You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
A low-severity vulnerability in Next.js has been fixed in version 15.2.2. This issue may have allowed limited source code exposure when the dev server was running with the App Router enabled. The vulnerability only affects local development environments and requires the user to visit a malicious webpage while npm run dev is active.
Because the mitigation is potentially a breaking change for some development setups, to opt-in to the fix, you must configure allowedDevOrigins in your next config after upgrading to a patched version. Learn more.
A vulnerability in Next.js Image Optimization has been fixed in v15.4.5 and v14.2.31. When images returned from API routes vary based on request headers (such as Cookie or Authorization), these responses could be incorrectly cached and served to unauthorized users due to a cache key confusion bug.
All users are encouraged to upgrade if they use API routes to serve images that depend on request headers and have image optimization enabled.
A vulnerability in Next.js Image Optimization has been fixed in v15.4.5 and v14.2.31. The issue allowed attacker-controlled external image sources to trigger file downloads with arbitrary content and filenames under specific configurations. This behavior could be abused for phishing or malicious file delivery.
All users relying on images.domains or images.remotePatterns are encouraged to upgrade and verify that external image sources are strictly validated.
A vulnerability in Next.js Middleware has been fixed in v14.2.32 and v15.4.7. The issue occurred when request headers were directly passed into NextResponse.next(). In self-hosted applications, this could allow Server-Side Request Forgery (SSRF) if certain sensitive headers from the incoming request were reflected back into the response.
All users implementing custom middleware logic in self-hosted environments are strongly encouraged to upgrade and verify correct usage of the next() function.
Summary
We received a responsible disclosure from Allam Rachid (zhero) for a low-severity race-condition vulnerability in Next.js. This issue only affects the Pages Router under certain misconfigurations, causing normal endpoints to serve pageProps data instead of standard HTML.
A vulnerability affects certain React packages1 for versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 and frameworks that use the affected packages, including Next.js 15.x and 16.x using the App Router. The issue is tracked upstream as CVE-2025-55182.
The vulnerability also affects experimental canary releases starting with 14.3.0-canary.77. Users on any of the 14.3 canary builds should either downgrade to a 14.x stable release or 14.3.0-canary.76.
All users of stable 15.x or 16.x Next.js versions should upgrade to a patched, stable version immediately.
Upgrade Next.js from 16.0.1 to 16.0.7 across the repo to patch upstream security issues, including the React Server Components vulnerability affecting Next 15.x/16.x. This keeps image optimization and middleware behavior secure.
Dependencies
Bumped Next.js to 16.0.7 in apps/demo, apps/web, packages/preview-server, and packages/react-email; updated lockfile.
Includes patches for React Server Components and recent Image Optimization/Middleware advisories.
Migration
If using App Router in dev, set allowedDevOrigins in next.config.js to opt in to the dev server mitigation.
Review custom middleware to avoid passing incoming request headers into NextResponse.next().
If serving images from API routes with optimization enabled, verify caching does not leak header-dependent responses.
Written for commit 34d2afd. Summary will update automatically on new commits.
Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.
This PR includes no changesets
When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types
Please, give more attention to this issue. Currently, there is a hard dependency on next 16.0.1 and we can't get around it without doing manual overrides.
is it possible to backport to version when we are using Next 15? we still have some build issue to upgrade to latest version but we are blocked by the version to deploy react-email on Vercel
npx fix-react2shell-next
Need to install the following packages:
fix-react2shell-next@1.1.4
Ok to proceed? (y) y
fix-react2shell-next - Next.js vulnerability scanner
Checking for 4 known vulnerabilities:
- CVE-2025-66478 (critical): Remote code execution via crafted RSC payload
- CVE-2025-55184 (high): DoS via malicious HTTP request causing server to hang and consume CPU
- CVE-2025-55183 (medium): Compiled Server Action source code can be exposed via malicious request
- CVE-2025-67779 (high): Incomplete fix for CVE-2025-55184 DoS via malicious RSC payload causing infinite loop
Found 2 package.json file(s)
Found 1 vulnerable file(s):
.react-email/package.json
next: 16.0.7 -> 16.0.10 [CVE-2025-55184, CVE-2025-55183, CVE-2025-67779]
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
This PR contains the following updates:
16.0.1->16.0.7GitHub Vulnerability Alerts
CVE-2025-48068
Summary
A low-severity vulnerability in Next.js has been fixed in version 15.2.2. This issue may have allowed limited source code exposure when the dev server was running with the App Router enabled. The vulnerability only affects local development environments and requires the user to visit a malicious webpage while
npm run devis active.Because the mitigation is potentially a breaking change for some development setups, to opt-in to the fix, you must configure
allowedDevOriginsin your next config after upgrading to a patched version. Learn more.Learn more: https://vercel.com/changelog/cve-2025-48068
Credit
Thanks to sapphi-red and Radman Siddiki for responsibly disclosing this issue.
CVE-2025-57752
A vulnerability in Next.js Image Optimization has been fixed in v15.4.5 and v14.2.31. When images returned from API routes vary based on request headers (such as
CookieorAuthorization), these responses could be incorrectly cached and served to unauthorized users due to a cache key confusion bug.All users are encouraged to upgrade if they use API routes to serve images that depend on request headers and have image optimization enabled.
