next@14.0.5-canary.16

next is a react framework.

Affected versions of this package are vulnerable to Use of Cache Containing Sensitive Information in createPatchedFetcher in packages/next/src/server/lib/patch-fetch.ts. An attacker can leak a cached response body from one request to another by sending server-side fetch(new Request(...), init) calls to the same URL with different request bodies or overrides. When the Request object and the separate init object diverge, the fetch cache can key the request differently from the effective upstream request, so a response generated for one body is reused for a different body. This exposes confidential data in cached POST responses to unauthorized requests.

Notes

• Applications using the Pages Router are not in scope for this issue; the advisory applies to the server-side patched fetch path.
• The leak requires fetch(new Request(...), init) where the separate init overrides the base Request; fetch(new Request(init), init) is the safe shape called out by the maintainers.

Upgrade next to version 15.5.21, 16.2.11 or higher.

next is a react framework.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the areAllActionIdsValid validation in server action form submission handling. An attacker can exhaust CPU and block other requests in the same process by sending a crafted form payload with many $ACTION_REF_ fields to a page that uses Server Actions. The vulnerable code processes these malformed MPA form submissions before deeper action decoding work, so repeated oversized action-reference fields force excessive validation work on the server. Applications using the App Router with at least one Server Action are affected; Pages Router apps and apps without Server Actions are not.

Notes

• The vulnerable path is in App Router’s MPA form-submission validation, so the expensive validation work is exercised before action decoding on requests carrying server-action form data rather than during the action handler itself.
• The malformed payload pattern is specific to repeated $ACTION_REF_ fields in the form body; ordinary Server Action submissions are not affected unless they include an unusually large number of those reference fields.

Upgrade next to version 15.5.21, 16.2.11 or higher.

next is a react framework.

Affected versions of this package are vulnerable to Insertion of Sensitive Information Into Sent Data in action-handler.ts and action-utils.ts. An attacker can enumerate internal Server Action IDs by sending crafted Next-Action requests or probing client-served artifacts that reference those IDs. This exposes the presence of internal server functions and enables endpoint discovery on apps that use Server Actions, increasing the risk of further abuse when combined with other weaknesses.

Notes

• Publicly served client artifacts can reveal the full Server Action ID format, so the disclosure is not limited to active probing with Next-Action; attackers can also recover candidate IDs from browser-delivered chunks and manifests in apps that ship Server Actions.
• The advisory also covers use cache endpoints exposed through the same App Router server-function machinery, not just use server actions.

Workarounds

• Never assume authentication at the use cache or use server boundary; authenticate inside the Server Action or cache boundary itself so unauthenticated users cannot reach the internal endpoint.

Upgrade next to version 15.5.21, 16.2.11 or higher.

next is a react framework.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the handleAction Server Actions path in the App Router Edge runtime. An attacker can exhaust server memory by sending an oversized Server Action request, especially a multipart form submission, because the Edge handler reads the full body without enforcing serverActions.bodySizeLimit. This can crash or destabilize affected deployments and prevent legitimate Server Action requests from being processed.

Notes

• Affected deployments need App Router pages with at least one Server Action running in the Edge runtime; the issue is in that execution path rather than in Server Actions generally.
• The advisory’s practical ceiling is tied to hosting-side request body limits: if the platform does not cap uploads, an oversized multipart action request can still drive memory growth before application code sees it.

Workarounds

• Limit Server Actions request bodies at your hosting provider to 5 MiB maximum, so oversized multipart submissions cannot reach the Edge runtime and trigger excessive memory use.

Upgrade next to version 15.5.21, 16.2.11 or higher.

next is a react framework.

Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via the IncrementalCache.generateCacheKey function in next/dist/server/lib/incremental-cache. An attacker can make a server-side fetch return a cached response body from a different request by sending POST requests to the same URL with different non-UTF-8 request bodies that collapse to the same cache key. The affected cache key generation decodes request bodies as strings, so distinct byte sequences with invalid UTF-8 can hash to the same entry even though the requests are not deduped. This can leak confidential response data from one POST to an unauthorized request that uses a colliding body, breaking response isolation for server-side cached fetches.

Notes

• Applications using Pages Router are not affected; the advisory’s cache-key confusion is in the server-side fetch cache path used by the App Router/IncrementalCache flow.
• The issue is only reachable when request bodies are sent with a non-UTF-8 charset or otherwise contain byte sequences that do not round-trip as UTF-8; default UTF-8 request bodies do not trigger the collision described in the advisory.

Upgrade next to version 15.5.21, 16.2.11 or higher.

next is a react framework.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the CSP nonce headers. An attacker can inject malicious scripts into cached HTML responses by supplying malformed nonce values, which may then be executed in the browsers of subsequent visitors. This is possible when applications are deployed behind shared caches and rely on request-derived nonce values.

Upgrade next to version 15.5.16, 16.2.5 or higher.

next is a react framework.

Affected versions of this package are vulnerable to Incorrect Authorization in the /_next/data/<buildId>/<page>.json route when i18n is configured and authorization is enforced via middleware or proxy. An attacker can gain unauthorized access to sensitive server-side-rendered JSON data for protected pages by making locale-less requests that bypass the intended authorization checks.

