Skip to content

RadicalNotion.AI

We do not sell or share your personal information.

© 2026 RadicalNotion.AI

Security Data

CWE Directory
CAPEC Directory
CNA Directory
CNA Leaderboard
CNA Report Cards
Vendor Directory
Patched Functions
Data Sources

Calculators

CVSS Calculator
CVSS 4.0
CVSS 3.1
CVSS 3.0
CVSS 2.0
Badge Builder

Platform

My Vulnerabilities
Insights
Notifications
Pricing

Learn

Guides
What is a CVE?
What is CVSS?
The CISA KEV catalog
What is EPSS?

Company

About
Blog
Careers
Contact
Demo

Account

Sign up
Log in

Legal

Security
Privacy
Terms

RadicalNotion.AI

Security data

Weaknesses (CWE)The MITRE CWE weakness catalog
Attack Patterns (CAPEC)MITRE CAPEC attack patterns
CNAsNumbering authorities and report cards
VendorsVulnerabilities by vendor
Patched FunctionsWhere CVE fixes land in code

Tools

CVSS CalculatorScore CVSS 4.0, 3.1, 3.0 & 2.0
Badge BuilderEmbeddable SVG badges for READMEs

Resources

LearnSecurity guides
Data SourcesCVE data sources

About Blog Pricing Demo

Log in Create an account

Home
Patched Functions
Vercel
Next.js

vercel/next.js: Functions Patched by CVE Fixes

typescript

javascript

#110 of 500 repositories

vercel/next.js

Functions and files changed by CVE fixes in this repository.

Latest located fix October 2, 2026

39

CVE fixes located

Published CVEs

332

Functions patched

Distinct function sites

70

Files patched

Distinct source files

2017–2026

Years covered

By CVE publication date

Overview

39 published CVEs have a fix traced to functions in vercel/next.js, the earliest published in 2017. Those fixes changed 332 distinct functions across 70 files, in 1,784 patch hunks.

Among the 500 repositories tracked here, vercel/next.js ranks #110 by the number of CVEs with a located fix.

Most patched functions

Functions in vercel/next.js changed by the most CVE fixes.

1createRedirectRenderResultpackages/next/src/server/app-render/action-handler.ts2 CVEs · 4 patches2024 to 2026
2createPatchedFetcherpackages/next/src/server/lib/patch-fetch.ts2 CVEs · 4 patches2026
3handleActionpackages/next/src/server/app-render/action-handler.ts2 CVEs · 3 patches2026
4initializepackages/next/src/server/lib/router-server.ts2 CVEs · 3 patches2025 to 2026
5calculateRevalidatepackages/next/src/server/lib/incremental-cache/index.ts2 CVEs · 2 patches2026
6getpackages/next/src/server/lib/incremental-cache/index.ts2 CVEs · 2 patches2026
7_getPathnamepackages/next/src/server/lib/incremental-cache/index.ts2 CVEs · 2 patches2026
8exportPagesPagepackages/next/src/export/routes/pages.ts2 CVEs · 2 patches2026
9exportPagespackages/next/src/export/worker.ts2 CVEs · 2 patches2026
10exportPageImplpackages/next/src/export/worker.ts2 CVEs · 2 patches2026
11getpackages/next/src/server/lib/incremental-cache/file-system-cache.ts2 CVEs · 2 patches2026
12exportAppPagepackages/next/src/export/routes/app-page.ts2 CVEs · 2 patches2026
13exportAppRoutepackages/next/src/export/routes/app-route.ts2 CVEs · 2 patches2026
14getSeedReadStatepackages/next/src/server/lib/incremental-cache/file-system-cache.ts2 CVEs · 2 patches2026
15joinpackages/next/src/export/worker.ts2 CVEs · 2 patches2026

Most patched files

Files in vercel/next.js changed by the most CVE fixes.

1packages/next/src/server/image-optimizer.ts8 CVEs · 12 functions
2packages/next/src/server/base-server.ts7 CVEs · 4 functions
3packages/next/src/server/app-render/action-handler.ts6 CVEs · 10 functions
4packages/next/src/server/lib/incremental-cache/index.ts3 CVEs · 11 functions
5packages/next/src/server/lib/incremental-cache/file-system-cache.ts3 CVEs · 6 functions
6packages/next/server/next-server.ts3 CVEs · 4 functions
7packages/next/taskfile.js3 CVEs · 4 functions
8packages/next/src/server/lib/router-utils/block-cross-site-dev.ts3 CVEs · 2 functions
9packages/next/types/$$compiled.internal.d.ts3 CVEs · 1 functions
10packages/next/server/image-optimizer.ts2 CVEs · 5 functions

Fix size

How much code a CVE fix in vercel/next.js changes, with backports counted once.

