English

Lỗ hổng bảo mật Next.js

65 cảnh báo chạm tới Next.js 13 trở lên, mới nhất trước. Cập nhật 31/10/2026.

Hướng dẫn bảo mật

Giải thích các lỗ hổng nghiêm trọng

Mỗi lỗ hổng mức Nghiêm trọng có một trang tiếng Việt: chuyện gì xảy ra, ai bị ảnh hưởng, cách vá và cách tự kiểm tra.

Tóm tắt giữ nguyên tiếng Anh như trong cảnh báo gốc.

Ngày công bốMức độCảnh báoTóm tắtBản bị ảnh hưởng → bản vá
22/10/2026Nghiêm trọngCVSS 9.5GHSA-2464-fhr4-w9xwNext.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are usedGiải thích
  • >= 10.0.0, <= 15.5.27 → 15.5.28
  • >= 16.0.0, <= 16.4.0 → 16.4.1
22/10/2026Nghiêm trọngCVSS 9.5GHSA-673q-mjm6-r5xrNext.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arraysGiải thích
  • >= 16.0.0, <= 16.4.0 → 16.4.1
22/10/2026Trung bìnhCVSS 6.3GHSA-h694-7cp9-m8p3CVE-2026-103004next.js cache leak across root param values in nested 'use cache' functions
  • >= 16.3.0, < 16.3.8 → 16.3.8
22/10/2026CaoCVSS 8.2GHSA-p3m5-59mp-jv5rCVE-2026-94482Next.js: Denial of Service in App Router using Server Actions
  • >= 13.0.0, <= 15.5.27 → 15.5.28
  • >= 16.0.0, <= 16.4.0 → 16.4.1
07/10/2026ThấpCVSS 2.3GHSA-39w2-rjm5-chcvCVE-2026-94486Next.js has information disclosure in development server's Model Context Protocol endpoint
  • >= 16.0.0, < 16.3.8 → 16.3.8
07/10/2026Trung bìnhCVSS 6.3GHSA-3w37-wq28-93x7CVE-2026-94544Next.js: Pending `use cache` fill can leak Draft Mode content into regular responses and persisted pages
  • >= 16.3.0, < 16.3.8 → 16.3.8
07/10/2026Trung bìnhCVSS 6.3GHSA-4jqv-mc3x-m676CVE-2026-94543Next.js has cache poisoning of SSG and ISR pages in self-hosted applications
  • >= 15.0.0, < 15.5.27 → 15.5.27
  • >= 16.0.0, < 16.3.8 → 16.3.8
07/10/2026CaoCVSS 8.3GHSA-cjq9-62q9-8jv4CVE-2026-94483Next.js has Server-Side Request Forgery in Image Optimization
  • >= 16.0.0, < 16.3.8 → 16.3.8
07/10/2026Trung bìnhCVSS 6.3GHSA-f87g-xv8r-7p7xCVE-2026-94485Next.js has information disclosure in App Router metadata image routes via dynamicParams bypass
  • >= 16.0.0, < 16.3.8 → 16.3.8
07/10/2026Trung bìnhCVSS 6.3GHSA-mcj8-r9mp-w47pCVE-2026-94484Next.js has cache poisoning in SSG/ISR rendering that leads to cross-user content substitution and persistent denial of service
  • >= 16.0.0, < 16.3.8 → 16.3.8
  • >= 15.0.0, < 15.5.27 → 15.5.27
30/09/2026Nghiêm trọngCVSS 9.5GHSA-vcvr-r3jv-pc5jNext.js: Remote Code Execution in next/og ImageResponseGiải thích
  • >= 16.2.0, < 16.3.6 → 16.3.6
