StackPrism

Is your Next.js version vulnerable?

Enter your Next.js version, or paste your package.json. You get every known advisory for that release, which ones attackers exploit (CISA KEV), the version that fixes all of them, and how long your release line is supported.
Examples:

Result for 12.3.7

Next.js 12.3.7 has 15 known vulnerabilities

Next.js 12 is past end of life (since Nov 21, 2022): no more security fixes

Move to 16.4.2: it’s on a supported long-term support line.

Fixes all of them
15.5.24
Newest 12.x release
12.3.7 (15 known advisories)
Latest release
16.4.2
Supported line to move to
Next.js 16 LTS (16.4.2)

One task with the upgrade and why. Paste it into Claude Code, Cursor or Codex.

Advisories, most urgent first

Show all 15 advisories
next 12.3.7 package pageAll Next.js support dates (opens in a new tab)

Last checked against npm, OSV.dev, deps.dev, CISA KEV, FIRST EPSS and endoflife.date.

Next.js release lines today

The newest Next.js release lines, their support dates from endoflife.date, and whether the newest release in each line has known advisories today. Select a version to check it.

  • Next.js 16 LTS16.4.2

    Supported

    Advisories in the newest release: None known

  • Next.js 15 LTS15.5.28

    End of life on Oct 21, 2026

    Advisories in the newest release: None known

  • Next.js 14 LTS14.2.35

    End of life since Oct 26, 2025

    Advisories in the newest release: No more fixes

  • Next.js 1313.5.11

    End of life since Dec 21, 2024

    Advisories in the newest release: No more fixes

  • Next.js 1212.3.7

    End of life since Nov 21, 2022

    Advisories in the newest release: No more fixes

Last checked against endoflife.date, npm, OSV.dev and deps.dev.

Recent Next.js incidents

  • React2Shell (CVE-2025-55182): remote code execution through React Server Components in Next.js 15.x and 16.x apps using the App Router, disclosed in December 2025 and listed by CISA as exploited.
  • Middleware bypass (CVE-2025-29927): one request header skipped middleware, and with it any authorization check done there, in self-hosted Next.js 12.x to 15.x before March 2025’s fixes.

Each incident page checks a whole repo or package.json for that one problem and says plainly when nothing matches.

How the check works

The version goes to OSV.dev, which collects Next.js advisories from the GitHub Advisory Database. Each advisory’s CVE is looked up in CISA KEV and FIRST EPSS, so the list starts with what attackers use. The release line’s dates come from endoflife.date, and the newest release in your line is checked too, so the version we suggest is one with no known advisories when there is one.

To check every package in the app, not just Next.js, use the package.json checker or paste the repo into the dependency check.

Questions

How do I find my Next.js version?

Run npm ls next in the project for the installed version, or npx next --version. package.json usually holds a range such as ^15.0.3, and the installed version can be newer.

Does Next.js include its own React?

The App Router ships its own build of React, including the React Server Components packages. That’s why Next.js publishes its own advisories for React flaws such as React2Shell, and why, for a Next.js app, your next version is the one that decides.

Does my hosting change the answer?

Sometimes. The check reports by version. Some advisories only matter for self-hosted apps: Vercel says apps on its platform weren’t affected by the middleware bypass, for example. Read the advisory before deciding an upgrade can wait.

Are canary versions checked?

Yes, as given. OSV.dev understands pre-release versions, so a canary build is matched against each advisory’s affected range.

Can I share a result?

Yes: the address bar holds ?version=…, and opening it runs the check again with today’s data. Result pages aren’t indexed by search engines.

Go further than one check

Map your repo into an architecture diagram with live health on every part, get an alert when a new critical finding lands, and hand your coding agent a brief to build from. Free to start.

Map my repoDesign a stack