The version of Next.js installed on the remote host is 13.3.0 prior to 14.2.35, 15.0.x prior to 15.0.7, 15.1.x prior to 15.1.11, 15.2.x prior to 15.2.8, 15.3.x prior to 15.3.8, 15.4.x prior to 15.4.10, 15.5.x prior to 15.5.9 or 16.0.x prior to 16.0.10. It is, therefore, affected by multiple vulnerabilities:

- A denial of service vulnerability with Server Components, where a crafted HTTP request sent to any App Router endpoint can cause the server process to hang. (CVE-2025-55184)

- A denial of service vulnerability with Server Components, as the fix addressing CVE-2025-55184 was incomplete. (CVE-2025-67779)

- An information disclosure vulnerability where a crafted HTTP request can return the compiled source code of Server Actions. This issue only affects versions 15.0.0 and later. (CVE-2025-55183)

Note that the scanner has not attempted to exploit these issues but has instead relied only on application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - It was found that the fix addressing CVE-2025-55184 in React Server Components was incomplete and does not
    prevent a denial of service attack in a specific case. React Server Components versions 19.0.2, 19.1.3 and
    19.2.2 are affected, allowing unsafe deserialization of payloads from HTTP requests to Server Function
    endpoints. This can cause an infinite loop that hangs the server process and may prevent future HTTP
    requests from being served. (CVE-2025-67779)

多個 Node.js React Server Components 套件受到一個拒絕服務弱點影響。
下列 Node.js 套件和版本會受到影響:

  - react-server-dom-webpack 19.0.2, 19.1.3, 19.2.2
  -react-server-dom-parcel 19.0.2, 19.1.3, 19.2.2
  - React-server-dom-turbopack 19.0.2, 19.1.3, 19.2.2

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

多个 Node.jsReact Server Components 程序包受到拒绝服务漏洞的影响。
以下 Node.js 程序包和版本受到影响:

  - react-server-dom-webpack 19.0.2、 19.1.3、 19.2.2
  - react-server-dom-parcel 19.0.2、 19.1.3、 19.2.2
  - react-server-dom-turbopack 19.0.2、 19.1.3、 19.2.2

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

Multiple Node.js React Server Components packages are affected by a denial of service vulnerability.
The following Node.js packages and versions are affected:

  - react-server-dom-webpack 19.0.2, 19.1.3, 19.2.2
  - react-server-dom-parcel 19.0.2, 19.1.3, 19.2.2
  - react-server-dom-turbopack 19.0.2, 19.1.3, 19.2.2

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
115765	Next.js 15.0.x < 15.0.7 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	2026/11/6	2026/11/6	high
115766	Next.js 15.1.x < 15.1.11 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	2026/11/6	2026/11/6	high
115767	Next.js 15.2.x < 15.2.8 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	2026/11/6	2026/11/6	high
115768	Next.js 15.3.x < 15.3.8 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	2026/11/6	2026/11/6	high
115769	Next.js 15.4.x < 15.4.10 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	2026/11/6	2026/11/6	high
115770	Next.js 15.5.x < 15.5.9 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	2026/11/6	2026/11/6	high
115771	Next.js 16.0.x < 16.0.10 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	2026/11/6	2026/11/6	high
115764	Next.js 13.3.0 < 14.2.35 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	2026/11/6	2026/11/6	high
436373	SCA: security update for react-server-dom-parcel, react-server-dom-turbopack, react-server-dom-webpack (GHSA-7gmr-mq3h-m5h9)	Tenable Self-Hosted Container Security	SCA Checks	2025/12/12	2026/7/2	high
436373	SCA: security update for react-server-dom-parcel, react-server-dom-turbopack, react-server-dom-webpack (GHSA-7gmr-mq3h-m5h9)	Tenable Cloud Security	SCA Checks	2025/12/12	2026/7/2	high
278532	Node.js React Server Components 拒絕服務 (CVE-2025-67779)	Nessus	Misc.	2025/12/12	2026/2/24	high
278532	Node.js React Server 组件拒绝服务 (CVE-2025-67779)	Nessus	Misc.	2025/12/12	2026/2/24	high
278532	Node.js React Server Components Denial of Service (CVE-2025-67779)	Nessus	Misc.	2025/12/12	2026/2/24	high

检测

插件搜索

high

high

high

high

high

high

high

high

high

high

high

high

high