More details at Vercel Changelog
CVE-2025-55173
A vulnerability in Next.js Image Optimization has been fixed in v15.4.5 and v14.2.31. The issue allowed attacker-controlled external image sources to trigger file downloads with arbitrary content and filenames under specific configurations. This behavior could be abused for phishing or malicious file delivery.
All users relying on
images.domainsorimages.remotePatternsare encouraged to upgrade and verify that external image sources are strictly validated.More details at Vercel Changelog
CVE-2025-57822
A vulnerability in Next.js Middleware has been fixed in v14.2.32 and v15.4.7. The issue occurred when request headers were directly passed into
NextResponse.next(). In self-hosted applications, this could allow Server-Side Request Forgery (SSRF) if certain sensitive headers from the incoming request were reflected back into the response.All users implementing custom middleware logic in self-hosted environments are strongly encouraged to upgrade and verify correct usage of the
next()function.More details at Vercel Changelog
CVE-2025-32421
Summary
We received a responsible disclosure from Allam Rachid (zhero) for a low-severity race-condition vulnerability in Next.js. This issue only affects the Pages Router under certain misconfigurations, causing normal endpoints to serve
pagePropsdata instead of standard HTML.Learn more here
Credit
Thank you to Allam Rachid (zhero) for the responsible disclosure. This research was rewarded as part of our bug bounty program.
CVE-2025-66478
A vulnerability affects certain React packages1 for versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 and frameworks that use the affected packages, including Next.js 15.x and 16.x using the App Router. The issue is tracked upstream as CVE-2025-55182.
Fixed in:
React: 19.0.1, 19.1.2, 19.2.1
Next.js: 15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7, 16.0.7
The vulnerability also affects experimental canary releases starting with 14.3.0-canary.77. Users on any of the 14.3 canary builds should either downgrade to a 14.x stable release or 14.3.0-canary.76.
All users of stable 15.x or 16.x Next.js versions should upgrade to a patched, stable version immediately.
1 The affected React packages are:
Release Notes
vercel/next.js (next)
v16.0.7Compare Source
v16.0.6Compare Source
v16.0.5Compare Source
Core Changes
Credits
Huge thanks to @lucasadrianof for helping!
v16.0.4Compare Source
v16.0.3Compare Source
Core Changes
next dev --inspect: #85037b4455a6e-20251027to4f931700-20251029: #85518cacheLifetypes out of the webpack plugin and into the dev bundler directly: #85539'use cache'in page/layout component: #855194f931700-20251029to561ee24d-20251101: #85670'next'plugin: #85749561ee24d-20251101to67f7d47a-20251103: #8576267f7d47a-20251103tof646e8ff-20251104: #85772f646e8ff-20251104todd048c3b-20251105: #85819dd048c3b-20251105tofa50caf5-20251107: #85906'use cache'call stacks: #85966fa50caf5-20251107to52684925-20251110: #85980Misc Changes
opt-level = sfor not frequently used crates: #85426experimental.cacheLife: #85467createSandbox: #85507--debug-build-pathsinstead ofNEXT_PRIVATE_APP_PATHS: #85504completion.rsa bit: #84863maxRetriesandhardErrorparameters: #85536cells are created inresolve_rawto make cell allocation order deterministic.: #85525assert*->waitFor*when the util is not instant: #85450RegExp-like implementations incheck: #85537after()tests: #85566test/integration/in flake detection tests: #85590run-for-changescript: #85619extern crateandmacro_usesyntax: #85778NEXT_TEST_PREFER_OFFLINEininstall-native.mjs: #85850next-core/src/next_client_reference/visit_client_reference.rs: #85843non_operation_vc_strongly_consistentfeature usage from next-api: #85874turbo-tasks-macros-sharedcrate intoturbo-tasks-macros: #85917next.browserWithResponse(): #85911'use cache'functions to reduce function allocations: #85904font-familydeclaration: #85913Auth0Link: #85953cacheLife&cacheTagin client: #85872cacheLife&cacheTag: #85875sharpandunrs-resolver: #83168evaluateto take module_graph: #85971encryptActionBoundArgs/decryptActionBoundArgsimports: #86015Credits
Huge thanks to @kdy1, @eps1lon, @SyMind, @bgw, @swarnava, @devjiwonchoi, @ztanner, @ijjk, @huozhi, @icyJoseph, @acdlite, @unstubbable, @gnoff, @gusfune, @vercel-release-bot, @lukesandberg, @sokra, @hayes, @shuding, @wyattjoh, @marjan-ahmed, @timneutkens, @ajstrongdev, @zigang93, @mischnic, @Nayeem-XTREME, @hamirmahal, @eli0shin, @tessamero, @gaojude, @jamesdaniels, @georgesfarah, and @timeyoutakeit for helping!
v16.0.2Compare Source
Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Never, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about these updates again.
This PR was generated by Mend Renovate. View the repository job log.
Summary by cubic
Upgrade Next.js from 16.0.1 to 16.0.7 across the repo to patch upstream security issues, including the React Server Components vulnerability affecting Next 15.x/16.x. This keeps image optimization and middleware behavior secure.
Dependencies
Migration
Written for commit 34d2afd. Summary will update automatically on new commits.