next security advisories

16.4.2 · 15 Oct 2026MIT41.1M / weekRepository Homepage npm Atom feed

Security advisories

From OSV, open ones first. Each release line gets its own fix: an older major is fixed by a patch on that major, not by moving to the newest one.

Is your project affected?

Paste your package.json, or type the range you declare for next. It is read in your browser and sent nowhere.

Line	Newest	Where it stands
	16.4.2	Safe from 16.3.8
	15.5.28	Safe from 15.5.27
	14.2.35	23 open advisories, worst critical
	13.5.11	164 open advisories, worst critical · last release Mar 2025, no longer updated

Your version

Critical
Next.js: Remote Code Execution in next/og ImageResponseGHSA-vcvr-r3jv-pc5j · 30 Sep 2026
- 16.x16.2.0 – 16.3.5Fixed in 16.3.6
Critical
Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are usedGHSA-2xp9-vwfh-vxw4 · 8 Sep 2026
- 16.x16.0.0 – 16.3.2Fixed in 16.3.3
- 15.x15.0.0 – 15.5.23Fixed in 15.5.24
- 14.x14.0.0 – 14.2.35No fix on 14.x · move to 15.5.24
- 13.x and older10.0.0 – 13.5.11No fix, no longer updated · move to 15.5.24
Critical
Next.js: Unauthenticated Remote Code Execution on windows-hosted serversGHSA-p293-qw3h-jr36 · 8 Sep 2026
- 16.x16.0.0 – 16.3.2Fixed in 16.3.3
- 15.x15.0.0 – 15.5.23Fixed in 15.5.24
- 14.x14.0.0 – 14.2.35No fix on 14.x · move to 15.5.24
- 13.x13.4.0 – 13.5.11No fix on 13.x · move to 15.5.24
Critical
Next.js is vulnerable to RCE in React flight protocolGHSA-9qr9-h5gf-34mp · 3 Dec 2025
- 16.x16.0.0 – 16.0.6Fixed in 16.0.7
- 15.x15.0.0 – 15.5.6Fixed in 15.5.7
Critical
Authorization Bypass in Next.js MiddlewareGHSA-f82v-jwr5-mffw · 21 Mar 2025
- 15.x15.0.0 – 15.2.2Fixed in 15.2.3
- 14.x14.0.0 – 14.2.24Fixed in 14.2.25
- 13.x13.0.0 – 13.5.8Fixed in 13.5.9
- 12.x12.0.0 – 12.3.4Fixed in 12.3.5
High
Next.js has Server-Side Request Forgery in Image OptimizationGHSA-cjq9-62q9-8jv4 · 7 Oct 2026
- 16.x16.0.0 – 16.3.7Fixed in 16.3.8
High
Next.js: Server-Side Request Forgery in Server Actions on custom serversGHSA-89xv-2m56-2m9x · 22 Jul 2026
- 16.x16.0.0 – 16.2.10Fixed in 16.2.11
- 15.x15.0.0 – 15.5.20Fixed in 15.5.21
- 14.x14.1.1 – 14.2.35No fix on 14.x · move to 15.5.21
High
Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostnameGHSA-p9j2-gv94-2wf4 · 22 Jul 2026
- 16.x16.0.0 – 16.2.10Fixed in 16.2.11
- 15.x15.0.0 – 15.5.20Fixed in 15.5.21
- 14.x14.0.0 – 14.2.35No fix on 14.x · move to 15.5.21
- 13.x and older12.0.0 – 13.5.11No fix, no longer updated · move to 15.5.21
High
Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single localeGHSA-6gpp-xcg3-4w24 · 22 Jul 2026
- 16.x16.0.0 – 16.2.10Fixed in 16.2.11
High
Next.js: Denial of Service in App Router using Server ActionsGHSA-m99w-x7hq-7vfj · 22 Jul 2026
- 16.x16.0.0 – 16.2.10Fixed in 16.2.11
- 15.x15.0.0 – 15.5.20Fixed in 15.5.21
- 14.x14.0.0 – 14.2.35No fix on 14.x · move to 15.5.21
- 13.x13.0.0 – 13.5.11No fix on 13.x · move to 15.5.21