35

Median lines changed

Added plus removed, per CVE

33%

Fixes of 20 lines or fewer

Share of CVE fixes

36%

Fixes in a single function

Share of CVE fixes

Latest CVEs

The most recently published CVEs with a fix located in vercel/next.js, and the functions each fix changed.

Next.js: Cache poisoning in Next.js SSG/ISR rendering leads to cross-user content substitution and persistent denial of service
CVE-2026-94484get FileSystemCache ResponseCacheOwner
Medium · CVSS 6.3
EPSS 0.2%2026-10-02
Next.js: Information disclosure in Next.js App Router metadata image routes via dynamicParams bypass
CVE-2026-94485isInternalEndpoint getMcpMiddleware McpServerOptions
Medium · CVSS 6.3
EPSS 0.1%2026-10-02
Next.js: Server-Side Request Forgery in Image Optimization
CVE-2026-94483upstreamTimedOut fetchExternalImage Readable
High · CVSS 8.3
EPSS 0.2%2026-10-02
Next.js: Cache poisoning of SSG and ISR pages in self-hosted Next.js applications
CVE-2026-94543get FileSystemCache ResponseCacheOwner
Medium · CVSS 6.3
EPSS 0.3%2026-10-02
Next.js: Pending `use cache` fill can leak Draft Mode content into regular responses and persisted pages
CVE-2026-94544cache
Medium · CVSS 6.3
EPSS 0.2%2026-10-02
Next.js: Information disclosure in the Next.js development server's Model Context Protocol endpoint
CVE-2026-94486isInternalEndpoint getMcpMiddleware McpServerOptions
Low · CVSS 2.3
EPSS 0.1%2026-10-02
Satori-generated SVG has improper escaping
CVE-2026-94545FI Ic Ee
Medium · CVSS 5.3
EPSS 1.0%2026-09-30
Next.js: Unauthenticated Remote Code Execution on windows-hosted servers
CVE-2026-75604getFilePath escapePathDelimiters
Critical · CVSS 9.0
EPSS 2.1%2026-09-01
Next.js: Server-Side Request Forgery in Server Actions on Custom Servers
CVE-2026-64649createRedirectRenderResult createForwardedActionResponse
High · CVSS 8.3
EPSS 0.5%2026-07-27
Next.js: Response Body Cache Confusion for Requests Containing Bodies
CVE-2026-64648createPatchedFetcher
Medium · CVSS 6.0
EPSS 0.3%2026-07-27
Next.js: Response Body Cache Confusion with Invalid UTF-8 Request Bodies
CVE-2026-64647IncrementalCache toHex generateSimpleCacheKey
Medium · CVSS 6.3
EPSS 0.3%2026-07-27
Next.js: Unbounded Server Action payload in Edge runtime
CVE-2026-64646handleAction
Medium · CVSS 6.3
EPSS 0.5%2026-07-27

Get an alert for each new vercel/next.js CVE, with the patched functions and AI-written analysis.

Monitor next.js CVEs

Other repositories

Repositories with a similar number of located CVE fixes.

Combodo/iTop39 CVEs debian/xorg-server39 CVEs facebook/hhvm39 CVEs givanz/Vvveb39 CVEs honojs/hono39 CVEs rabbitmq/rabbitmq-server39 CVEs apache/struts40 CVEs Exiv2/exiv240 CVEs

Browse all repositories

Frequently asked questions

Common questions about CVE fixes in vercel/next.js.

How many CVEs have a located fix in vercel/next.js?: 39 published CVEs have a fix traced to functions in vercel/next.js, touching 332 functions across 70 files.
Which function in vercel/next.js has been patched by the most CVEs?: createRedirectRenderResult in packages/next/src/server/app-render/action-handler.ts has been changed by 2 CVE fixes, from 2024 to 2026.
How large is a typical CVE fix in vercel/next.js?: The median fix changes 35 lines. 33% of fixes change 20 lines or fewer, and 36% change a single function.
How is a fix located to a function?: The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

References

vercel/next.js on GitHub (opens in a new tab)
Patched functions directory
CWE directory: the weakness types behind these fixes

Fix locations are computed by RadicalNotion.AI from the upstream patch diff of each CVE. CVE data is sourced from the CVE Program.

Track vercel/next.js CVEs

Get an alert when a new CVE lands in this repository, with the patched functions and AI-written remediation guidance.

Create an account See pricing

On this page

Overview
Most patched functions
Most patched files
Fix size
Latest CVEs
Other repositories
FAQ
References