Is the stack on fire?

Vercel’s AI SDK's filetype whitelists can be bypassed when uploading files · patched in 5.0.52

Vercel’s AI SDK's filetype whitelists can be bypassed when uploading files · patched in 5.1.0-beta.9

Drizzle ORM has SQL injection via improperly escaped SQL identifiers · patched in 0.45.2

Drizzle ORM has SQL injection via improperly escaped SQL identifiers · patched in 1.0.0-beta.20

Next.js: Server-Side Request Forgery in Server Actions on custom servers · patched in 15.5.21

Next.js: Server-Side Request Forgery in Server Actions on custom servers · patched in 16.2.11

Next.js: Cache confusion of response bodies for requests with bodies · patched in 15.5.21

Next.js: Cache confusion of response bodies for requests with bodies · patched in 16.2.11

Next.js: Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences · patched in 15.5.21

Next.js: Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences · patched in 16.2.11

Next.js: Unbounded Server Action payload in Edge runtime · patched in 15.5.21

Next.js: Unbounded Server Action payload in Edge runtime · patched in 16.2.11

Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname · patched in 15.5.21

Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname · patched in 16.2.11

Next.js: Denial of Service in the Image Optimization API using SVGs · patched in 15.5.21

Next.js: Denial of Service in the Image Optimization API using SVGs · patched in 16.2.11

Next.js: Unauthenticated disclosure of internal Server Function endpoints · patched in 15.5.21

Next.js: Unauthenticated disclosure of internal Server Function endpoints · patched in 16.2.11

Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale · patched in 16.2.11

Next.js: Denial of Service in App Router using Server Actions · patched in 15.5.21

Next.js: Denial of Service in App Router using Server Actions · patched in 16.2.11

Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Up · patched in 15.5.18

Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Up · patched in 16.2.6

Next.js's Middleware / Proxy redirects can be cache-poisoned · patched in 15.5.16

Next.js's Middleware / Proxy redirects can be cache-poisoned · patched in 16.2.5

Next.js vulnerable to cross-site scripting in App Router applications using CSP nonces · patched in 15.5.16

Next.js vulnerable to cross-site scripting in App Router applications using CSP nonces · patched in 16.2.5

Next.js vulnerable to cache poisoning via collisions in React Server Component cache-busting · patched in 15.5.16

Next.js vulnerable to cache poisoning via collisions in React Server Component cache-busting · patched in 16.2.5

Next.js has cross-site scripting in beforeInteractive scripts with untrusted input · patched in 15.5.16

Next.js has cross-site scripting in beforeInteractive scripts with untrusted input · patched in 16.2.5

Next.js vulnerable to Denial of Service via connection exhaustion in applications using Cache Components · patched in 15.5.16

Next.js vulnerable to Denial of Service via connection exhaustion in applications using Cache Components · patched in 16.2.5

Next.js has a Denial of Service in the Image Optimization API · patched in 15.5.16

Next.js has a Denial of Service in the Image Optimization API · patched in 16.2.5

Next.js vulnerable to server-side request forgery in applications using WebSocket upgrades · patched in 15.5.16

Next.js vulnerable to server-side request forgery in applications using WebSocket upgrades · patched in 16.2.5

Next.js vulnerable to cache poisoning in React Server Component responses · patched in 15.5.16

Next.js vulnerable to cache poisoning in React Server Component responses · patched in 16.2.5

Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes · patched in 15.5.16

Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes · patched in 16.2.5

Next.js has a Middleware / Proxy bypass through dynamic route parameter injection · patched in 15.5.16

Next.js has a Middleware / Proxy bypass through dynamic route parameter injection · patched in 16.2.5

Next.js has a Middleware / Proxy bypass in Pages Router applications using i18n · patched in 15.5.16

Next.js has a Middleware / Proxy bypass in Pages Router applications using i18n · patched in 16.2.5

Next.js Vulnerable to Denial of Service with Server Components · patched in 15.5.16

Next.js Vulnerable to Denial of Service with Server Components · patched in 16.2.5

Next.js has a Denial of Service with Server Components · patched in 15.5.15

Next.js has a Denial of Service with Server Components · patched in 16.2.3

Next.js: HTTP request smuggling in rewrites · patched in 16.1.7

Next.js: HTTP request smuggling in rewrites · patched in 15.5.13

Next.js: Unbounded next/image disk cache growth can exhaust storage · patched in 16.1.7

Next.js: Unbounded next/image disk cache growth can exhaust storage · patched in 15.5.14

Next.js: Unbounded postponed resume buffering can lead to DoS · patched in 16.1.7

Next.js: null origin can bypass Server Actions CSRF checks · patched in 16.1.7

Next.js: null origin can bypass dev HMR websocket CSRF checks · patched in 16.1.7