High
Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-UpGHSA-26hh-7cqf-hhc6 · 11 May 2026
- 16.x16.0.0 – 16.2.5Fixed in 16.2.6
- 15.x15.2.0 – 15.5.16Fixed in 15.5.18
High
Next.js vulnerable to Denial of Service via connection exhaustion in applications using Cache ComponentsGHSA-mg66-mrh9-m8jx · 11 May 2026
- 16.x16.0.0 – 16.2.4Fixed in 16.2.5
- 15.x15.0.0 – 15.5.15Fixed in 15.5.16
High
Next.js vulnerable to server-side request forgery in applications using WebSocket upgradesGHSA-c4j6-fc7j-m34r · 11 May 2026
- 16.x16.0.0 – 16.2.4Fixed in 16.2.5
- 15.x15.0.0 – 15.5.15Fixed in 15.5.16
- 14.x14.0.0 – 14.2.35No fix on 14.x · move to 15.5.16
- 13.x13.4.13 – 13.5.11No fix on 13.x · move to 15.5.16
High
Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routesGHSA-267c-6grr-h53f · 11 May 2026
- 16.x16.0.0 – 16.2.4Fixed in 16.2.5
- 15.x15.2.0 – 15.5.15Fixed in 15.5.16
High
Next.js has a Middleware / Proxy bypass through dynamic route parameter injectionGHSA-492v-c6pp-mqqv · 11 May 2026
- 16.x16.0.0 – 16.2.4Fixed in 16.2.5
- 15.x15.4.0 – 15.5.15Fixed in 15.5.16
High
Next.js has a Middleware / Proxy bypass in Pages Router applications using i18nGHSA-36qx-fr4f-26g5 · 11 May 2026
- 16.x16.0.0 – 16.2.4Fixed in 16.2.5
- 15.x15.0.0 – 15.5.15Fixed in 15.5.16
- 14.x14.0.0 – 14.2.35No fix on 14.x · move to 15.5.16
- 13.x and older12.2.0 – 13.5.11No fix, no longer updated · move to 15.5.16
High
Next.js Vulnerable to Denial of Service with Server ComponentsGHSA-8h8q-6873-q5fj · 11 May 2026
- 16.x16.0.0 – 16.2.4Fixed in 16.2.5
- 15.x15.0.0 – 15.5.15Fixed in 15.5.16
- 14.x14.0.0 – 14.2.35No fix on 14.x · move to 15.5.16
- 13.x13.0.0 – 13.5.11No fix on 13.x · move to 15.5.16
High
Next.js has a Denial of Service with Server ComponentsGHSA-q4gf-8mx6-v5v3 · 10 Apr 2026
- 16.x16.0.0 – 16.2.2Fixed in 16.2.3
- 15.x15.0.0 – 15.5.14Fixed in 15.5.15
- 14.x14.0.0 – 14.2.35No fix on 14.x · move to 15.5.15
- 13.x13.0.0 – 13.5.11No fix on 13.x · move to 15.5.15
High
Next.js HTTP request deserialization can lead to DoS when using insecure React Server ComponentsGHSA-h25m-26qc-wcjf · 28 Jan 2026
- 16.x16.0.0 – 16.1.4Fixed in 16.1.5
- 15.x15.0.0 – 15.5.9Fixed in 15.5.10
- 14.x14.0.0 – 14.2.35No fix on 14.x · move to 15.5.10
- 13.x13.0.0 – 13.5.11No fix on 13.x · move to 15.5.10
High
Next has a Denial of Service with Server Components - Incomplete Fix Follow-UpGHSA-5j59-xgg2-r9c4 · 12 Dec 2025
- 16.x16.0.9Fixed in 16.0.10
- 15.x15.0.6 – 15.5.8Fixed in 15.5.9
- 14.x14.0.0 – 14.2.34Fixed in 14.2.35
- 13.x13.3.1 – 13.5.11No fix on 13.x · move to 14.2.35
High
Next Vulnerable to Denial of Service with Server ComponentsGHSA-mwv6-3258-q52c · 11 Dec 2025
- 16.x16.0.0 – 16.0.8Fixed in 16.0.9
- 15.x15.0.0 – 15.5.7Fixed in 15.5.8
- 14.x14.0.0 – 14.2.33Fixed in 14.2.34
- 13.x13.3.0 – 13.5.11No fix on 13.x · move to 14.2.34
High
Next.JS vulnerability can lead to DoS via cache poisoning GHSA-67rr-84xm-4c7r · 3 Jul 2025
