- Top reward
- $6,000
- Top severity paid
- High
- Assets in scope
- 9
- Public CVEs
- 60
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays up to $6,000
- for high bugs, from $625.
- Report on Sorona
- Submit through the program page.
- Partial safe harbor
- Some legal protection; read the terms.
- Replies within 1 day
- As the policy promises.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What Sorona lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| High |
|
$6,000 |
| Medium |
|
$1,250 |
| Low |
|
$625 |
- Response
-
Within 1 days
1 business day First response
- Safe harbor
-
Partial
Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf.
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
9 assets you may test, 7 excluded.
Web 1
- https://vercel.com/docs/cli
Products and areas 8
- Authentication and credential handling in the CLI: login, token issuance, the on-disk global configuration and its permissions, and what ends up in terminal output or a CI log
- File collection and upload during a deploy, including .vercelignore handling and whatever else decides which files leave the machine
- Framework detection and vercel.json parsing, covering the routing, rewrite and header configuration a project can declare
- Project and team scoping in the CLI and its API client, the boundary between one team's resources and another's
- The builder and build-utils packages this monorepo publishes, which exist to execute untrusted project code, along with the runtime shims they emit
- The environment-variable commands and the secrets they write to disk
- The vercel/vercel repository itself, listed under Tier 1 (High Priority) as a source-code asset that is bounty-eligible up to critical severity. The asset is the repo, and the hosted Vercel platform is a separate program
- vercel build and vercel deploy, which read project configuration and run project build scripts from whatever repository the CLI is pointed at
Out of scope (7)
- Examples, templates and documentation snippets rather than the CLI's own code
- Findings against the Vercel hosted platform, which belong to Vercel's separate main program
- Issues that require the attacker to already control the machine running the CLI
- Output formatting and other cosmetic issues in the CLI's terminal rendering
- Reports without the mandatory working proof-of-concept artifact, which are not eligible regardless of severity
- Theoretical chains that only work under preconditions no real deployment would meet
- Vulnerable-dependency reports without a demonstrated exploit chain reaching impact through the CLI
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Sorona's policy.
While testing
-
Submit through sorona.xyz first.
-
Include a working proof-of-concept artifact with every report, without one the finding is not bounty-eligible
-
Confidentiality obligations last two years from the date of disclosure, even if the program ends or your participation ceases
Not accepted
-
Output formatting and other cosmetic issues in the CLI's terminal rendering
-
Issues that require the attacker to already control the machine running the CLI
-
Vulnerable-dependency reports without a demonstrated exploit chain reaching impact through the CLI
-
Findings against the Vercel hosted platform
-
Theoretical chains that only work under preconditions no real deployment would meet
-
Examples, templates and documentation snippets rather than the CLI's own code
-
Reports without the mandatory working proof-of-concept artifact
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 1 hour ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2026-94484 | Next.js is a React framework for building full-stack web applications. From 15.0.0 until 15.5.27 and 16.3.8, applications with a root-level catch-all page and statically generated or Incremental Static Regeneration routes can use a shared response cache key that is insufficiently scoped to the source route. A single unauthenticated crafted request can poison that cache, causing cross-user content | Medium 6.3 | 2 Oct 2026 |
| CVE-2026-94485 | Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, the `next dev` development server exposes a Model Context Protocol endpoint without reliably restricting cross-site requests. A malicious website visited by a developer can reach the endpoint and read the project's disk location, source code snippets from error reports, route inventory, and development | Medium 6.3 | 2 Oct 2026 |
| CVE-2026-94486 | Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, the next dev development server exposes a Model Context Protocol endpoint without reliably restricting cross-site requests. A malicious website visited by a developer can reach the endpoint and read the project's disk location, source code snippets from error reports, route inventory, and development l | Low 2.3 | 2 Oct 2026 |