08/09/2026Nghiêm trọngCVSS 9.5GHSA-2xp9-vwfh-vxw4Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are usedGiải thích
  • >= 10.0.0, < 15.5.24 → 15.5.24
  • >= 16.0.0, < 16.3.3 → 16.3.3
08/09/2026Nghiêm trọngCVSS 9GHSA-p293-qw3h-jr36CVE-2026-75604Next.js: Unauthenticated Remote Code Execution on windows-hosted serversGiải thích
  • >= 13.4.0, < 15.5.24 → 15.5.24
  • >= 16.0.0, < 16.3.3 → 16.3.3
22/07/2026Trung bìnhCVSS 6.3GHSA-4633-3j49-mh5qCVE-2026-64647Next.js: Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences
  • >= 13.0.0, < 15.5.21 → 15.5.21
  • >= 16.0.0, < 16.2.11 → 16.2.11
22/07/2026Trung bìnhCVSS 6.3GHSA-4c39-4ccg-62r3CVE-2026-64646Next.js: Unbounded Server Action payload in Edge runtime
  • >= 13.0.0, < 15.5.21 → 15.5.21
  • >= 16.0.0, < 16.2.11 → 16.2.11
22/07/2026Trung bìnhCVSS 6GHSA-68g3-v927-f742CVE-2026-64648Next.js: Cache confusion of response bodies for requests with bodies
  • >= 13.0.0, < 15.5.21 → 15.5.21
  • >= 16.0.0, < 16.2.11 → 16.2.11
22/07/2026CaoCVSS 8.3GHSA-6gpp-xcg3-4w24CVE-2026-64642Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale
  • >= 16.0.0, < 16.2.11 → 16.2.11
22/07/2026CaoCVSS 8.3GHSA-89xv-2m56-2m9xCVE-2026-64649Next.js: Server-Side Request Forgery in Server Actions on custom servers
  • >= 14.1.1, < 15.5.21 → 15.5.21
  • >= 16.0.0, < 16.2.11 → 16.2.11
22/07/2026Trung bìnhCVSS 6.3GHSA-955p-x3mx-jcvpCVE-2026-64643Next.js: Unauthenticated disclosure of internal Server Function endpoints
  • >= 13.0.0, < 15.5.21 → 15.5.21
  • >= 16.0.0, < 16.2.11 → 16.2.11
22/07/2026CaoCVSS 8.2GHSA-m99w-x7hq-7vfjCVE-2026-64641Next.js: Denial of Service in App Router using Server Actions
  • >= 13.0.0, < 15.5.21 → 15.5.21
  • >= 16.0.0, < 16.2.11 → 16.2.11
22/07/2026CaoCVSS 8.3GHSA-p9j2-gv94-2wf4CVE-2026-64645Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname
  • >= 12.0.0, < 15.5.21 → 15.5.21
  • >= 16.0.0, < 16.2.11 → 16.2.11
22/07/2026Trung bìnhCVSS 6.3GHSA-q8wf-6r8g-63chCVE-2026-64644Next.js: Denial of Service in the Image Optimization API using SVGs
  • >= 15.5.0, < 15.5.21 → 15.5.21
  • >= 16.0.0, < 16.2.11 → 16.2.11
11/05/2026CaoCVSS 7.5GHSA-267c-6grr-h53fCVE-2026-44575Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes
  • >= 15.2.0, < 15.5.16 → 15.5.16
  • >= 16.0.0, < 16.2.5 → 16.2.5
11/05/2026CaoCVSS 7.5GHSA-26hh-7cqf-hhc6CVE-2026-45109Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Up
  • >= 15.2.0, < 15.5.18 → 15.5.18
  • >= 16.0.0, < 16.2.6 → 16.2.6
11/05/2026CaoCVSS 7.5GHSA-36qx-fr4f-26g5CVE-2026-44573Next.js has a Middleware / Proxy bypass in Pages Router applications using i18n