Next.js HTTP request deserialization can lead to DoS when using insecure React Server Components · patched in 15.0.8

Next.js HTTP request deserialization can lead to DoS when using insecure React Server Components · patched in 15.1.12

Next.js HTTP request deserialization can lead to DoS when using insecure React Server Components · patched in 15.2.9

Next.js HTTP request deserialization can lead to DoS when using insecure React Server Components · patched in 15.3.9

Next.js HTTP request deserialization can lead to DoS when using insecure React Server Components · patched in 15.4.11

Next.js HTTP request deserialization can lead to DoS when using insecure React Server Components · patched in 15.5.10

Next.js HTTP request deserialization can lead to DoS when using insecure React Server Components · patched in 15.6.0-canary.61

Next.js HTTP request deserialization can lead to DoS when using insecure React Server Components · patched in 16.0.11

Next.js HTTP request deserialization can lead to DoS when using insecure React Server Components · patched in 16.1.5

Next.js has Unbounded Memory Consumption via PPR Resume Endpoint · patched in 16.1.5

Next.js has Unbounded Memory Consumption via PPR Resume Endpoint · patched in 15.6.0-canary.61

Next.js has Unbounded Memory Consumption via PPR Resume Endpoint

Next.js has Unbounded Memory Consumption via PPR Resume Endpoint

Next.js has Unbounded Memory Consumption via PPR Resume Endpoint

Next.js has Unbounded Memory Consumption via PPR Resume Endpoint

Next.js has Unbounded Memory Consumption via PPR Resume Endpoint

Next.js has Unbounded Memory Consumption via PPR Resume Endpoint

Next.js has Unbounded Memory Consumption via PPR Resume Endpoint

Next.js has Unbounded Memory Consumption via PPR Resume Endpoint

Next.js has Unbounded Memory Consumption via PPR Resume Endpoint

Next.js has Unbounded Memory Consumption via PPR Resume Endpoint

Next.js has Unbounded Memory Consumption via PPR Resume Endpoint

Next.js has Unbounded Memory Consumption via PPR Resume Endpoint

Next.js has Unbounded Memory Consumption via PPR Resume Endpoint

Next.js has Unbounded Memory Consumption via PPR Resume Endpoint

Next.js self-hosted applications vulnerable to DoS via Image Optimizer remotePatterns configuration · patched in 15.5.10

Next.js self-hosted applications vulnerable to DoS via Image Optimizer remotePatterns configuration · patched in 16.1.5

Next has a Denial of Service with Server Components - Incomplete Fix Follow-Up · patched in 14.2.35

Next has a Denial of Service with Server Components - Incomplete Fix Follow-Up · patched in 15.0.7

Next has a Denial of Service with Server Components - Incomplete Fix Follow-Up · patched in 15.1.11

Next has a Denial of Service with Server Components - Incomplete Fix Follow-Up · patched in 15.2.8

Next has a Denial of Service with Server Components - Incomplete Fix Follow-Up · patched in 15.3.8

Next has a Denial of Service with Server Components - Incomplete Fix Follow-Up · patched in 15.4.10

Next has a Denial of Service with Server Components - Incomplete Fix Follow-Up · patched in 15.5.9

Next has a Denial of Service with Server Components - Incomplete Fix Follow-Up · patched in 15.6.0-canary.60

Next has a Denial of Service with Server Components - Incomplete Fix Follow-Up · patched in 16.0.10

Next has a Denial of Service with Server Components - Incomplete Fix Follow-Up · patched in 16.1.0-canary.19

Next Server Actions Source Code Exposure · patched in 15.0.6

Next Server Actions Source Code Exposure · patched in 15.1.10

Next Server Actions Source Code Exposure · patched in 15.2.7

Next Server Actions Source Code Exposure · patched in 15.3.7

Next Server Actions Source Code Exposure · patched in 15.4.9

Next Server Actions Source Code Exposure · patched in 15.5.8

Next Server Actions Source Code Exposure · patched in 15.6.0-canary.59

Next Server Actions Source Code Exposure · patched in 16.0.9

Next Server Actions Source Code Exposure · patched in 16.1.0-canary.17

Next Vulnerable to Denial of Service with Server Components · patched in 14.2.34

Next Vulnerable to Denial of Service with Server Components · patched in 15.0.6

Next Vulnerable to Denial of Service with Server Components · patched in 15.1.10

Next Vulnerable to Denial of Service with Server Components · patched in 15.2.7

Next Vulnerable to Denial of Service with Server Components · patched in 15.3.7

Next Vulnerable to Denial of Service with Server Components · patched in 15.4.9

Next Vulnerable to Denial of Service with Server Components · patched in 15.5.8

Next Vulnerable to Denial of Service with Server Components · patched in 15.6.0-canary.59

