Is version 15.5.10 safe?

[sinchang]

Summary

According to the Snyk blog https://security.snyk.io/vuln/SNYK-JS-NEXT-15105315, version 15.5.10 is insecure, and upgrading to 15.6.0-canary.61 is recommended. If necessary, please release a patch version instead of a canary.

Additional information

No response

Example

No response

[sinchang]

cc @ztanner

[abhishekmardiya]

Yes, version 15.5.10 is safe and includes fixes for all reported vulnerabilities.
Reference: https://vercel.com/changelog/summary-of-cve-2026-23864

There’s no need to upgrade to a canary version—canary releases are intended for testing and experimentation, not for production use.

Also, consider upgrading react and react-dom to 19.2.4. While it’s not strictly necessary—since Next.js automatically manages React versions—it’s still a good practice to keep both packages updated for consistency and potential fixes.
Reference: #87958

[aaneloy]

Short Answer

No, 15.5.10 does not exist as a patched version. You should upgrade to 15.5.9 (the latest secure version in the 15.5.x line).

Security Context

There have been three critical security advisories for Next.js in December 2025:

1. CVE-2025-66478 (CVSS 10.0 - Critical RCE)

• Disclosure: December 3, 2025
• Impact: Remote Code Execution via React Server Components
• Affected: Next.js 15.x, 16.x, and canary releases ≥14.3.0-canary.77
• NOT affected: Next.js 13.x, 14.x stable, Pages Router, Edge Runtime

2. CVE-2025-55184 / CVE-2025-67779 (High - DoS)

• Disclosure: December 11, 2025
• Impact: Denial of Service (infinite loop hangs server)
• Affected: All App Router applications ≥13.3

3. CVE-2025-55183 (Medium - Source Code Exposure)

• Disclosure: December 11, 2025
• Impact: Server Function source code can be leaked
• Affected: Next.js 15.x and 16.x only

Recommended Safe Versions (As of January 2026)

Your Version	Upgrade To
15.0.x	15.0.7
15.1.x	15.1.11
15.2.x	15.2.8
15.3.x	15.3.8
15.4.x	15.4.10
15.5.x	15.5.9
16.0.x	16.0.10
14.x	14.2.35

Quick Fix Command

# For 15.5.x users
npm install next@15.5.9

# Or use the official interactive tool
npx fix-react2shell-next

Post-Upgrade Actions

After upgrading and redeploying:

1. Rotate all application secrets (especially if your app was online and unpatched before December 4th, 2025)
2. Verify with npm list next that you're on a patched version

Official Resources

• CVE-2025-66478 Advisory
• December 11 Security Update
• GitHub Security Discussion

[abhishekmardiya]

Yes — v15.5.9 is vulnerable.
https://osv-watch.vercel.app/?ecosystem=npm&package=next&version=15.5.9

The vulnerability is not present in v15.5.10.
https://osv-watch.vercel.app/?ecosystem=npm&package=next&version=15.5.10

[sinchang]

@abhishekmardiya CVE-2025-59472 was not found in the OSV database.

[abhishekmardiya]

Some vulnerabilities don’t appear in OSV because it only pulls data from official security feeds (such as GitHub and NVD). If a vulnerability is disclosed only via vendor changelogs (like Vercel) or hasn’t been synced yet, OSV won’t list it right away. Delays and version-mapping issues can also happen.

As you can see, CVE-2025-59471 has already been added to the OSV database, while CVE-2025-59472 hasn’t appeared yet—but it will likely be added soon once the feeds are updated.

[sinchang]

@abhishekmardiya Yes, CVE-2025-59472 was in the OSV database now.

But still very confused about what the blog below says. https://vercel.com/changelog/summaries-of-cve-2025-59471-and-cve-2025-59472

cc @feedthejim

[abhishekmardiya]

Yeah, I don’t fully understand why OSV still marks it as a vulnerable version. It might be out of sync, but I’m not entirely sure.
Version 15.5.11 has been released, but it’s still currently marked as vulnerable in OSV.

You can also try running npm auditin your project—if it reports no vulnerabilities for Next.js, you should be good to go.

[icyJoseph]

v15.5.10 is safe -

To be affected by CVE-2025-59472 - you need to:

CVE-2025-59472 only affects applications running with the experimental.ppr: true or cacheComponents: true configuration options and NEXT_PRIVATE_MINIMAL_MODE=1 as an environment variable.

experimental.ppr was only ever available in version 15 canary branches. If you do use experimental.ppr on v15, you are already on canary, and need to update to latest canary.