Next.js security posture
While Next.js provides robust defaults like automatic XSS protection and built-in CSRF measures for certain hooks, complex Server Action implementations and custom API routes often introduce critical security gaps in production environments.
2 linked rules in the directory.
Top risks for this stack
00 critical06 high
react-server-dom: Denial of Service in Server FunctionsHIGH
Jul 2026
No rule coverage yet — consider contributing a rule.
Next.js: Server-Side Request Forgery in Server Actions on custom serversHIGH
Jul 2026
No rule coverage yet — consider contributing a rule.
Next.js: Denial of Service in the Image Optimization API using SVGsMEDIUM
Jul 2026
No rule coverage yet — consider contributing a rule.
Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single localeHIGH
Jul 2026
No rule coverage yet — consider contributing a rule.
Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-UpHIGH
May 2026
Rule coverage exists — verify in Composer export.
Next.js vulnerable to Denial of Service via connection exhaustion in applications using Cache ComponentsHIGH
May 2026
Rule coverage exists — verify in Composer export.
Next.js vulnerable to cache poisoning in React Server Component responsesMEDIUM
May 2026
Rule coverage exists — verify in Composer export.
Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routesHIGH
May 2026
Rule coverage exists — verify in Composer export.
What the framework handles
FeatureStatus
XSS PreventionBUILT-IN
Route ProtectionMANUAL CFG
CORS PolicyMANUAL CFG
Header SecurityBUILT-IN
Environment IsolationBUILT-IN