Upgrade next to version 15.5.16, 16.2.5 or higher.

next is a react framework.

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) via crafted WebSocket upgrade requests. An attacker can access internal or external resources by sending specially crafted requests with absolute-url that cause the server to proxy connections to arbitrary destinations, potentially exposing sensitive internal services or cloud metadata endpoints.

Upgrade next to version 15.5.16, 16.2.5 or higher.

next is a react framework.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) in the beforeInteractive process, when untrusted input is embedded without proper escaping. An attacker can execute arbitrary JavaScript in a user's browser by injecting malicious content into the serialized script.

Upgrade next to version 15.5.16, 16.2.5 or higher.

next is a react framework.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the Image Optimization API when handling requests to the /_next/image endpoint that match the images.localPatterns configuration. An attacker can exhaust server memory and cause a denial of service by requesting large local assets, leading to out-of-memory conditions.

Note: This is only exploitable if the default image loader is used and the images.localPatterns configuration allows access to large local files.

Upgrade next to version 15.5.16, 16.2.5 or higher.

next is a react framework.

Affected versions of this package are vulnerable to Use of Weak Hash via collisions in the _rsc cache-busting process. An attacker can manipulate cache entries by crafting requests that cause shared caches to serve incorrect response variants to users. This is only exploitable if deployments rely on shared caches with insufficient response partitioning.

Upgrade next to version 15.5.16, 16.2.5 or higher.

next is a react framework.

Affected versions of this package are vulnerable to Acceptance of Extraneous Untrusted Data With Trusted Data through the improper handling of the x-nextjs-data header in middleware or proxy redirect responses. An attacker can disrupt access to redirect paths by injecting this header in requests, causing the middleware to generate a redirect response lacking a standard Location header. If a CDN or reverse proxy caches this malformed response without varying on the injected header, subsequent users may receive unusable redirects, resulting in service disruption until the cache is cleared.

Upgrade next to version 15.5.16, 16.2.5 or higher.

next is a react framework.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via server function endpoints. An attacker can cause out-of-memory exceptions or induce excessive CPU usage by sending malicious FormData in an HTTP request.

Note: Only React apps that use React Server Components are vulnerable.

Upgrade next to version 15.5.16, 16.2.5 or higher.

next is a react framework.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the createMap, createSet, and extractIterator functions in packages/react-server/src/ReactFlightReplyServer.js. An attacker can crash the server by supplying a model that contains cyclic reference and is consumed more than once during React Server Components decoding. The repeated consumption triggers an exception during reply processing, breaking rendering for requests that handle attacker-controlled Flight payloads.

Upgrade next to version 15.5.15, 16.2.3 or higher.

next is a react framework.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the decoding reply functions of React Flight protocol. An attacker can cause server crashes, out-of-memory exceptions, or excessive CPU usage by sending specially crafted HTTP requests to Server Function endpoints.

Notes:

• This issue is a result of an incomplete fix for CVE-2025-55184
• If your app’s React code does not use a server, your app is not affected by these vulnerabilities.
• If your app does not use a framework, bundler, or bundler plugin that supports React Server Components, your app is not affected by these vulnerabilities.

Upgrade next to version 15.0.8, 15.1.12, 15.2.9, 15.3.9, 15.4.11, 15.5.10, 15.6.0-canary.61, 16.0.11, 16.1.5, 16.2.0-canary.9 or higher.

next is a react framework.

Affected versions of this package are vulnerable to HTTP Request Smuggling during the rewrite of the proxy traffic to an external backend. An attacker can access unintended backend routes by sending crafted DELETE or OPTIONS requests with Transfer-Encoding: chunked headers. This is only exploitable if the application is not hosted on providers that handle rewrites at the CDN level.

Upgrade next to version 15.5.13, 16.1.7, 16.2.0-canary.102 or higher.

next is a react framework.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the lack of an upper bound on the disk cache used by the image optimization. An attacker can exhaust disk storage by generating a large number of unique image optimization variants, leading to service disruption.

Upgrade next to version 16.1.7, 16.2.0-canary.54 or higher.

next is a react framework.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the fetchExternalImage() function, which is used for image optimization and loads external images into memory without a maximum size limit. An attacker can exhaust system memory and disrupt service availability by requesting optimization of very large images from external domains.

Note:

This is only exploitable if remotePatterns is configured to allow image optimization from external domains and the attacker can serve or control a large image on an allowed domain.

Upgrade next to version 15.5.10, 16.1.1-canary.15, 16.1.5 or higher.

next is a react framework.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data due to unsafe deserialization of payloads from HTTP requests to Server Function endpoints. An attacker can cause the server process to enter an infinite loop and hang, preventing it from serving future HTTP requests by sending specially crafted payloads.

Notes:

Even if your app does not implement any React Server Function endpoints it may still be vulnerable if your app supports React Server Components.

If your app’s React code does not use a server, your app is not affected by these vulnerabilities. If your app does not use a framework, bundler, or bundler plugin that supports React Server Components, your app is not affected by these vulnerabilities.

For React Native users not using a monorepo or react-dom, your react version should be pinned in your package.json, and there are no additional steps needed.

