The version of Next.js installed on the remote host is 10.0.0 prior to 15.5.10 or 16.0.0 prior to 16.1.5. It is, therefore, affected by multiple vulnerabilities:

- A denial of service vulnerability in the Image Optimizer of self-hosted applications with remotePatterns configured, as external images are loaded entirely into memory without a maximum size limit. (CVE-2025-59471)

- A denial of service vulnerability with Server Components. This issue only affects versions 13.0.0 and later and is also fixed in versions 15.0.8, 15.1.12, 15.2.9, 15.3.9, 15.4.11 and 16.0.11. (CVE-2026-23864)

- A denial of service vulnerability in applications with Partial Prerendering (PPR) enabled when running in minimal mode, due to unbounded request body buffering and decompression. This issue only affects versions 16.1.0 and later. (CVE-2025-59472)

Note that the scanner has not attempted to exploit these issues but has instead relied only on application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Multiple denial of service vulnerabilities exist in React Server Components, affecting the following
    packages: react-server-dom-parcel, react-server-dom-turbopack, react-server-dom-webpack. The
    vulnerabilities are triggered by sending specially crafted HTTP requests to Server Function endpoints, and
    could lead to server crashes, out-of-memory exceptions or excessive CPU usage; depending on the vulnerable
    code path being exercised, the application configuration and application code. Strongly consider upgrading
    to the latest package versions to reduce risk and prevent availability issues in applications using React
    Server Components. (CVE-2026-23864)

ID	名稱	產品	系列	已發布	已更新	嚴重性
115763	Next.js 16.0.x < 16.1.5 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	2026/11/6	2026/11/6	high
115762	Next.js 10.0.0 < 15.5.10 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	2026/11/6	2026/11/6	high
437389	SCA: security update for react-server-dom-parcel, react-server-dom-turbopack, react-server-dom-webpack (GHSA-83fc-fqcc-2hmg)	Tenable Self-Hosted Container Security	SCA Checks	2026/1/29	2026/7/28	high
437389	SCA: security update for react-server-dom-parcel, react-server-dom-turbopack, react-server-dom-webpack (GHSA-83fc-fqcc-2hmg)	Tenable Cloud Security	SCA Checks	2026/1/29	2026/7/28	high

偵測

搜尋 Plugin

high

high

high

high