| CVE-2026-94543 | Next.js is a React framework for building full-stack web applications. From 15.0.0 until 15.5.27 and 16.3.8, self-hosted applications using the Pages Router with statically generated or Incremental Static Regeneration pages can key a response cache entry without sufficiently binding it to the source route. A request can replace one page's cache entry with content from a different route, causing th | Medium 6.3 | 2 Oct 2026 |
| CVE-2026-94544 | Next.js is a React framework for building full-stack web applications. From 16.3.0 until 16.3.8, pending use cache fills for the same key are shared without separating Draft Mode requests from regular requests. An overlapping regular request can receive unauthenticated unpublished content from an editor's Draft Mode fill, while an overlapping Draft Mode request can receive published content from a | Medium 6.3 | 2 Oct 2026 |
| CVE-2026-94483 | Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, Image Optimization can follow attacker-controlled DNS resolution for a remote URL that matches images.remotePatterns, allowing the optimized image fetch to reach private IP addresses after the URL passes the allow-list check. Applications without images.remotePatterns are not affected. Administrators u | High 8.3 | 2 Oct 2026 |
| CVE-2026-103004 | Next.js versions from 16.3.0 to 16.3.7 warm `use cache` handlers using `next/root-params` and can leak their return value to pages with different root params. With Cache Components enabled (cacheComponents: true), a 'use cache' function that calls another 'use cache' function that reads a root param can be keyed incorrectly when the inner call is served from an existing entry: the enclosing functi | Medium 6.3 | 1 Oct 2026 |
| CVE-2026-64648 | Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a server-side fetch with a request body may return a cached response body from a different request to the same URL but different body. Confidential data in the POST's response body would then leak to unauthorized requests. Though the request itself will not be dedup | Medium 6.0 | 27 Jul 2026 |
| CVE-2026-64649 | Next.js is a React framework for building full-stack web applications. In versions 14.1.1 through 15.5.20 and 16.0.0 through 16.2.10, when a Server Action forwards or redirects a request, an attacker can cause the server to send that outbound request to a malicious host (Server-Side Request Forgery). This requires the attacker's request to control Host-associated headers. In some configurations, i | High 8.3 | 27 Jul 2026 |
| CVE-2026-64647 | Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a server-side fetch with a request body may return a cached response body from a different request to the same URL but different body. Confidential data in the POST's response body would then leak to unauthorized requests. Though the request itself will not be dedup | Medium 6.3 | 27 Jul 2026 |
| CVE-2026-64646 | Next.js is a React framework for building full-stack web applications. In versions 13.0.0 through 15.5.20 and 16.0.0 through 16.2.10, requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive memory consumption if that Server Actions uses the Edge runtime. This issue has been fixed in versions 15.5.21 and 16.2.11. | Medium 6.3 | 27 Jul 2026 |
| CVE-2026-64641 | Next.js is a React framework for building full-stack web applications. In versions 13.0.0 through 15.5.20 and 16.0.0 through 16.2.10, crafted requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive CPU usage blocking processing of further requests in the same process. This issue has been fixed in versions 15.5.21 and 16.2.11. | High 8.2 | 27 Jul 2026 |
| CVE-2026-64642 | Next.js is a React framework for building full-stack web applications. In versions 16.0.0 through 16.2.10, crafted requests targeting Next.js applications using App Router built with Turbopack and a single entry in config.i18n.locales can bypass middleware/proxy based authentication. This issue has been fixed in version 16.2.11. | High 8.3 | 27 Jul 2026 |
| CVE-2026-64643 | Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, Next.js applications using App Router, Server Actions (use server) or use cache endpoints can be disclosed bypassing any authentication on the pages where these endpoints are usually used. Server Action IDs can be disclosed to unauthenticated users via publicly serv | Medium 6.3 | 27 Jul 2026 |
| CVE-2026-64644 | Next.js is a React framework for building full-stack web applications. In versions 15.5.0 through 15.5.20 and 16.0.0 through 16.2.10, when self-hosting Next.js with the default image loader, the Image Optimization API can optimize remotely hosted images if configured (not enabled by default). If those images contain malicious content, they can cause CPU exhaustion in /_next/image endpoints.Only co | Medium 6.3 | 27 Jul 2026 |