If you are using React Native in a monorepo, you should update only the impacted packages if they are installed: react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack. This is required to mitigate the security advisories, but you do not need to update react and react-dom so this will not cause the version mismatch error in React Native. See this issue for more information.

Upgrade next to version 14.2.34, 15.0.6, 15.1.10, 15.2.7, 15.3.7, 15.4.9, 15.5.8, 16.0.9, 16.1.0-canary.19 or higher.

next is a react framework.

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) via the resolve-routes. An attacker can access internal resources and potentially exfiltrate sensitive information by crafting requests containing user-controlled headers (e.g., Location) that are forwarded or interpreted without validation.

Note: This is only exploitable if custom middleware logic is implemented in a self-hosted deployment. The project maintainers recommend using the documented NextResponse.next({request}) to explicitly pass the request object.

Upgrade next to version 14.2.32, 15.4.2-canary.43, 15.4.7 or higher.

next is a react framework.

Affected versions of this package are vulnerable to Use of Cache Containing Sensitive Information in the image optimization process, when responses from API routes vary based on request headers such as Cookie or Authorization. An attacker can gain unauthorized access to sensitive image data by exploiting cache key confusion, causing responses intended for authenticated users to be served to unauthorized users.

Note: Exploitation requires a prior authorized request to populate the cache.

Upgrade next to version 14.2.31, 15.4.2-canary.19, 15.4.5 or higher.

next is a react framework.

Affected versions of this package are vulnerable to Missing Source Correlation of Multiple Independent Data in image-optimizer. An attacker can cause arbitrary files to be downloaded with attacker-controlled content and filenames by supplying malicious external image sources.

Note: This is only exploitable if the application is configured to allow external image sources via the images.domains or images.remotePatterns configuration.

Upgrade next to version 14.2.31, 15.4.2-canary.19, 15.4.5 or higher.

next is a react framework.

Affected versions of this package are vulnerable to Missing Origin Validation in WebSockets when running next dev and the project uses the App Router. An attacker can access the source code of client components by exploiting the Cross-site WebSocket hijacking (CSWSH) attack when a user visits a malicious link while having the server running locally.

Upgrade next to version 14.2.30, 15.2.2 or higher.

next is a react framework.

Affected versions of this package are vulnerable to Race Condition in the Pages Router. An attacker can cause the server to serve incorrect pageProps data instead of the expected HTML content by exploiting a race condition between two requests, one containing the ?__nextDataRequest=1 query parameter and another with the x-now-route-matches header.

Notes:

1. This is only exploitable if the CDN provider caches a 200 OK response even in the absence of explicit cache-control headers, enabling a poisoned response to persist and be served to subsequent users;

2. No backend access or privileged escalation is possible through this vulnerability;

3. Applications hosted on Vercel's platform are not affected by this issue, as the platform does not cache responses based solely on 200 OK status without explicit cache-control headers.

4. This is a bypass of the fix for CVE-2024-46982

Upgrade next to version 14.2.24, 15.1.6 or higher.

next is a react framework.

Affected versions of this package are vulnerable to Improper Authorization due to the improper handling of the x-middleware-subrequest header. An attacker can bypass authorization checks by sending crafted requests containing this specific header.

Upgrade next to version 12.3.5, 13.5.9, 14.2.25, 15.2.3, 15.3.0-canary.12 or higher.

next is a react framework.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the Server Actions process. An attacker can cause the server to hang by constructing requests that leave Server-Actions requests pending until the hosting provider terminates the function execution.

Note:

This is only exploitable if there are no protections against long-running Server Action invocations.

Upgrade next to version 13.5.8, 14.2.21, 15.1.2 or higher.

next is a react framework.

Affected versions of this package are vulnerable to Missing Authorization when using pathname-based checks in middleware for authorization decisions. If i18n configuration is not configured, an attacker can get unintended access to pages one level under the application's root directory.

e.g. https://example.com/foo is accessible. https://example.com/ and https://example.com/foo/bar are not.

Note:

Only self-hosted applications are vulnerable. The vulnerability has been fixed by Vercel on the server side.

Upgrade next to version 13.5.8, 14.2.15, 15.0.0-canary.177 or higher.

next is a react framework.

Affected versions of this package are vulnerable to Uncontrolled Recursion through the image optimization feature. An attacker can cause excessive CPU consumption by exploiting this vulnerability.

Upgrade next to version 14.2.7, 15.0.0-canary.109 or higher.

next is a react framework.

Affected versions of this package are vulnerable to Acceptance of Extraneous Untrusted Data With Trusted Data by sending a crafted HTTP request, which allows the attacker to poison the cache of a non-dynamic server-side rendered route in the page router. This will coerce the request to cache a route that is meant to not be cached and send a Cache-Control: s-maxage=1, a stale-while-revalidate header, which some upstream CDNs may cache as well.

Note:

This is only vulnerable if:

1. The user is using pages router

2. The user is using non-dynamic server-side rendered routes.

Users are not affected if:

1. They are using the app router

2. The deployments are on Vercel

Upgrade next to version 13.5.7, 14.2.10 or higher.