Detections
Analytics

Next.js 16.0.x < 16.0.10 Multiple Vulnerabilities

high Web App Scanning Plugin ID 115771

Synopsis

Next.js 16.0.x < 16.0.10 Multiple Vulnerabilities

Description

The version of Next.js installed on the remote host is 13.3.0 prior to 14.2.35, 15.0.x prior to 15.0.7, 15.1.x prior to 15.1.11, 15.2.x prior to 15.2.8, 15.3.x prior to 15.3.8, 15.4.x prior to 15.4.10, 15.5.x prior to 15.5.9 or 16.0.x prior to 16.0.10. It is, therefore, affected by multiple vulnerabilities:

- A denial of service vulnerability with Server Components, where a crafted HTTP request sent to any App Router endpoint can cause the server process to hang. (CVE-2025-55184)

- A denial of service vulnerability with Server Components, as the fix addressing CVE-2025-55184 was incomplete. (CVE-2025-67779)

- An information disclosure vulnerability where a crafted HTTP request can return the compiled source code of Server Actions. This issue only affects versions 15.0.0 and later. (CVE-2025-55183)

Note that the scanner has not attempted to exploit these issues but has instead relied only on application's self-reported version number.

Solution

Upgrade to Next.js version 16.0.10 or later.

See Also

https://github.com/vercel/next.js/security/advisories/GHSA-5j59-xgg2-r9c4

https://github.com/vercel/next.js/security/advisories/GHSA-mwv6-3258-q52c

https://github.com/vercel/next.js/security/advisories/GHSA-w37m-7fhw-fmv9

Plugin Details

Severity: High

ID: 115771

Type: Version Based

Published: 11/6/2026

Updated: 11/6/2026

Scan Template: basic, full, pci, quick, scan

Risk Information

VPR

Risk Factor: Medium

Score: 5

Percentile: 94.05

CVSS v2

Risk Factor: High

Base Score: 7.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS Score Source: CVE-2025-55184

CVSS v3

Risk Factor: High

Base Score: 7.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVSS Score Source: CVE-2025-55184

Vulnerability Information

CPE: cpe:2.3:a:vercel:next.js:*:*:*:*:*:*:*:*

Exploit Available: true

Exploit Ease: Exploits are available

Vulnerability Publication Date: 12/3/2025

Reference Information

CVE: CVE-2025-55183, CVE-2025-55184, CVE-2025-67779