| CVE-2026-64645 | Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a rewrites() or redirects() rule that builds its external destination hostname from request-controlled input can be pointed at an arbitrary hostname, regardless of the rule's hostname suffix. For a rewrite, Next.js proxies the request to that arbitrary host and serv | High 8.3 | 27 Jul 2026 |
| CVE-2026-8767 | A vulnerability has been found in vercel ai up to 3.0.97. Impacted is the function run of the file .github/workflows/prettier-on-automerge.yml of the component PR Branch Name Interpolation. The manipulation leads to os command injection. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitability is considered difficult. The exploit has been disclosed to th | Low 1.3 | 17 May 2026 |
| CVE-2026-8768 | A vulnerability was found in vercel ai up to 3.0.97. The affected element is the function validateDownloadUrl of the file packages/provider-utils/src/download-blob.ts of the component provider-utils. The manipulation results in server-side request forgery. The attack can be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure b | Medium 5.5 | 17 May 2026 |
| CVE-2026-8769 | A vulnerability was determined in vercel ai up to 3.0.97. The impacted element is the function createJsonResponseHandler/createJsonErrorResponseHandler of the file packages/provider-utils/src/response-handler.ts of the component provider-utils. This manipulation causes resource consumption. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendo | Low 2.1 | 17 May 2026 |
| CVE-2026-45772 | Turborepo is a high-performance build system for JavaScript and TypeScript codebases. From 1.1.0 to before 2.9.14, Turborepo can be vulnerable to arbitrary code execution when run in untrusted repositories that contain malicious Yarn configuration. In affected versions, package manager detection executed yarn --version from the project directory, which could cause Yarn to load and execute a projec | – | 15 May 2026 |
| CVE-2026-45773 | Turborepo is a high-performance build system for JavaScript and TypeScript codebases. Prior to 2.9.14, Turborepo's self-hosted login and SSO browser flows did not validate a CSRF state value on the localhost callback. While the CLI was waiting for authentication, a malicious web page could send a request to the local callback server with an attacker-controlled token. If accepted before the legitim | Medium 5.1 | 15 May 2026 |
| CVE-2026-46508 | Turborepo is a high-performance build system for JavaScript and TypeScript codebases. Prior to 2.9.14000, the Turborepo LSP VS Code extension could execute shell commands derived from workspace-controlled values. The extension used string-based command execution for Turborepo daemon commands and task runs. A malicious workspace could provide crafted values through workspace settings or task names | High 8.4 | 15 May 2026 |
| CVE-2026-44582 | Next.js is a React framework for building full-stack web applications. From 13.4.6 to before 15.5.16 and 16.2.5, React Server Component responses can be vulnerable to cache poisoning in deployments that rely on shared caches with insufficient response partitioning. In affected conditions, collisions in the _rsc cache-busting value can allow an attacker to poison cache entries so users receive the | Low 3.7 | 13 May 2026 |
| CVE-2026-45109 | Next.js is a React framework for building full-stack web applications. From 15.2.0 to before 15.5.18 and 16.2.6, it was found that the fix addressing CVE-2026-44575 did not apply to middleware.ts with Turbopack. This vulnerability is fixed in 15.5.18 and 16.2.6. | High 7.5 | 13 May 2026 |
| CVE-2026-44578 | Next.js is a React framework for building full-stack web applications. From 13.4.13 to before 15.5.16 and 16.2.5, self-hosted applications using the built-in Node.js server can be vulnerable to server-side request forgery through crafted WebSocket upgrade requests. An attacker can cause the server to proxy requests to arbitrary internal or external destinations, which may expose internal services | High 8.6 | 13 May 2026 |
| CVE-2026-44579 | Next.js is a React framework for building full-stack web applications. From to before 15.5.16 and 16.2.5, applications using Partial Prerendering through the Cache Components feature can be vulnerable to connection exhaustion through crafted POST requests to a server action. In affected configurations, a malicious request can trigger a request-body handling deadlock that leaves connections open fo | High 7.5 | 13 May 2026 |
| CVE-2026-44580 | Next.js is a React framework for building full-stack web applications. From 13.0.0 to before 15.5.16 and 16.2.5, applications that use beforeInteractive scripts together with untrusted content can be vulnerable to cross-site scripting. In affected versions, serialized script content was not escaped safely before being embedded into the document, which could allow attacker-controlled input to break | Medium 6.1 | 13 May 2026 |
| CVE-2026-44581 | Next.js is a React framework for building full-stack web applications. From 13.4.0 to before 15.5.16 and 16.2.5, App Router applications that rely on CSP nonces can be vulnerable to stored cross-site scripting when deployed behind shared caches. In affected versions, malformed nonce values derived from request headers could be reflected into rendered HTML in an unsafe way, allowing an attacker to | Medium 4.7 | 13 May 2026 |
| CVE-2026-44573 | Next.js is a React framework for building full-stack web applications. From 12.2.0 to before 15.5.16 and 16.2.5, Applications using the Pages Router with i18n configured and middleware/proxy-based authorization can allow unauthorized access to protected page data through locale-less /_next/data/<buildId>/<page>.json requests. In affected configurations, middleware does not run for the unprefixed d | High 7.5 | 13 May 2026 |
| CVE-2026-44574 | Next.js is a React framework for building full-stack web applications. From 15.4.0 to before 15.5.16 and 16.2.5, applications that rely on middleware to protect dynamic routes can be vulnerable to authorization bypass. In affected deployments, specially crafted query parameters can alter the dynamic route value seen by the page while leaving the visible path unchanged, which can allow protected co | High 8.1 | 13 May 2026 |
| CVE-2026-44575 | Next.js is a React framework for building full-stack web applications. From 15.2.0 to before 15.5.16 and 16.2.5, App Router applications that rely on middleware or proxy-based checks for authorization can allow unauthorized access through transport-specific route variants used for segment prefetching. In affected configurations, specially crafted .rsc and segment-prefetch URLs can resolve to the s | High 7.5 | 13 May 2026 |
| CVE-2026-44576 | Next.js is a React framework for building full-stack web applications. From 14.2.0 to before 15.5.16 and 16.2.5, applications using React Server Components can be vulnerable to cache poisoning when shared caches do not correctly partition response variants. Under affected conditions, an attacker can cause an RSC response to be served from the original URL and poison shared cache entries so later v | Medium 5.4 | 13 May 2026 |
| CVE-2026-44577 | Next.js is a React framework for building full-stack web applications. From 10.0.0 to before 15.5.16 and 16.2.5, when self-hosting Next.js with the default image loader, the Image Optimization API fetches local images entirely into memory without enforcing a maximum size limit. An attacker could cause out-of-memory conditions by requesting large local assets from the /_next/image endpoint that mat | Medium 5.9 | 13 May 2026 |
| CVE-2026-44572 | Next.js is a React framework for building full-stack web applications. From 12.2.0 to before 15.5.16 and 16.2.5, an external client could send a x-nextjs-data header on a normal request to a path handled by middleware that returns a redirect. When that happened, the middleware/proxy could treat the request as a data request and replace the standard Location redirect header with the internal x-next | Low 3.7 | 13 May 2026 |
| CVE-2026-44479 | Vercel’s AI Cloud is a unified platform for building modern applications. From 50.16.0 to 52.0.0, hen the Vercel CLI runs in non-interactive mode (--non-interactive or auto-detected AI agent), commands that cannot complete autonomously emit JSON payloads with suggested follow-up commands. If the user authenticated via --token or -t on the command line, the token value is included verbatim in those | Medium 5.5 | 13 May 2026 |
| CVE-2026-27979 | Next.js is a React framework for building full-stack web applications. Starting in version 16.0.1 and prior to version 16.1.7, a request containing the `next-resume: 1` header (corresponding with a PPR resume request) would buffer request bodies without consistently enforcing `maxPostponedStateSize` in certain setups. The previous mitigation protected minimal-mode deployments, but equivalent non-m | Medium 6.9 | 18 Mar 2026 |
| CVE-2026-27980 | Next.js is a React framework for building full-stack web applications. Starting in version 10.0.0 and prior to version 16.1.7, the default Next.js image optimization disk cache (`/_next/image`) did not have a configurable upper bound, allowing unbounded cache growth. An attacker could generate many unique image-optimization variants and exhaust disk space, causing denial of service. This is fixed | Medium 6.9 | 18 Mar 2026 |
