Componentpedia: next : 14.2.32 issues and vulnerabilities | Meterian Boost Open Source Security Resource

CWE-1395
Threat level: CRITICAL | CVSS score: 9.5

Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used

CVE-2026-27980
CWE-400
Threat level: MEDIUM | CVSS score: 5

The default Next.js image optimization disk cache (/_next/image) did not have a configurable upper bound, allowing unbounded cache growth.

CVE-2025-59471
CWE-400
Threat level: MEDIUM | CVSS score: 5

Strongly consider upgrading to 15.5.10 and 16.1.5 to reduce risk and prevent availability issues in Next applications.

CWE-770
Threat level: HIGH | CVSS score: 8

A specially crafted HTTP request can be sent to any App Router Server Function endpoint that, when deserialized, may trigger excessive CPU usage. This can result in denial of service in unpatched environments.

CVE-2026-29057
CWE-444
Threat level: MEDIUM | CVSS score: 5

When Next.js rewrites proxy traffic to an external backend, a crafted DELETE/OPTIONS request using Transfer-Encoding: chunked could trigger request boundary disagreement between the proxy and backend. This could allow request smuggling through rewritten routes.

CVE-2026-23864
CWE-400
Threat level: HIGH | CVSS score: 8

A specially crafted HTTP request can be sent to any App Router Server Function endpoint that, when deserialized, may trigger excessive CPU usage, out-of-memory exceptions, or server crashes. This can result in denial of service in unpatched environments.

Componentpedia / Listings / next / 14.2.32

next