  • >= 12.2.0, < 15.5.16 → 15.5.16
  • >= 16.0.0, < 16.2.5 → 16.2.5
11/05/2026ThấpCVSS 3.7GHSA-3g8h-86w9-wvmqCVE-2026-44572Next.js's Middleware / Proxy redirects can be cache-poisoned
  • >= 12.2.0, < 15.5.16 → 15.5.16
  • >= 16.0.0, < 16.2.5 → 16.2.5
11/05/2026CaoCVSS 8.1GHSA-492v-c6pp-mqqvCVE-2026-44574Next.js has a Middleware / Proxy bypass through dynamic route parameter injection
  • >= 15.4.0, < 15.5.16 → 15.5.16
  • >= 16.0.0, < 16.2.5 → 16.2.5
11/05/2026CaoCVSS 7.5GHSA-8h8q-6873-q5fjNext.js Vulnerable to Denial of Service with Server Components
  • >= 13.0.0, < 15.5.16 → 15.5.16
  • >= 16.0.0, < 16.2.5 → 16.2.5
11/05/2026CaoCVSS 8.6GHSA-c4j6-fc7j-m34rCVE-2026-44578Next.js vulnerable to server-side request forgery in applications using WebSocket upgrades
  • >= 13.4.13, < 15.5.16 → 15.5.16
  • >= 16.0.0, < 16.2.5 → 16.2.5
11/05/2026Trung bìnhCVSS 4.7GHSA-ffhc-5mcf-pf4qCVE-2026-44581Next.js vulnerable to cross-site scripting in App Router applications using CSP nonces
  • >= 13.4.0, < 15.5.16 → 15.5.16
  • >= 16.0.0, < 16.2.5 → 16.2.5
11/05/2026Trung bìnhCVSS 6.1GHSA-gx5p-jg67-6x7hCVE-2026-44580Next.js has cross-site scripting in beforeInteractive scripts with untrusted input
  • >= 13.0.0, < 15.5.16 → 15.5.16
  • >= 16.0.0, < 16.2.5 → 16.2.5
11/05/2026Trung bìnhCVSS 5.9GHSA-h64f-5h5j-jqjhCVE-2026-44577Next.js has a Denial of Service in the Image Optimization API
  • >= 10.0.0, < 15.5.16 → 15.5.16
  • >= 16.0.0, < 16.2.5 → 16.2.5
11/05/2026CaoCVSS 7.5GHSA-mg66-mrh9-m8jxCVE-2026-44579Next.js vulnerable to Denial of Service via connection exhaustion in applications using Cache Components
  • >= 15.0.0, < 15.5.16 → 15.5.16
  • >= 16.0.0, < 16.2.5 → 16.2.5
11/05/2026ThấpCVSS 3.7GHSA-vfv6-92ff-j949CVE-2026-44582Next.js vulnerable to cache poisoning via collisions in React Server Component cache-busting
  • >= 13.4.6, < 15.5.16 → 15.5.16
  • >= 16.0.0, < 16.2.5 → 16.2.5
11/05/2026Trung bìnhCVSS 5.4GHSA-wfc6-r584-vfw7CVE-2026-44576Next.js vulnerable to cache poisoning in React Server Component responses
  • >= 14.2.0, < 15.5.16 → 15.5.16
  • >= 16.0.0, < 16.2.5 → 16.2.5
10/04/2026CaoCVSS 7.5GHSA-q4gf-8mx6-v5v3Next.js has a Denial of Service with Server Components
  • >= 13.0.0, < 15.5.15 → 15.5.15
  • >= 16.0.0-beta.0, < 16.2.3 → 16.2.3
17/03/2026Trung bìnhCVSS 6.9GHSA-3x4c-7xq6-9pq8CVE-2026-27980Next.js: Unbounded next/image disk cache growth can exhaust storage
  • >= 16.0.0-beta.0, < 16.1.7 → 16.1.7
  • >= 10.0.0, < 15.5.14 → 15.5.14
