Vulnerabilidades de Vercel

🔔 Criar alerta RSS

CVEs publicadas que afetam produtos de Vercel: 54 registro(s), com severidade, exploração e correções.

Next.js 40 Ai 4 Turborepo 3 Next 3 Vercel 1 Turborepo Language Server Protocol 1 Deepsec 1 Nuxt Devtools 1 AI SDK 1 Ms 1 @ai-sdk/harness-codex 1 @ai-sdk/harness-opencode 1 Satori 1

Somente exploradas (KEV) →

CVE-2025-55182 Crítica · 10.0 KEV Urgente · 100 Exploit público Ransomware CWE-502 03/12/2025

Meta React Server Components Remote Code Execution Vulnerability

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.

CVE-2025-52662 Média · 6.1 CWE-79 06/11/2025

Cross-site Scripting (XSS) em Nuxt Devtools

A vulnerability in Nuxt DevTools has been fixed in version **2.6.4***. This issue may have allowed Nuxt auth token extraction via XSS under certain configurations. All users are encouraged to upgrade. More details: https://vercel.com/changelog/cve-2025-52662-xss-on-nuxt-devtools

CVE-2025-48985 Média · 5.3 CWE-20 06/11/2025

Improper Input Validation em Vercel Ai

A vulnerability in Vercel’s AI SDK has been fixed in versions 5.0.52, 5.1.0-beta.9, and 6.0.0-beta. This issue may have allowed users to bypass filetype whitelists when uploading files. All users are encouraged to upgrade. More details: https://vercel.com/changelog/cve-2025-48985-input-validation-bypass-on-ai-sdk

CVE-2017-20162 Média · 5.3 CWE-1333 05/01/2023

vercel ms index.js parse redos

A vulnerability, which was classified as problematic, has been found in vercel ms up to 1.x. This issue affects the function parse of the file index.js. The manipulation of the argument str leads to inefficient regular expression complexity. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2.0.0 is able to address this issue. The patch is named caae2988ba2a37765d055c4eee63d383320ee662. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-217451.