Packages / next / Security

LowVulnerabilityGHSA-3h52-269p-cp9rCVE-2025-48068Published 28 May 2025

Information exposure in Next.js dev server due to lack of origin verification

Affected releases · next

  • 15.x15.0.0 – 15.2.1Fixed in 15.2.2

On 15.x, the newest line:

npm install next@15.2.2
16.x

  1. Not affected

    16.0.0 – 16.4.2

    45 releases, latest

15.x

  1. Affected

    15.0.0 – 15.2.1

    24 releases

  2. Fixed

    15.2.2 – 15.5.28

    58 releases

423 stable releases of next, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for next. It is read in your browser and sent nowhere.

What happens

Summary

A low-severity vulnerability in Next.js has been fixed in version 15.2.2. This issue may have allowed limited source code exposure when the dev server was running with the App Router enabled. The vulnerability only affects local development environments and requires the user to visit a malicious webpage while npm run dev is active.

Because the mitigation is potentially a breaking change for some development setups, to opt-in to the fix, you must configure allowedDevOrigins in your next config after upgrading to a patched version. Learn more.

Learn more: vercel.com/changelog/cve-2025-48068

Credit

Thanks to sapphi-red and Radman Siddiki for responsibly disclosing this issue.