The version of Next.js installed on the remote host is 12.0.0 prior to 15.5.21 or 16.0.0 prior to 16.2.11. It is, therefore, affected by multiple vulnerabilities:

- A Server-Side Request Forgery vulnerability in rewrites via an attacker-controlled destination hostname. (CVE-2026-64645)

- A Server-Side Request Forgery vulnerability in Server Actions on custom servers. This issue only affects versions 14.1.1 and later. (CVE-2026-64649)

- A Middleware / Proxy bypass in App Router applications using Turbopack and a single locale. This issue only affects versions 16.0.0 and later. (CVE-2026-64642)

- A denial of service vulnerability in App Router applications using Server Actions. This issue only affects versions 13.0.0 and later. (CVE-2026-64641)

- A denial of service vulnerability due to unbounded Server Action payloads in the Edge runtime. This issue only affects versions 13.0.0 and later. (CVE-2026-64646)

- A denial of service vulnerability in the Image Optimization API using SVGs. This issue only affects versions 15.5.0 and later. (CVE-2026-64644)

- A cache confusion of response bodies for requests with bodies. This issue only affects versions 13.0.0 and later. (CVE-2026-64648)

- A cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences. This issue only affects versions 13.0.0 and later. (CVE-2026-64647)

- An unauthenticated disclosure of internal Server Function endpoints. This issue only affects versions 13.0.0 and later. (CVE-2026-64643)

Note that the scanner has not attempted to exploit these issues but has instead relied only on application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Next.js is a React framework for building full-stack web applications. In versions 16.0.0 through 16.2.10,
    crafted requests targeting Next.js applications using App Router built with Turbopack and a single entry
    in config.i18n.locales can bypass middleware/proxy based authentication. This issue has been fixed in
    version 16.2.11. (CVE-2026-64642)

远程主机上的 Next.js Framework 受到认证绕过漏洞的影响：

  - 使用以 Turbopack 构建的 App Router 和 config.i18n.locales 中的单一条目，针对Next.js应用程序的特别构建请求可绕过基于中间件/代理的认证。（CVE-2026-64642）

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

遠端主機上的 Next.js Framework 受到繞過驗證弱點影響：

  - 使用 Turbopack 建置的 App Router 和 config.i18n.locales 中的單一項目，針對Next.js應用程式的特製請求可以繞過基於中間件/代理的身份驗證。（CVE-2026-64642）

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

リモートホスト上の Next.js Framework は、認証バイパスの脆弱性の影響を受けます:

  - Turbopack でビルドされた App Router と config.i18n.locales の単一エントリを使用する Next.js アプリケーションをターゲットとする細工されたリクエストが、ミドルウェア/プロキシベースの認証をバイパスする可能性があります。(CVE-2026-64642)

Nessus はこれらの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

The Next.js Framework on the remote host is affected by an authentication bypass vulnerability:

  - Crafted requests targeting Next.js applications using App Router built with Turbopack and a single entry     in config.i18n.locales can bypass middleware/proxy based authentication. (CVE-2026-64642)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
115757	Next.js 16.0.x < 16.2.11 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	11/6/2026	11/6/2026	high
115756	Next.js 12.0.0 < 15.5.21 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	11/6/2026	11/6/2026	high
445138	SCA: security update for next (GHSA-6gpp-xcg3-4w24)	Tenable Cloud Security	SCA Checks	7/23/2026	8/10/2026	high
465002	Echo: next: security update to 16.2.11	Tenable Cloud Security	Echo Local Security Checks	10/2/2026	10/5/2026	high
445138	SCA: security update for next (GHSA-6gpp-xcg3-4w24)	Tenable Self-Hosted Container Security	SCA Checks	7/23/2026	8/10/2026	high
465002	Echo: next: security update to 16.2.11	Tenable Self-Hosted Container Security	Echo Local Security Checks	10/2/2026	10/5/2026	high
330087	Next.js Framework 16.x < 16.2.11 中间件绕过	Nessus	Misc.	7/27/2026	7/30/2026	high
330087	Next.js框架 16.x < 16.2.11 中間件繞過	Nessus	Misc.	7/27/2026	7/30/2026	high
330087	Next.js Framework 16.x < 16.2.11 ミドルウェアのバイパス	Nessus	Misc.	7/27/2026	7/30/2026	high
330087	Next.js Framework 16.x < 16.2.11 Middleware Bypass	Nessus	Misc.	7/27/2026	7/30/2026	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high

high

high

high

high