- 15.x15.0.4 – 15.1.7Fixed in 15.1.8
High
Next.js authorization bypass vulnerabilityGHSA-7gfc-8cq8-jh5f · 17 Dec 2024
- 14.x14.0.0 – 14.2.14Fixed in 14.2.15
- 13.x and older9.5.5 – 13.5.11No fix, no longer updated · move to 14.2.15
High
Next.js Cache PoisoningGHSA-gp8f-8m3g-qvj9 · 17 Sep 2024
- 14.x14.0.0 – 14.2.9Fixed in 14.2.10
- 13.x13.5.1 – 13.5.6Fixed in 13.5.7
High
Next.js Denial of Service (DoS) conditionGHSA-fq54-2j52-jc42 · 10 Jul 2024
- 13.x13.3.1 – 13.4.19Fixed in 13.5.0
High
Next.js Server-Side Request Forgery in Server ActionsGHSA-fr5h-rqp8-mj6g · 9 May 2024
- 14.x14.0.0 – 14.1.0Fixed in 14.1.1
- 13.x13.4.0 – 13.5.11No fix on 13.x · move to 14.1.1
High
Next.js Vulnerable to HTTP Request SmugglingGHSA-77r5-gw3j-2mpf · 9 May 2024
- 13.x13.4.0 – 13.5.0Fixed in 13.5.1
High
Unexpected server crash in Next.js.GHSA-25mp-g6fv-mqxx · 7 Dec 2021
- 12.x12.0.0 – 12.0.4Fixed in 12.0.5
- 11.x11.0.0 – 11.1.2Fixed in 11.1.3
- 10.x and older0.9.9 – 10.2.3No fix, no longer updated · move to 11.1.3
High
XSS in Image Optimization API for Next.jsGHSA-9gr3-7897-pp7m · 1 Sep 2021
- 11.x11.0.0 – 11.1.0Fixed in 11.1.1
- 10.x10.0.0 – 10.2.3No fix on 10.x · move to 11.1.1
High
Remote Code Execution in nextGHSA-5vj8-3v2h-h38v · 4 Sep 2020
- 5.x5.0.0Fixed in 5.1.0
- 4.x and older0.9.9 – 4.2.3No fix, no longer updated · move to 5.1.0
High
Directory traversal vulnerability in Next.jsGHSA-m34x-wgrh-g897 · 24 Jan 2018
- 4.x4.0.0 – 4.2.2Fixed in 4.2.3
- 3.x and older1.0.0 – 3.2.3No fix, no longer updated · move to 4.2.3
High
Next.js Directory Traversal VulnerabilityGHSA-3f5c-4qxj-vmpf · 5 Dec 2017
- 2.x2.0.0 – 2.4.0Fixed in 2.4.1
- 1.x1.0.0 – 1.2.3No fix on 1.x · move to 2.4.1
Moderate
Next.js: Pending `use cache` fill can leak Draft Mode content into regular responses and persisted pagesGHSA-3w37-wq28-93x7 · 7 Oct 2026
- 16.x16.3.0 – 16.3.7Fixed in 16.3.8
Moderate
Next.js has cache poisoning of SSG and ISR pages in self-hosted applicationsGHSA-4jqv-mc3x-m676 · 7 Oct 2026
- 16.x16.0.0 – 16.3.7Fixed in 16.3.8
- 15.x15.0.0 – 15.5.26Fixed in 15.5.27
Moderate
Next.js has information disclosure in App Router metadata image routes via dynamicParams bypassGHSA-f87g-xv8r-7p7x · 7 Oct 2026
- 16.x16.0.0 – 16.3.7Fixed in 16.3.8
Moderate
Next.js has cache poisoning in SSG/ISR rendering that leads to cross-user content substitution and persistent denial of serviceGHSA-mcj8-r9mp-w47p · 7 Oct 2026
- 16.x16.0.0 – 16.3.7Fixed in 16.3.8
- 15.x15.0.0 – 15.5.26Fixed in 15.5.27
Moderate
Next.js: Cache confusion of response bodies for requests with bodiesGHSA-68g3-v927-f742 · 22 Jul 2026
- 16.x16.0.0 – 16.2.10Fixed in 16.2.11
- 15.x15.0.0 – 15.5.20Fixed in 15.5.21
- 14.x14.0.0 – 14.2.35No fix on 14.x · move to 15.5.21
- 13.x13.0.0 – 13.5.11No fix on 13.x · move to 15.5.21
Moderate
Next.js: Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequencesGHSA-4633-3j49-mh5q · 22 Jul 2026
