next vulnerabilities

2 known vulnerabilities in next from Vercel. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  next: Uncontrolled Resource Consumption

  CVE-2025-59472Jan 26, 2026Vercel

  A denial of service vulnerability exists in Next.js versions with Partial Prerendering (PPR) enabled when running in minimal mode. The PPR resume endpoint accepts unauthenticated POST requests with the `Next-Resume: 1` header and processes attacker-controlled

• 7.5 High severity

  next: Uncontrolled Resource Consumption

  CVE-2025-59471Jan 26, 2026Vercel

  A denial of service vulnerability exists in self-hosted Next.js applications that have `remotePatterns` configured for the Image Optimizer. The image optimization endpoint (`/_next/image`) loads external images entirely into memory without enforcing a maximum