Vercel Next.js Vulnerabilities Allow DoS or Security Bypass

CERT-Bund has released security advisory WID-SEC-2026-0748 concerning multiple vulnerabilities in Vercel Next.js. These vulnerabilities, with a CVSS base score of 6.5, can be exploited by remote, anonymous attackers to conduct Denial of Service (DoS) attacks or bypass security controls. The advisory specifically impacts Next.js versions prior to 16.1.7 and 15.5.13, and is applicable across UNIX and Windows operating systems.

Organizations utilizing affected versions of Vercel Next.js should immediately update to a patched version to mitigate the risks of DoS attacks and security bypass. While the advisory does not specify a compliance deadline, prompt patching is crucial to prevent potential service disruptions and security breaches. Failure to address these vulnerabilities could lead to significant operational downtime and compromise sensitive data.