React Server Component cache-busting | 3.7 low | | | 2026-05-13 | [CVE-2026-44581](https://rewindex.com/cve/CVE-2026-44581.md) | Next.js: Cross-site scripting in App Router applications using CSP nonces | 4.7 medium | | | 2026-05-13 | [CVE-2026-44580](https://rewindex.com/cve/CVE-2026-44580.md) | Next.js: Cross-site scripting in beforeInteractive scripts with untrusted input | 6.1 medium | | | 2026-05-13 | [CVE-2026-44579](https://rewindex.com/cve/CVE-2026-44579.md) | Next.js: Denial of Service via connection exhaustion in applications using Cache Components | 7.5 high | | | 2026-05-13 | [CVE-2026-44578](https://rewindex.com/cve/CVE-2026-44578.md) | Next.js: Server-side request forgery in applications using WebSocket upgrades | 8.6 high | | | 2026-05-13 | [CVE-2026-44577](https://rewindex.com/cve/CVE-2026-44577.md) | Next.js: Denial of Service in the Image Optimization API | 5.9 medium | | | 2026-05-13 | [CVE-2026-44576](https://rewindex.com/cve/CVE-2026-44576.md) | Next.js: Cache poisoning in React Server Component responses | 5.4 medium | | | 2026-05-13 | [CVE-2026-44574](https://rewindex.com/cve/CVE-2026-44574.md) | Next.js: Middleware / Proxy bypass through dynamic route parameter injection | 8.1 high | | | 2026-05-13 | [CVE-2026-44575](https://rewindex.com/cve/CVE-2026-44575.md) | Next.js: Middleware / Proxy bypass in App Router applications via segment-prefetch routes | 7.5 high | | | 2026-05-13 | [CVE-2026-44573](https://rewindex.com/cve/CVE-2026-44573.md) | Next.js: Middleware / Proxy bypass in Pages Router applications using i18n | 7.5 high | | | 2026-05-13 | [CVE-2026-44572](https://rewindex.com/cve/CVE-2026-44572.md) | Next.js: Middleware / Proxy redirects can be cache-poisoned | 3.7 low | | | 2026-05-13 | [CVE-2026-44479](https://rewindex.com/cve/CVE-2026-44479.md) | Vercel: Non-interactive mode includes CLI arguments in suggested command output | 5.5 medium | | | 2026-03-18 | [CVE-2026-29057](https://rewindex.com/cve/CVE-2026-29057.md) | Next.js: HTTP request smuggling in rewrites | 6.5 medium | | | 2026-03-18 | [CVE-2026-27980](https://rewindex.com/cve/CVE-2026-27980.md) | Next.js: Unbounded next/image disk cache growth can exhaust storage | 7.5 high | | | 2026-03-18 | [CVE-2026-27979](https://rewindex.com/cve/CVE-2026-27979.md) | Next.js: Unbounded postponed resume buffering can lead to DoS | 7.5 high | | | 2026-03-17 | [CVE-2026-27978](https://rewindex.com/cve/CVE-2026-27978.md) | Next.js: null origin can bypass Server Actions CSRF checks | 4.3 medium | | | 2026-03-17 | [CVE-2026-27977](https://rewindex.com/cve/CVE-2026-27977.md) | Next.js: null origin can bypass dev HMR websocket CSRF checks | 5.4 medium | | | 2026-01-26 | [CVE-2025-59472](https://rewindex.com/cve/CVE-2025-59472.md) | | 5.9 medium | | | 2026-01-26 | [CVE-2025-59471](https://rewindex.com/cve/CVE-2025-59471.md) | | 5.9 medium | | | 2025-12-11 | [CVE-2025-67779](https://rewindex.com/cve/CVE-2025-67779.md) | | 7.5 high | | | 2025-12-11 | [CVE-2025-55184](https://rewindex.com/cve/CVE-2025-55184.md) | | 7.5 high | | Next page: [page 2](https://rewindex.com/company/vercel/cves.md?page=2) --- _Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_ ## Charts ### Chart data: CVEs per week, last 52 weeks (Vercel) Weeks start Monday, UTC. Bars: CVEs by published date (KEV date added if unpublished), by CVSS severity; kev_added: entries added to CISA KEV that week. Same filters as the list. The current week is partial. | Week of (UTC) | Critical | High | Medium | Low | Not scored | Added to KEV | | --- | --- | --- | --- | --- | --- | --- | | 2025-11-03 | 0 | 0 | 1 | 1 | 0 | 0 | | 2025-11-10 | 0 | 0 | 0 | 0 | 0 | 0 | | 2025-11-17 | 0 | 0 | 0 | 0 | 0 | 0 | | 2025-11-24 | 0 | 0 | 0 | 0 | 0 | 0 | | 2025-12-01 | 1 | 0 | 0 | 0 | 0 | 1 | | 2025-12-08 | 0 | 2 | 1 | 0 | 0 | 0 | | 2025-12-15 | 0 | 0 | 0 | 0 | 0 | 0 | | 2025-12-22 | 0 | 0 | 0 | 0 | 0 | 0 | | 2025-12-29 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-01-05 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-01-12 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-01-19 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-01-26 | 0 | 0 | 2 | 0 | 0 | 0 | | 2026-02-02 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-02-09 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-02-16 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-02-23 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-03-02 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-03-09 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-03-16 | 0 | 2 | 3 | 0 | 0 | 0 | | 2026-03-23 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-03-30 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-04-06 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-04-13 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-04-20 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-04-27 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-05-04 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-05-11 | 1 | 8 | 8 | 2 | 0 | 0 | | 2026-05-18 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-05-25 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-06-01 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-06-08 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-06-15 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-06-22 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-06-29 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-07-06 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-07-13 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-07-20 | 0 | 0 | 2 | 0 | 0 | 0 | | 2026-07-27 | 0 | 2 | 7 | 0 | 0 | 0 | | 2026-08-03 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-08-10 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-08-17 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-08-24 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-08-31 | 1 | 0 | 0 | 0 | 0 | 0 | | 2026-09-07 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-09-14 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-09-21 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-09-28 | 0 | 0 | 8 | 0 | 0 | 0 | | 2026-10-05 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-10-12 | 0 | 0 | 1 | 0 | 0 | 0 | | 2026-10-19 | 0 | 1 | 0 | 0 | 0 | 0 | | 2026-10-26 | 0 | 0 | 0 | 0 | 0 | 0 | --- Canonical: https://rewindex.com/company/vercel/cves · Markdown: https://rewindex.com/company/vercel/cves.md · JSON: https://rewindex.com/api/v1/companies/vercel/cves · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T02:05:44.696Z