- 16.x16.0.0 – 16.2.10Fixed in 16.2.11
- 15.x15.0.0 – 15.5.20Fixed in 15.5.21
- 14.x14.0.0 – 14.2.35No fix on 14.x · move to 15.5.21
- 13.x13.0.0 – 13.5.11No fix on 13.x · move to 15.5.21
Moderate
Next.js: Unbounded Server Action payload in Edge runtimeGHSA-4c39-4ccg-62r3 · 22 Jul 2026
- 16.x16.0.0 – 16.2.10Fixed in 16.2.11
- 15.x15.0.0 – 15.5.20Fixed in 15.5.21
- 14.x14.0.0 – 14.2.35No fix on 14.x · move to 15.5.21
- 13.x13.0.0 – 13.5.11No fix on 13.x · move to 15.5.21
Moderate
Next.js: Denial of Service in the Image Optimization API using SVGsGHSA-q8wf-6r8g-63ch · 22 Jul 2026
- 16.x16.0.0 – 16.2.10Fixed in 16.2.11
- 15.x15.5.0 – 15.5.20Fixed in 15.5.21
Moderate
Next.js: Unauthenticated disclosure of internal Server Function endpointsGHSA-955p-x3mx-jcvp · 22 Jul 2026
- 16.x16.0.0 – 16.2.10Fixed in 16.2.11
- 15.x15.0.0 – 15.5.20Fixed in 15.5.21
- 14.x14.0.0 – 14.2.35No fix on 14.x · move to 15.5.21
- 13.x13.0.0 – 13.5.11No fix on 13.x · move to 15.5.21
Moderate
Next.js vulnerable to cross-site scripting in App Router applications using CSP noncesGHSA-ffhc-5mcf-pf4q · 11 May 2026
- 16.x16.0.0 – 16.2.4Fixed in 16.2.5
- 15.x15.0.0 – 15.5.15Fixed in 15.5.16
- 14.x14.0.0 – 14.2.35No fix on 14.x · move to 15.5.16
- 13.x13.4.0 – 13.5.11No fix on 13.x · move to 15.5.16
Moderate
Next.js has cross-site scripting in beforeInteractive scripts with untrusted inputGHSA-gx5p-jg67-6x7h · 11 May 2026
- 16.x16.0.0 – 16.2.4Fixed in 16.2.5
- 15.x15.0.0 – 15.5.15Fixed in 15.5.16
- 14.x14.0.0 – 14.2.35No fix on 14.x · move to 15.5.16
- 13.x13.0.0 – 13.5.11No fix on 13.x · move to 15.5.16
Moderate
Next.js has a Denial of Service in the Image Optimization APIGHSA-h64f-5h5j-jqjh · 11 May 2026
- 16.x16.0.0 – 16.2.4Fixed in 16.2.5
- 15.x15.0.0 – 15.5.15Fixed in 15.5.16
- 14.x14.0.0 – 14.2.35No fix on 14.x · move to 15.5.16
- 13.x and older10.0.0 – 13.5.11No fix, no longer updated · move to 15.5.16
Moderate
Next.js vulnerable to cache poisoning in React Server Component responsesGHSA-wfc6-r584-vfw7 · 11 May 2026
- 16.x16.0.0 – 16.2.4Fixed in 16.2.5
- 15.x15.0.0 – 15.5.15Fixed in 15.5.16
- 14.x14.2.0 – 14.2.35No fix on 14.x · move to 15.5.16
Moderate
Next.js: HTTP request smuggling in rewritesGHSA-ggv3-7p47-pfv8 · 17 Mar 2026
- 16.x16.0.0 – 16.1.6Fixed in 16.1.7
- 15.x15.0.0 – 15.5.12Fixed in 15.5.13
- 14.x14.0.0 – 14.2.35No fix on 14.x · move to 15.5.13
- 13.x and older9.5.0 – 13.5.11No fix, no longer updated · move to 15.5.13
Moderate
Next.js: Unbounded next/image disk cache growth can exhaust storageGHSA-3x4c-7xq6-9pq8 · 17 Mar 2026
- 16.x16.0.0 – 16.1.6Fixed in 16.1.7
- 15.x15.0.0 – 15.5.13Fixed in 15.5.14
- 14.x14.0.0 – 14.2.35No fix on 14.x · move to 15.5.14
- 13.x and older10.0.0 – 13.5.11No fix, no longer updated · move to 15.5.14
Moderate
Next.js: Unbounded postponed resume buffering can lead to DoSGHSA-h27x-g6w4-24gq · 17 Mar 2026