| CVE-2026-29057 | Next.js is a React framework for building full-stack web applications. Starting in version 9.5.0 and prior to versions 15.5.13 and 16.1.7, when Next.js rewrites proxy traffic to an external backend, a crafted `DELETE`/`OPTIONS` request using `Transfer-Encoding: chunked` could trigger request boundary disagreement between the proxy and backend. This could allow request smuggling through rewritten r | Medium 6.3 | 18 Mar 2026 |
| CVE-2026-27977 | Next.js is a React framework for building full-stack web applications. Starting in version 16.0.1 and prior to version 16.1.7, in `next dev`, cross-site protection for internal websocket endpoints could treat `Origin: null` as a bypass case even if `allowedDevOrigins` is configured, allowing privacy-sensitive/opaque contexts (for example sandboxed documents) to connect unexpectedly. If a dev serve | Low 2.3 | 18 Mar 2026 |
| CVE-2026-27978 | Next.js is a React framework for building full-stack web applications. Starting in version 16.0.1 and prior to version 16.1.7, `origin: null` was treated as a "missing" origin during Server Action CSRF validation. As a result, requests from opaque contexts (such as sandboxed iframes) could bypass origin verification instead of being validated as cross-origin requests. An attacker could induce a vi | Medium 5.3 | 18 Mar 2026 |
| CVE-2025-59471 | A denial of service vulnerability exists in self-hosted Next.js applications that have `remotePatterns` configured for the Image Optimizer. The image optimization endpoint (`/_next/image`) loads external images entirely into memory without enforcing a maximum size limit, allowing an attacker to cause out-of-memory conditions by requesting optimization of arbitrarily large images. This vulnerabilit | Medium 5.9 | 26 Jan 2026 |
| CVE-2025-59472 | A denial of service vulnerability exists in Next.js versions with Partial Prerendering (PPR) enabled when running in minimal mode. The PPR resume endpoint accepts unauthenticated POST requests with the `Next-Resume: 1` header and processes attacker-controlled postponed state data. Two closely related vulnerabilities allow an attacker to crash the server process through memory exhaustion: 1. **Unbo | Medium 5.9 | 26 Jan 2026 |
| CVE-2025-67779 | It was found that the fix addressing CVE-2025-55184 in React Server Components was incomplete and does not prevent a denial of service attack in a specific case. React Server Components versions 19.0.2, 19.1.3 and 19.2.2 are affected, allowing unsafe deserialization of payloads from HTTP requests to Server Function endpoints. This can cause an infinite loop that hangs the server process and may pr | High 7.5 | 12 Dec 2025 |
| CVE-2025-55184 | A pre-authentication denial of service vulnerability exists in React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints, which can cause an infinite l | High 7.5 | 11 Dec 2025 |
| CVE-2025-55183 | An information leak vulnerability exists in specific configurations of React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. A specifically crafted HTTP request sent to a vulnerable Server Function may unsafely return the source code of any Serve | Medium 5.3 | 11 Dec 2025 |
| CVE-2025-55182 | A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints. | Critical 10.0 | 3 Dec 2025 |
| CVE-2025-48985 | A vulnerability in Vercel’s AI SDK has been fixed in versions 5.0.52, 5.1.0-beta.9, and 6.0.0-beta. This issue may have allowed users to bypass filetype whitelists when uploading files. All users are encouraged to upgrade. More details: https://vercel.com/changelog/cve-2025-48985-input-validation-bypass-on-ai-sdk | Low 3.7 | 7 Nov 2025 |
| CVE-2025-55173 | Next.js is a React framework for building full-stack web applications. In versions before 14.2.31 and from 15.0.0 to before 15.4.5, Next.js Image Optimization is vulnerable to content injection. The issue allowed attacker-controlled external image sources to trigger file downloads with arbitrary content and filenames under specific configurations. This behavior could be abused for phishing or mali | Medium 4.3 | 29 Aug 2025 |
| CVE-2025-57752 | Next.js is a React framework for building full-stack web applications. In versions before 14.2.31 and from 15.0.0 to before 15.4.5, Next.js Image Optimization API routes are affected by cache key confusion. When images returned from API routes vary based on request headers (such as Cookie or Authorization), these responses could be incorrectly cached and served to unauthorized users due to a cache | Medium 6.2 | 29 Aug 2025 |
