Generated stack · Vercel
Next.js
React framework generated by v0, Bolt and others.
6Advisories
2critical
3high
1medium
2026-09-08Latest
Timeline · advisories per quarter
22025 Q1
22026 Q2
22026 Q3
Named in sources
Reported for Next.js
01. CVE-2026-75604: Next.js: Unauthenticated Remote Code Execution on windows-hosted serversA vulnerability in applications using Pages and App router without Cache Component can lead to remote code execution when the server is hosted on machines using a Windows filesystem. Next.js 2026-09-08 02. CVE-2025-29927: Next.js middleware authorization bypassSelf-hosted Next.js apps that did auth in middleware could be bypassed with the internal x-middleware-subrequest header. Relevant to any Next.js app, including ones generated by v0. Next.js 
v0 
Bolt +2 more 2025-03 03. Secrets leaked via NEXT_PUBLIC_ (or VITE_) environment variablesPrefixing a variable with NEXT_PUBLIC_ inlines it into the JavaScript every visitor downloads. AI tools often “fix” a missing-env error this way. 
Lovable Bolt v0 +4 more 2026-08 04. CVE-2026-44578: Next.js vulnerable to server-side request forgery in applications using WebSocket upgradesSelf-hosted applications using the built-in Node.js server can be vulnerable to server-side request forgery through crafted WebSocket upgrade requests. Next.js 2026-05-11 05. CVE-2026-44574: Next.js has a Middleware / Proxy bypass through dynamic route parameter injectionApplications that rely on middleware to protect dynamic routes can be vulnerable to authorization bypass. Next.js 2026-05-11 06. Protecting routes only in middlewareVercel recommends against middleware being the sole method of protecting routes. Check auth again where data is read or changed. Next.js v0 Bolt +2 more 2025-03
Next.js 2026-09-08 02. CVE-2025-29927: Next.js middleware authorization bypassSelf-hosted Next.js apps that did auth in middleware could be bypassed with the internal x-middleware-subrequest header. Relevant to any Next.js app, including ones generated by v0. Next.js v0 Bolt +2 more 2025-03 03. Secrets leaked via NEXT_PUBLIC_ (or VITE_) environment variablesPrefixing a variable with NEXT_PUBLIC_ inlines it into the JavaScript every visitor downloads. AI tools often “fix” a missing-env error this way. Lovable Bolt v0 +4 more 2026-08 04. CVE-2026-44578: Next.js vulnerable to server-side request forgery in applications using WebSocket upgradesSelf-hosted applications using the built-in Node.js server can be vulnerable to server-side request forgery through crafted WebSocket upgrade requests. Next.js 2026-05-11 05. CVE-2026-44574: Next.js has a Middleware / Proxy bypass through dynamic route parameter injectionApplications that rely on middleware to protect dynamic routes can be vulnerable to authorization bypass. Next.js 2026-05-11 06. Protecting routes only in middlewareVercel recommends against middleware being the sole method of protecting routes. Check auth again where data is read or changed. Next.js v0 Bolt +2 more 2025-03