- 16.x16.0.1 – 16.1.6Fixed in 16.1.7
Moderate
Next.js: null origin can bypass Server Actions CSRF checksGHSA-mq59-m269-xvcx · 17 Mar 2026
- 16.x16.0.1 – 16.1.6Fixed in 16.1.7
Moderate
Next.js has Unbounded Memory Consumption via PPR Resume Endpoint GHSA-5f7q-jpqc-wp7h · 28 Jan 2026
- 16.x16.0.0 – 16.1.4Fixed in 16.1.5
Moderate
Next.js self-hosted applications vulnerable to DoS via Image Optimizer remotePatterns configurationGHSA-9g9p-9gw9-jx7f · 27 Jan 2026
- 16.x16.0.0 – 16.1.4Fixed in 16.1.5
- 15.x15.0.0 – 15.5.9Fixed in 15.5.10
- 14.x14.0.0 – 14.2.35No fix on 14.x · move to 15.5.10
- 13.x and older10.0.0 – 13.5.11No fix, no longer updated · move to 15.5.10
Moderate
Next Server Actions Source Code Exposure GHSA-w37m-7fhw-fmv9 · 11 Dec 2025
- 16.x16.0.0 – 16.0.8Fixed in 16.0.9
- 15.x15.0.0 – 15.5.7Fixed in 15.5.8
Moderate
Next.js Affected by Cache Key Confusion for Image Optimization API RoutesGHSA-g5qg-72qw-gw5v · 29 Aug 2025
- 15.x15.0.0 – 15.4.4Fixed in 15.4.5
- 14.x14.0.0 – 14.2.30Fixed in 14.2.31
- 13.x and older0.9.9 – 13.5.11No fix, no longer updated · move to 14.2.31
Moderate
Next.js Content Injection Vulnerability for Image OptimizationGHSA-xv57-4mr9-wg8v · 29 Aug 2025
- 15.x15.0.0 – 15.4.4Fixed in 15.4.5
- 14.x14.0.0 – 14.2.30Fixed in 14.2.31
- 13.x and older0.9.9 – 13.5.11No fix, no longer updated · move to 14.2.31
Moderate
Next.js Improper Middleware Redirect Handling Leads to SSRFGHSA-4342-x723-ch2f · 29 Aug 2025
- 15.x15.0.0 – 15.4.6Fixed in 15.4.7
- 14.x14.0.0 – 14.2.31Fixed in 14.2.32
- 13.x and older0.9.9 – 13.5.11No fix, no longer updated · move to 14.2.32
Moderate
Next.js Allows a Denial of Service (DoS) with Server ActionsGHSA-7m27-7ghc-44w9 · 3 Jan 2025
- 15.x15.0.0 – 15.1.1Fixed in 15.1.2
- 14.x14.0.0 – 14.2.20Fixed in 14.2.21
- 13.x13.0.0 – 13.5.7Fixed in 13.5.8
Moderate
Denial of Service condition in Next.js image optimizationGHSA-g77x-44xx-532m · 14 Oct 2024
- 14.x14.0.0 – 14.2.6Fixed in 14.2.7
- 13.x and older10.0.0 – 13.5.11No fix, no longer updated · move to 14.2.7
Moderate
Unexpected server crash in Next.jsGHSA-wff4-fpwg-qqv3 · 30 Aug 2022
- 12.x12.2.3Fixed in 12.2.4
Moderate
Improper CSP in Image Optimization API for Next.js versions between 10.0.0 and 12.1.0GHSA-fmvm-x8mv-47mj · 17 Feb 2022
- 12.x12.0.0 – 12.0.10Fixed in 12.1.0
- 11.x and older10.0.0 – 11.1.4No fix, no longer updated · move to 12.1.0
Moderate
Denial of Service Vulnerability in next.jsGHSA-wr66-vrwm-5g5x · 28 Jan 2022
- 12.x12.0.0 – 12.0.8Fixed in 12.0.9
Moderate
Open Redirect in Next.jsGHSA-vxf5-wxwp-m7g9 · 12 Aug 2021
- 11.x11.0.0 – 11.0.1Fixed in 11.1.0
- 10.x and older0.9.9 – 10.2.3No fix, no longer updated · move to 11.1.0
Moderate
Open Redirect in Next.js versionsGHSA-x56p-c8cg-q435 · 8 Oct 2020
- 9.x9.5.0 – 9.5.3Fixed in 9.5.4
Moderate
Directory Traversal in Next.jsGHSA-fq77-7p7r-83rj · 30 Mar 2020
- 9.x9.0.0 – 9.3.1Fixed in 9.3.2
