PatchSiren

vercel CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

HIGH vercel CVE published 2026-07-27

CVE-2026-64645

CVE-2026-64645 is a Server-Side Request Forgery (SSRF) and Open Redirect vulnerability affecting Next.js, a React framework for building full-stack web applications. The issue exists in versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10. An attacker can exploit this vulnerability by crafting a rewrites() or redirects() rule that uses request-controlled input to build an external destination hostna [truncated]

MEDIUM vercel CVE published 2026-07-27

CVE-2026-64644

CVE-2026-64644 is a vulnerability in the Next.js Image Optimization API that can cause CPU exhaustion. The vulnerability affects Next.js versions 15.5.0 through 15.5.20 and 16.0.0 through 16.2.10. The issue has been fixed in versions 15.5.21 and 16.2.11. This vulnerability allows malicious content in remotely hosted images to cause CPU exhaustion in /_next/image endpoints when config.images.remotePatterns [truncated]

MEDIUM vercel CVE published 2026-07-27

CVE-2026-64643

CVE-2026-64643 is a medium-severity vulnerability affecting Next.js versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10. The issue allows Server Action IDs to be disclosed to unauthenticated users via publicly served client artifacts, potentially bypassing authentication on pages where these endpoints are used. This disclosure is typically a recon/enumeration primitive but can increase risk when co [truncated]

HIGH vercel CVE published 2026-07-27

CVE-2026-64642

CVE-2026-64642 is a high-severity vulnerability affecting Next.js versions 16.0.0 through 16.2.10. Crafted requests targeting Next.js applications using App Router built with Turbopack and a single entry in config.i18n.locales can bypass middleware/proxy-based authentication. The issue has been fixed in version 16.2.11. This vulnerability has significant implications for developers and administrators of N [truncated]

HIGH vercel CVE published 2026-07-27

CVE-2026-64641

CVE-2026-64641 is a HIGH severity vulnerability in Next.js, a React framework for building full-stack web applications. Versions 13.0.0 through 15.5.20 and 16.0.0 through 16.2.10 are affected. Crafted requests to Next.js applications using App Router with at least one Server Action can lead to excessive CPU usage, blocking further requests in the same process. The issue is fixed in versions 15.5.21 and 16 [truncated]

LOW vercel CVE published 2026-05-17

CVE-2026-8769

A vulnerability in Vercel AI SDK versions up to 3.0.97 allows remote attackers to cause resource consumption through the createJsonResponseHandler and createJsonErrorResponseHandler functions in packages/provider-utils/src/response-handler.ts. The issue was publicly disclosed on 2026-05-17 with an exploit available, and the vendor was reportedly contacted but did not respond. The vulnerability is rated LO [truncated]

MEDIUM Vercel CVE published 2026-05-17

CVE-2026-8768

CVE-2026-8768 is a server-side request forgery (SSRF) vulnerability in the vercel ai package’s provider-utils component, specifically the validateDownloadUrl function in packages/provider-utils/src/download-blob.ts. The issue is described as remotely exploitable and affecting versions up to 3.0.97. The vulnerability was published on 2026-05-17 and is rated medium severity (CVSS 5.5). The disclosure also s [truncated]

LOW vercel CVE published 2026-05-17

CVE-2026-8767

A command injection vulnerability exists in Vercel AI SDK versions up to 3.0.97, specifically within a GitHub Actions workflow file. The vulnerability resides in the `run` function of `.github/workflows/prettier-on-automerge.yml`, where PR branch name interpolation allows for OS command injection. The attack vector is remote but requires high complexity and difficult exploitability conditions. The CVSS 4. [truncated]

HIGH vercel CVE published 2026-05-15

CVE-2026-46508

CVE-2026-46508 is a high-severity (CVSS 8.4) command injection vulnerability in the Turborepo Language Server Protocol (LSP) VS Code extension, published 2026-05-15 and last modified 2026-05-19. The extension, prior to version 2.9.14000, used string-based command execution for daemon commands and task runs, allowing malicious workspace-controlled values—such as crafted task names or workspace settings—to [truncated]

MEDIUM Vercel CVE published 2026-05-15

CVE-2026-45773

CVE-2026-45773 is a medium-severity authentication flow flaw in Turborepo’s self-hosted login and SSO browser flows. Before 2.9.14, the localhost callback did not validate a CSRF state value. If a user was waiting for authentication in the CLI, a malicious web page could send a request to the local callback server with an attacker-controlled token. If that request arrived before the legitimate callback, t [truncated]

HIGH Vercel CVE published 2026-05-13

CVE-2026-44579

CVE-2026-44579 is a high-severity vulnerability affecting Next.js, a popular React framework for building full-stack web applications. The vulnerability, which has a CVSS score of 7.5, can lead to connection exhaustion through crafted POST requests to a server action. This can occur when applications use Partial Prerendering through the Cache Components feature. A malicious request can trigger a request-b [truncated]

HIGH Vercel CVE published 2026-05-13

CVE-2026-44575

CVE-2026-44575 is a high-severity vulnerability in Next.js, a React framework for building full-stack web applications. The vulnerability affects App Router applications that rely on middleware or proxy-based checks for authorization, allowing unauthorized access through specially crafted .rsc and segment-prefetch URLs. This can occur when such URLs resolve to the same page without being matched by the in [truncated]

MEDIUM vercel CVE published 2026-05-13

CVE-2026-44479

A medium-severity vulnerability, CVE-2026-44479, was discovered in Vercel's AI Cloud platform. The issue affects versions 50.16.0 to 52.0.0 of the Vercel CLI. When running in non-interactive mode, commands that cannot complete autonomously emit JSON payloads with suggested follow-up commands. If the user authenticated via --token or -t on the command line, the token value is included verbatim in those sug [truncated]

HIGH Vercel CVE published 2017-01-23

CVE-2015-8315

CVE-2015-8315 describes a regular expression denial of service (ReDoS) in the Node.js ms package before version 0.7.1. An attacker who can supply a long version string may trigger excessive CPU consumption, resulting in denial of service. NVD rates the issue High with a CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.