Next Vulnerable to Denial of Service with Server Components · patched in 16.0.9

Next Vulnerable to Denial of Service with Server Components · patched in 16.1.0-canary.17

Next.js is vulnerable to RCE in React flight protocol · patched in 15.0.5

Next.js is vulnerable to RCE in React flight protocol · patched in 15.2.6

Next.js is vulnerable to RCE in React flight protocol · patched in 15.3.6

Next.js is vulnerable to RCE in React flight protocol · patched in 15.4.8

Next.js is vulnerable to RCE in React flight protocol · patched in 16.0.7

Next.js is vulnerable to RCE in React flight protocol · patched in 15.1.9

Next.js is vulnerable to RCE in React flight protocol · patched in 15.5.7

Next.js Affected by Cache Key Confusion for Image Optimization API Routes · patched in 15.4.5

Next.js Affected by Cache Key Confusion for Image Optimization API Routes · patched in 14.2.31

Next.js Content Injection Vulnerability for Image Optimization · patched in 15.4.5

Next.js Content Injection Vulnerability for Image Optimization · patched in 14.2.31

Next.js Improper Middleware Redirect Handling Leads to SSRF · patched in 15.4.7

Next.js Improper Middleware Redirect Handling Leads to SSRF · patched in 14.2.32

Next.JS vulnerability can lead to DoS via cache poisoning · patched in 15.1.8

Next.js has a Cache poisoning vulnerability due to omission of the Vary header · patched in 15.3.3

Information exposure in Next.js dev server due to lack of origin verification · patched in 15.2.2

Information exposure in Next.js dev server due to lack of origin verification · patched in 14.2.30

Next.js Race Condition to Cache Poisoning · patched in 15.1.6

Next.js Race Condition to Cache Poisoning · patched in 14.2.24

Next.js may leak x-middleware-subrequest-id to external hosts · patched in 12.3.6

Next.js may leak x-middleware-subrequest-id to external hosts · patched in 13.5.10

Next.js may leak x-middleware-subrequest-id to external hosts · patched in 14.2.26

Next.js may leak x-middleware-subrequest-id to external hosts · patched in 15.2.4

Authorization Bypass in Next.js Middleware · patched in 13.5.9

Authorization Bypass in Next.js Middleware · patched in 14.2.25

Authorization Bypass in Next.js Middleware · patched in 15.2.3

Authorization Bypass in Next.js Middleware · patched in 12.3.5

Next.js Allows a Denial of Service (DoS) with Server Actions · patched in 13.5.8

Next.js Allows a Denial of Service (DoS) with Server Actions · patched in 14.2.21

Next.js Allows a Denial of Service (DoS) with Server Actions · patched in 15.1.2

Next.js authorization bypass vulnerability · patched in 14.2.15

Denial of Service condition in Next.js image optimization · patched in 14.2.7

Next.js Cache Poisoning · patched in 13.5.7

Next.js Cache Poisoning · patched in 14.2.10

Next.js Denial of Service (DoS) condition · patched in 13.5.0

Next.js Server-Side Request Forgery in Server Actions · patched in 14.1.1

Next.js Vulnerable to HTTP Request Smuggling · patched in 13.5.1

Next.js missing cache-control header may lead to CDN caching empty reply · patched in 13.4.20-canary.13

Unexpected server crash in Next.js · patched in 12.2.4

Improper CSP in Image Optimization API for Next.js versions between 10.0.0 and 12.1.0 · patched in 12.1.0

Denial of Service Vulnerability in next.js · patched in 12.0.9

Unexpected server crash in Next.js. · patched in 12.0.5

Unexpected server crash in Next.js. · patched in 11.1.3

XSS in Image Optimization API for Next.js · patched in 11.1.1

Open Redirect in Next.js · patched in 11.1.0

Open Redirect in Next.js versions · patched in 9.5.4

Remote Code Execution in next · patched in 5.1.0

Directory Traversal in Next.js · patched in 9.3.2

Next.js has cross site scripting (XSS) vulnerability via the 404 or 500 /_error page · patched in 7.0.2

Directory traversal vulnerability in Next.js · patched in 4.2.3

Next.js Directory Traversal Vulnerability · patched in 2.4.1

next-mdx-remote affected by arbitrary code execution in React server-side rendering of untrusted MDX content · patched in 6.0.0

Cross-Site Scripting in react · patched in 0.4.2

Cross-Site Scripting in react · patched in 0.5.2

Cross-Site Scripting in react · patched in 0.14.0

Cross-Site Scripting in react-dom · patched in 16.0.1

Cross-Site Scripting in react-dom · patched in 16.1.2

Cross-Site Scripting in react-dom · patched in 16.2.1

Cross-Site Scripting in react-dom · patched in 16.3.3

Cross-Site Scripting in react-dom · patched in 16.4.2