- Top reward
- $6,000
- Top severity paid
- High
- Assets in scope
- 10
- Public CVEs
- 64
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays up to $6,000
- for high bugs, from $625.
- Report on Sorona
- Submit through the program page.
- Partial safe harbor
- Some legal protection; read the terms.
- Replies within 1 day
- As the policy promises.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What Sorona lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| High |
|
$6,000 |
| Medium |
|
$1,250 |
| Low |
|
$625 |
- Response
-
Within 1 days
1 business day First response
- Safe harbor
-
Partial
Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf.
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
10 assets you may test, 7 excluded.
Web 1
- https://nextjs.org
Products and areas 9
- Middleware and the Edge runtime, including the internal headers Next.js uses to talk to itself across that boundary
- React Server Components, Server Actions and the Flight protocol: serialization and deserialization, action-id handling, CSRF protection and what a payload carries across the server boundary
- Request handling in the Node and Edge servers: Host and forwarded-header trust, cookie parsing, redirect targets, draft mode and the preview cookie
- Route Handlers, API routes and the server-side data-fetching entry points such as getServerSideProps and getStaticProps that run application code on a request
- Static and asset serving out of public/ and _next/static, plus source maps and anything else a production build leaves reachable
- The built-in image optimizer, its remote-pattern allowlist and the decoding it performs on whatever it fetches
- The routing layer across both routers: dynamic segments, route groups, rewrites, redirects, internationalised routing and the resolution order that decides which handler a request reaches
- The vercel/next.js repository itself, listed in the program's Tier 1 (High Priority) scope as a source-code asset that is bounty-eligible up to critical severity. Every asset in this program is a GitHub repository, and the per-asset focus list Vercel publishes ranks what they want most rather than fencing off the rest of the framework
- The whole caching stack, covering ISR, the full-route cache, the Data Cache, use cache and the client router cache, along with the keys and revalidation tags each of them derives
Out of scope (7)
- Build-time tooling such as webpack, babel and terser, which the program places explicitly out of scope
- Cloud-provider and deployment-specific issues, which belong to Vercel's main platform program rather than the open-source one
- Issues in the development server (next dev) unless you can show a path to production impact
- Reports without the mandatory working proof-of-concept zip, which are not eligible regardless of severity
- Scanner output and unverified AI or LLM findings, which the program closes as Not Applicable
- Templates, examples, starter projects and documentation snippets
- Third-party dependency CVEs without a demonstrated end-to-end chain through Next.js itself
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Sorona's policy.
While testing
-
Submit through sorona.xyz first.
-
Include a zip file with working proof-of-concept code, without one the report is not bounty-eligible
-
Show the bug on a production build, not on the dev server, unless you can demonstrate a production path to impact
-
One vulnerability per report unless a chain is needed to show the real impact
-
Vercel's confidentiality obligations run for two years and survive the end of the program
Not accepted
-
Scanner output and unverified AI or LLM findings, which the program closes as Not Applicable
-
Reports without the mandatory working proof-of-concept zip, which are not eligible regardless of severity
-
Third-party dependency CVEs without a demonstrated end-to-end chain through Next.js itself
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 1 hour ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
Sorona credits this project with 64 CVEs, 38 of them recent. The individual records appear here after the next sync.
Original policy
Copied from sorona.xyz on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Critical (Tier 1 asset) │ $10,000 │ $11,000 High │ $5,000 │ $6,000 Medium │ $1,000 │ $1,250 Low │ $500 │ $625 Submit a vulnerability CVE history 38 Last 12 months 64 Lifetime Access control 30 % Info disclosure 25 % Denial of service 20 % Injection 15 % Latest advisories Loading the feed Overview Next.js is the default React production framework, downloaded on the order of ten million times a week and sitting under a very large share of commercially operated React sites. Its middleware layer is frequently the only authorization gate in front of an application, which is why CVE-2025-29927 landed as an ecosystem-wide event: a framework bug here reaches every downstream deployment on the next install. Vercel pays it as a Tier 1 asset on its open-source program, and sorona.xyz adds 1.25× on top of whatever Vercel awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. Response times 1 business day First response 7 business days Triage 10 business days after triage Bounty In scope The vercel/next.js repository itself, listed in the program's Tier 1 (High Priority) scope as a source-code asset that is bounty-eligible up to critical severity. Every asset in this program is a GitHub repository, and the per-asset focus list Vercel publishes ranks what they want most rather than fencing off the rest of the framework The routing layer across both routers: dynamic segments, route groups, rewrites, redirects, internationalised routing and the resolution order that decides which handler a request reaches Middleware and the Edge runtime, including the internal headers Next.js uses to talk to itself across that boundary React Server Components, Server Actions and the Flight protocol: serialization and deserialization, action-id handling, CSRF protection and what a payload carries across the server boundary The whole caching stack, covering ISR, the full-route cache, the Data Cache, use cache and the client router cache, along with the keys and revalidation tags each of them derives Route Handlers, API routes and the server-side data-fetching entry points such as getServerSideProps and getStaticProps that run application code on a request The built-in image optimizer, its remote-pattern allowlist and the decoding it performs on whatever it fetches Request handling in the Node and Edge servers: Host and forwarded-header trust, cookie parsing, redirect targets, draft mode and the preview cookie Static and asset serving out of public/ and _next/static , plus source maps and anything else a production build leaves reachable Out of scope Build-time tooling such as webpack, babel and terser, which the program places explicitly out of scope Issues in the development server ( next dev ) unless you can show a path to production impact Cloud-provider and deployment-specific issues, which belong to Vercel's main platform program rather than the open-source one Templates, examples, starter projects and documentation snippets Third-party dependency CVEs without a demonstrated end-to-end chain through Next.js itself Scanner output and unverified AI or LLM findings, which the program closes as Not Applicable Reports without the mandatory working proof-of-concept zip, which are not eligible regardless of severity Most-valued findings Middleware authorization bypass reaching a protected route, the shape CVE-2025-29927 took and still the highest-value class here Cache poisoning that lets one visitor's response be served to another across ISR or the full-route cache Server Actions or Flight deserialization leading to code execution or cross-tenant data exposure Image optimizer SSRF that reaches internal network addresses past the remote-pattern allowlist SSRF driven by host reflection from the Host header, from forwarded headers, or from a redirect target Path traversal or source disclosure through the static file and asset pipeline Any of the above demonstrated on a default configuration rather than one the reporter had to weaken Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. Include a zip file with working proof-of-concept code, without one the report is not bounty-eligible Scanner output and unverified AI or LLM findings are closed as Not Applicable Show the bug on a production build, not on the dev server, unless you can demonstrate a production path to impact One vulnerability per report unless a chain is needed to show the real impact Vercel's confidentiality obligations run for two years and survive the end of the program Program stats 100 Reports resolved $241k Bounties paid 89% Response efficiency Disclosure Coordinated through Vercel. The program treats report contents as confidential and asks for written consent before anything is shared, so publication timing is Vercel's call rather than a fixed clock. sorona.xyz holds your finding until Vercel has resolved it. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability