Vercel vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Vercel products: 54 record(s), with severity, exploitation and fixes.

Next.js 40 Ai 4 Turborepo 3 Next 3 Vercel 1 Turborepo Language Server Protocol 1 Deepsec 1 Nuxt Devtools 1 AI SDK 1 Ms 1 @ai-sdk/harness-codex 1 @ai-sdk/harness-opencode 1 Satori 1

Exploited only (KEV) →

CVE-2025-55182 Critical · 10.0 KEV Urgent · 100 Public exploit Ransomware CWE-502 Dec 3, 2025

Meta React Server Components Remote Code Execution Vulnerability

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.

CVE-2025-52662 Medium · 6.1 CWE-79 Nov 6, 2025

Cross-site Scripting (XSS) in Nuxt Devtools

A vulnerability in Nuxt DevTools has been fixed in version **2.6.4***. This issue may have allowed Nuxt auth token extraction via XSS under certain configurations. All users are encouraged to upgrade. More details: https://vercel.com/changelog/cve-2025-52662-xss-on-nuxt-devtools

CVE-2025-48985 Medium · 5.3 CWE-20 Nov 6, 2025

Improper Input Validation in Vercel Ai

A vulnerability in Vercel’s AI SDK has been fixed in versions 5.0.52, 5.1.0-beta.9, and 6.0.0-beta. This issue may have allowed users to bypass filetype whitelists when uploading files. All users are encouraged to upgrade. More details: https://vercel.com/changelog/cve-2025-48985-input-validation-bypass-on-ai-sdk

CVE-2017-20162 Medium · 5.3 CWE-1333 Jan 5, 2023

vercel ms index.js parse redos

A vulnerability, which was classified as problematic, has been found in vercel ms up to 1.x. This issue affects the function parse of the file index.js. The manipulation of the argument str leads to inefficient regular expression complexity. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2.0.0 is able to address this issue. The patch is named caae2988ba2a37765d055c4eee63d383320ee662. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-217451.