| CVE-2025-57822 | Next.js is a React framework for building full-stack web applications. Prior to versions 14.2.32 and 15.4.7, when next() was used without explicitly passing the request object, it could lead to SSRF in self-hosted applications that incorrectly forwarded user-supplied headers. This vulnerability has been fixed in Next.js versions 14.2.32 and 15.4.7. All users implementing custom middleware logic in | Medium 6.5 | 29 Aug 2025 |
| CVE-2025-7074 | A vulnerability classified as problematic has been found in vercel hyper up to 3.4.1. This affects the function expand/braceExpand/ignoreMap of the file hyper/bin/rimraf-standalone.js. The manipulation leads to inefficient regular expression complexity. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. | Low 2.1 | 5 Jul 2025 |
| CVE-2025-49005 | Next.js is a React framework for building full-stack web applications. In Next.js App Router from 15.3.0 to before 15.3.3 and Vercel CLI from 41.4.1 to 42.2.0, a cache poisoning vulnerability was found. The issue allowed page requests for HTML content to return a React Server Component (RSC) payload instead under certain conditions. When deployed to Vercel, this would only impact the browser cache | Low 3.7 | 3 Jul 2025 |
| CVE-2025-49826 | Next.js is a React framework for building full-stack web applications. From versions 15.0.4-canary.51 to before 15.1.8, a cache poisoning bug leading to a Denial of Service (DoS) condition was found in Next.js. This issue does not impact customers hosted on Vercel. Under certain conditions, this issue may allow a HTTP 204 response to be cached for static pages, leading to the 204 response being se | High 7.5 | 3 Jul 2025 |
| CVE-2025-48068 | Next.js is a React framework for building full-stack web applications. In versions starting from 13.0 to before 14.2.30 and 15.0.0 to before 15.2.2, Next.js may have allowed limited source code exposure when the dev server was running with the App Router enabled. The vulnerability only affects local development environments and requires the user to visit a malicious webpage while npm run dev is ac | Low 2.3 | 30 May 2025 |
| CVE-2025-32421 | Next.js is a React framework for building full-stack web applications. Versions prior to 14.2.24 and 15.1.6 have a race-condition vulnerability. This issue only affects the Pages Router under certain misconfigurations, causing normal endpoints to serve `pageProps` data instead of standard HTML. This issue was patched in versions 15.1.6 and 14.2.24 by stripping the `x-now-route-matches` header from | Low 3.7 | 14 May 2025 |
| CVE-2025-30218 | Next.js is a React framework for building full-stack web applications. To mitigate CVE-2025-29927, Next.js validated the x-middleware-subrequest-id which persisted across multiple incoming requests. However, this subrequest ID is sent to all requests, even if the destination is not the same host as the Next.js application. Initiating a fetch request to a third-party within Middleware will send the | Low 1.7 | 2 Apr 2025 |
| CVE-2025-29927 | Next.js is a React framework for building full-stack web applications. Starting in version 1.11.4 and prior to versions 12.3.5, 13.5.9, 14.2.25, and 15.2.3, it is possible to bypass authorization checks within a Next.js application, if the authorization check occurs in middleware. If patching to a safe version is infeasible, it is recommend that you prevent external user requests which contain the | Critical 9.1 | 21 Mar 2025 |
| CVE-2024-56332 | Next.js is a React framework for building full-stack web applications. Starting in version 13.0.0 and prior to versions 13.5.8, 14.2.21, and 15.1.2, Next.js is vulnerable to a Denial of Service (DoS) attack that allows attackers to construct requests that leaves requests to Server Actions hanging until the hosting provider cancels the function execution. This vulnerability can also be used as a De | Medium 5.3 | 3 Jan 2025 |
| CVE-2024-51479 | Next.js is a React framework for building full-stack web applications. In affected versions if a Next.js application is performing authorization in middleware based on pathname, it was possible for this authorization to be bypassed for pages directly under the application's root directory. For example: * [Not affected] `https://example.com/` * [Affected] `https://example.com/foo` * [Not affected] | High 7.5 | 17 Dec 2024 |
| CVE-2024-47831 | Next.js is a React Framework for the Web. Cersions on the 10.x, 11.x, 12.x, 13.x, and 14.x branches before version 14.2.7 contain a vulnerability in the image optimization feature which allows for a potential Denial of Service (DoS) condition which could lead to excessive CPU consumption. Neither the `next.config.js` file that is configured with `images.unoptimized` set to `true` or `images.loader | Medium 5.9 | 14 Oct 2024 |
Original policy