- 8.x and older0.9.9 – 8.1.0No fix, no longer updated · move to 9.3.2
Moderate
Next.js has cross site scripting (XSS) vulnerability via the 404 or 500 /_error pageGHSA-qw96-mm2g-c8m7 · 15 Oct 2018
- 7.x7.0.0 – 7.0.1Fixed in 7.0.2
Low
Next.js has information disclosure in development server's Model Context Protocol endpointGHSA-39w2-rjm5-chcv · 7 Oct 2026
- 16.x16.0.0 – 16.3.7Fixed in 16.3.8
Low
Next.js's Middleware / Proxy redirects can be cache-poisonedGHSA-3g8h-86w9-wvmq · 11 May 2026
- 16.x16.0.0 – 16.2.4Fixed in 16.2.5
- 15.x15.0.0 – 15.5.15Fixed in 15.5.16
- 14.x14.0.0 – 14.2.35No fix on 14.x · move to 15.5.16
- 13.x and older12.2.0 – 13.5.11No fix, no longer updated · move to 15.5.16
Low
Next.js vulnerable to cache poisoning via collisions in React Server Component cache-bustingGHSA-vfv6-92ff-j949 · 11 May 2026
- 16.x16.0.0 – 16.2.4Fixed in 16.2.5
- 15.x15.0.0 – 15.5.15Fixed in 15.5.16
- 14.x14.0.0 – 14.2.35No fix on 14.x · move to 15.5.16
- 13.x13.4.6 – 13.5.11No fix on 13.x · move to 15.5.16
Low
Next.js: null origin can bypass dev HMR websocket CSRF checksGHSA-jcc7-9wpm-mj36 · 17 Mar 2026
- 16.x16.0.1 – 16.1.6Fixed in 16.1.7
Low
Next.js has a Cache poisoning vulnerability due to omission of the Vary headerGHSA-r2fc-ccr8-96c4 · 3 Jul 2025
- 15.x15.3.0 – 15.3.2Fixed in 15.3.3
Low
Information exposure in Next.js dev server due to lack of origin verificationGHSA-3h52-269p-cp9r · 28 May 2025
- 15.x15.0.0 – 15.2.1Fixed in 15.2.2
Low
Next.js Race Condition to Cache PoisoningGHSA-qpjv-v59x-3qc4 · 15 May 2025
- 15.x15.0.0 – 15.1.5Fixed in 15.1.6
- 14.x14.0.0 – 14.2.23Fixed in 14.2.24
- 13.x and older0.9.9 – 13.5.11No fix, no longer updated · move to 14.2.24
Low
Next.js may leak x-middleware-subrequest-id to external hostsGHSA-223j-4rm8-mrmf · 2 Apr 2025
- 15.x15.2.3Fixed in 15.2.4
- 14.x14.2.25Fixed in 14.2.26
- 13.x13.5.9Fixed in 13.5.10
- 12.x12.3.5Fixed in 12.3.6
Low
Next.js missing cache-control header may lead to CDN caching empty replyGHSA-c59h-r6p8-q9wc · 22 Oct 2023
- 13.x13.0.0 – 13.4.19Fixed in 13.5.0
- 12.x and older0.9.9 – 12.3.7No fix, no longer updated · move to 13.5.0

Quality and security signals

What npm and deps.dev say about the latest release. Signals, not a verdict.

Licence
MIT
Provenance
Present, built from github.com/vercel/next.js
Says where the release was built and from which commit. It does not say the code is safe.
Published by
GitHub Actions
Maintainers on npm
vercel-release-bot, matt.straka, matheuss, zeit-bot
Size
192.5 MB unpacked, 8,688 files
GitHub stars
143,250 on vercel/next.js
Last release
16.4.1, 14 October 2026
OpenSSF Scorecard
6.2 / 10 · 24 Aug 2026Lowest: Binary-Artifacts 0, CII-Best-Practices 0, SAST 0, Token-Permissions 0
Grades the repository's practices (reviews, CI, branch protection), not the package's code.

Registry facts last checked 21 Oct 2026. Releases and advisories last read 21 Oct 2026.