17/03/2026Trung bìnhCVSS 6.3GHSA-ggv3-7p47-pfv8CVE-2026-29057Next.js: HTTP request smuggling in rewrites
  • >= 16.0.0-beta.0, < 16.1.7 → 16.1.7
  • >= 9.5.0, < 15.5.13 → 15.5.13
17/03/2026Trung bìnhCVSS 6.9GHSA-h27x-g6w4-24gqCVE-2026-27979Next.js: Unbounded postponed resume buffering can lead to DoS
  • >= 16.0.1, < 16.1.7 → 16.1.7
17/03/2026ThấpCVSS 2.3GHSA-jcc7-9wpm-mj36CVE-2026-27977Next.js: null origin can bypass dev HMR websocket CSRF checks
  • >= 16.0.1, < 16.1.7 → 16.1.7
17/03/2026Trung bìnhCVSS 5.3GHSA-mq59-m269-xvcxCVE-2026-27978Next.js: null origin can bypass Server Actions CSRF checks
  • >= 16.0.1, < 16.1.7 → 16.1.7
28/01/2026Trung bìnhCVSS 5.9GHSA-5f7q-jpqc-wp7hCVE-2025-59472Next.js has Unbounded Memory Consumption via PPR Resume Endpoint
  • >= 16.0.0-beta.0, < 16.1.5 → 16.1.5
  • >= 15.6.0-canary.0, < 15.6.0-canary.61 → 15.6.0-canary.61
  • >= 15.0.0-canary.0, <= 15.0.0-canary.205 → chưa có bản vá
  • >= 15.0.1-canary.0, <= 15.0.1-canary.3 → chưa có bản vá
  • >= 15.0.2-canary.0, <= 15.0.2-canary.11 → chưa có bản vá
  • >= 15.0.3-canary.0, <= 15.0.3-canary.9 → chưa có bản vá
  • >= 15.0.4-canary.0, <= 15.0.4-canary.52 → chưa có bản vá
  • >= 15.1.1-canary.0, <= 15.1.1-canary.27 → chưa có bản vá
  • >= 15.2.0-canary.0, <= 15.2.0-canary.77 → chưa có bản vá
  • >= 15.2.1-canary.0, <= 15.2.1-canary.6 → chưa có bản vá
  • >= 15.2.2-canary.0, <= 15.2.2-canary.7 → chưa có bản vá
  • >= 15.3.0-canary.0, <= 15.3.0-canary.46 → chưa có bản vá
  • >= 15.3.1-canary.0, <= 15.3.1-canary.15 → chưa có bản vá
  • >= 15.4.0-canary.0, <= 15.4.0-canary.130 → chưa có bản vá
  • >= 15.4.2-canary.0, <= 15.4.2-canary.56 → chưa có bản vá
  • >= 15.5.1-canary.0, <= 15.5.1-canary.39 → chưa có bản vá
28/01/2026CaoCVSS 7.5GHSA-h25m-26qc-wcjfNext.js HTTP request deserialization can lead to DoS when using insecure React Server Components
  • >= 13.0.0, < 15.0.8 → 15.0.8
  • >= 15.1.1-canary.0, < 15.1.12 → 15.1.12
  • >= 15.2.0-canary.0, < 15.2.9 → 15.2.9
  • >= 15.3.0-canary.0, < 15.3.9 → 15.3.9
  • >= 15.4.0-canary.0, < 15.4.11 → 15.4.11
  • >= 15.5.1-canary.0, < 15.5.10 → 15.5.10
  • >= 15.6.0-canary.0, < 15.6.0-canary.61 → 15.6.0-canary.61
  • >= 16.0.0-beta.0, < 16.0.11 → 16.0.11
  • >= 16.1.0-canary.0, < 16.1.5 → 16.1.5
27/01/2026Trung bìnhCVSS 5.9GHSA-9g9p-9gw9-jx7fCVE-2025-59471Next.js self-hosted applications vulnerable to DoS via Image Optimizer remotePatterns configuration
  • >= 10.0.0, < 15.5.10 → 15.5.10
  • >= 15.6.0-canary.0, < 16.1.5 → 16.1.5
12/12/2025CaoCVSS 7.5GHSA-5j59-xgg2-r9c4Next has a Denial of Service with Server Components - Incomplete Fix Follow-Up
  • >= 13.3.1-canary.0, < 14.2.35 → 14.2.35
  • >= 15.0.6, < 15.0.7 → 15.0.7
  • >= 15.1.10, < 15.1.11 → 15.1.11
  • >= 15.2.7, < 15.2.8 → 15.2.8
  • >= 15.3.7, < 15.3.8 → 15.3.8
  • >= 15.4.9, < 15.4.10 → 15.4.10
  • >= 15.5.8, < 15.5.9 → 15.5.9
  • >= 15.6.0-canary.59, < 15.6.0-canary.60 → 15.6.0-canary.60
  • >= 16.0.9, < 16.0.10 → 16.0.10
  • >= 16.1.0-canary.17, < 16.1.0-canary.19 → 16.1.0-canary.19
11/12/2025CaoCVSS 7.5GHSA-mwv6-3258-q52cNext Vulnerable to Denial of Service with Server Components
  • >= 13.3.0, < 14.2.34 → 14.2.34
  • >= 15.0.0-canary.0, < 15.0.6 → 15.0.6
  • >= 15.1.1-canary.0, < 15.1.10 → 15.1.10
  • >= 15.2.0-canary.0, < 15.2.7 → 15.2.7
  • >= 15.3.0-canary.0, < 15.3.7 → 15.3.7
  • >= 15.4.0-canary.0, < 15.4.9 → 15.4.9
  • >= 15.5.1-canary.0, < 15.5.8 → 15.5.8
  • >= 15.6.0-canary.0, < 15.6.0-canary.59 → 15.6.0-canary.59
  • >= 16.0.0-beta.0, < 16.0.9 → 16.0.9
  • >= 16.1.0-canary.0, < 16.1.0-canary.17 → 16.1.0-canary.17
11/12/2025Trung bìnhCVSS 5.3GHSA-w37m-7fhw-fmv9Next Server Actions Source Code Exposure
  • >= 15.0.0-canary.0, < 15.0.6 → 15.0.6
  • >= 15.1.1-canary.0, < 15.1.10 → 15.1.10
  • >= 15.2.0-canary.0, < 15.2.7 → 15.2.7
  • >= 15.3.0-canary.0, < 15.3.7 → 15.3.7
  • >= 15.4.0-canary.0, < 15.4.9 → 15.4.9
  • >= 15.5.1-canary.0, < 15.5.8 → 15.5.8
  • >= 15.6.0-canary.0, < 15.6.0-canary.59 → 15.6.0-canary.59
  • >= 16.0.0-beta.0, < 16.0.9 → 16.0.9
  • >= 16.1.0-canary.0, < 16.1.0-canary.17 → 16.1.0-canary.17
03/12/2025Nghiêm trọngCVSS 10GHSA-9qr9-h5gf-34mpNext.js is vulnerable to RCE in React flight protocolGiải thích
  • >= 14.3.0-canary.77, < 15.0.5 → 15.0.5
  • >= 15.2.0-canary.0, < 15.2.6 → 15.2.6
  • >= 15.3.0-canary.0, < 15.3.6 → 15.3.6
  • >= 15.4.0-canary.0, < 15.4.8 → 15.4.8
  • >= 16.0.0-canary.0, < 16.0.7 → 16.0.7
  • >= 15.1.0-canary.0, < 15.1.9 → 15.1.9
  • >= 15.5.0-canary.0, < 15.5.7 → 15.5.7
29/08/2025Trung bìnhCVSS 6.5GHSA-4342-x723-ch2fCVE-2025-57822Next.js Improper Middleware Redirect Handling Leads to SSRF
  • >= 15.0.0-canary.0, < 15.4.7 → 15.4.7
  • >= 0.9.9, < 14.2.32 → 14.2.32
29/08/2025Trung bìnhCVSS 6.2GHSA-g5qg-72qw-gw5vCVE-2025-57752Next.js Affected by Cache Key Confusion for Image Optimization API Routes
  • >= 15.0.0, <= 15.4.4 → 15.4.5
  • >= 0.9.9, < 14.2.31 → 14.2.31
29/08/2025Trung bìnhCVSS 4.3GHSA-xv57-4mr9-wg8vCVE-2025-55173Next.js Content Injection Vulnerability for Image Optimization
  • >= 15.0.0, <= 15.4.4 → 15.4.5
  • >= 0.9.9, < 14.2.31 → 14.2.31
03/07/2025CaoCVSS 7.5GHSA-67rr-84xm-4c7rCVE-2025-49826Next.JS vulnerability can lead to DoS via cache poisoning
  • >= 15.0.4-canary.51, < 15.1.8 → 15.1.8
03/07/2025ThấpCVSS 3.7GHSA-r2fc-ccr8-96c4CVE-2025-49005Next.js has a Cache poisoning vulnerability due to omission of the Vary header
  • >= 15.3.0, < 15.3.3 → 15.3.3
28/05/2025ThấpCVSS 2.3GHSA-3h52-269p-cp9rCVE-2025-48068Information exposure in Next.js dev server due to lack of origin verification
  • >= 15.0.0, < 15.2.2 → 15.2.2
  • >= 13.0, < 14.2.30 → 14.2.30
15/05/2025ThấpCVSS 3.7GHSA-qpjv-v59x-3qc4CVE-2025-32421Next.js Race Condition to Cache Poisoning
  • >= 15.0.0, < 15.1.6 → 15.1.6
  • >= 0.9.9, < 14.2.24 → 14.2.24
02/04/2025ThấpCVSS 1.7GHSA-223j-4rm8-mrmfCVE-2025-30218Next.js may leak x-middleware-subrequest-id to external hosts
  • = 12.3.5 → 12.3.6
  • = 13.5.9 → 13.5.10
  • = 14.2.25 → 14.2.26
  • = 15.2.3 → 15.2.4
21/03/2025Nghiêm trọngCVSS 9.1GHSA-f82v-jwr5-mffwCVE-2025-29927Authorization Bypass in Next.js MiddlewareGiải thích
  • >= 13.0.0, < 13.5.9 → 13.5.9
  • >= 14.0.0, < 14.2.25 → 14.2.25
  • >= 15.0.0, < 15.2.3 → 15.2.3
  • >= 12.0.0, < 12.3.5 → 12.3.5
03/01/2025Trung bìnhCVSS 5.3GHSA-7m27-7ghc-44w9CVE-2024-56332Next.js Allows a Denial of Service (DoS) with Server Actions
  • >= 13.0.0, < 13.5.8 → 13.5.8
  • >= 14.0.0, < 14.2.21 → 14.2.21
  • >= 15.0.0, < 15.1.2 → 15.1.2
17/12/2024CaoCVSS 7.5GHSA-7gfc-8cq8-jh5fCVE-2024-51479Next.js authorization bypass vulnerability
  • >= 9.5.5, < 14.2.15 → 14.2.15
14/10/2024Trung bìnhCVSS 4.6GHSA-g77x-44xx-532mCVE-2024-47831Denial of Service condition in Next.js image optimization
  • >= 10.0.0, < 14.2.7 → 14.2.7
17/09/2024CaoCVSS 8.7GHSA-gp8f-8m3g-qvj9CVE-2024-46982Next.js Cache Poisoning
  • >= 13.5.1, < 13.5.7 → 13.5.7
  • >= 14.0.0, < 14.2.10 → 14.2.10
10/07/2024CaoCVSS 8.7GHSA-fq54-2j52-jc42CVE-2024-39693Next.js Denial of Service (DoS) condition
  • >= 13.3.1, < 13.5.0 → 13.5.0
09/05/2024CaoCVSS 7.5GHSA-77r5-gw3j-2mpfCVE-2024-34350Next.js Vulnerable to HTTP Request Smuggling
  • >= 13.4.0, < 13.5.1 → 13.5.1
09/05/2024CaoCVSS 7.5GHSA-fr5h-rqp8-mj6gCVE-2024-34351Next.js Server-Side Request Forgery in Server Actions
  • >= 13.4.0, < 14.1.1 → 14.1.1
22/10/2023ThấpGHSA-c59h-r6p8-q9wcCVE-2023-46298Next.js missing cache-control header may lead to CDN caching empty reply
  • >= 0.9.9, < 13.4.20-canary.13 → 13.4.20-canary.13

GitHub Advisory Database, CC-BY-4.0.