Copied from sorona.xyz on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Critical (Tier 1 asset) │ $10,000 │ $11,000 High │ $5,000 │ $6,000 Medium │ $1,000 │ $1,250 Low │ $500 │ $625 Submit a vulnerability CVE history 1 Last 12 months 2 Lifetime Code execution 40 % Info disclosure 30 % Access control 20 % Parsing/validation 5 % Latest advisories Loading the feed Overview The Vercel CLI is the deployment path for a very large share of the React and Next.js world, run both interactively and inside GitHub Actions or GitLab CI as the step that actually ships production. Its threat model is the classic CI-secret threat model: it holds a deployment token with the authority to publish production code, and it executes project configuration and build scripts from whatever repository it is pointed at, so vercel build running attacker-authored configuration is a direct path from a malicious pull request to a production deploy credential. The monorepo also publishes the builder and build-utils packages that run that untrusted project code. Vercel pays it as a Tier 1 asset on its open-source program, from $500 for a low finding up to $10,000 for a critical, and sorona.xyz adds 1.25× on top of whatever Vercel awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. Response times 1 business day First response 7 business days Triage 10 business days after triage Bounty In scope The vercel/vercel repository itself, listed under Tier 1 (High Priority) as a source-code asset that is bounty-eligible up to critical severity. The asset is the repo, and the hosted Vercel platform is a separate program Authentication and credential handling in the CLI: login, token issuance, the on-disk global configuration and its permissions, and what ends up in terminal output or a CI log vercel build and vercel deploy , which read project configuration and run project build scripts from whatever repository the CLI is pointed at The builder and build-utils packages this monorepo publishes, which exist to execute untrusted project code, along with the runtime shims they emit Framework detection and vercel.json parsing, covering the routing, rewrite and header configuration a project can declare File collection and upload during a deploy, including .vercelignore handling and whatever else decides which files leave the machine The environment-variable commands and the secrets they write to disk Project and team scoping in the CLI and its API client, the boundary between one team's resources and another's Out of scope Output formatting and other cosmetic issues in the CLI's terminal rendering Issues that require the attacker to already control the machine running the CLI Vulnerable-dependency reports without a demonstrated exploit chain reaching impact through the CLI Findings against the Vercel hosted platform, which belong to Vercel's separate main program Theoretical chains that only work under preconditions no real deployment would meet Examples, templates and documentation snippets rather than the CLI's own code Reports without the mandatory working proof-of-concept artifact, which are not eligible regardless of severity Most-valued findings Arbitrary code execution from malicious project configuration during vercel build or deploy, the top class here at 40% and the one that reaches the $10,000 critical row because it runs where the deploy token lives Deployment-token exposure to another local process or over the network, which in a CI runner is a direct route to publishing production code A chain through the builder or build-utils packages, since those exist specifically to execute untrusted project code Path traversal during build or deploy that exfiltrates files from outside the project directory Privilege escalation across project or team scopes, breaking the boundary the CLI's scoping is meant to enforce Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. Include a working proof-of-concept artifact with every report, without one the finding is not bounty-eligible Output formatting and cosmetic issues are lower priority, as are attacks that require the attacker to already control the machine running the CLI Vulnerable-dependency reports without a demonstrated exploit chain through the CLI itself are refused Findings against the hosted Vercel platform belong to Vercel's separate main program, not this one Confidentiality obligations last two years from the date of disclosure, even if the program ends or your participation ceases Program stats 100 Reports resolved $241k Bounties paid 89% Response efficiency Disclosure Coordinated through Vercel, with report contents confidential for two years from disclosure and written consent required before anything is published. sorona.xyz holds your finding until Vercel has resolved it and cleared publication. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability