Is your Next.js version vulnerable?
Result for 15.5.28
No known vulnerabilities in Next.js 15.5.28
Next.js 15 reaches end of life in 4 days, on Oct 21, 2026
- Newest 15.x release
- 15.5.28 (no known advisories)
- Latest release
- 16.4.2
- Supported line to move to
- Next.js 16 LTS (16.4.2)
Last checked against npm, OSV.dev, deps.dev and endoflife.date.
Next.js release lines today
The newest Next.js release lines, their support dates from endoflife.date, and whether the newest release in each line has known advisories today. Select a version to check it.
| Line | Support | Newest release | Advisories in it |
|---|---|---|---|
| Next.js 16 LTS | Supported | 16.4.2 | None known |
| Next.js 15 LTS | End of life on Oct 21, 2026 | 15.5.28 | None known |
| Next.js 14 LTS | End of life since Oct 26, 2025 | 14.2.35 | No more fixes |
| Next.js 13 | End of life since Dec 21, 2024 | 13.5.11 | No more fixes |
| Next.js 12 | End of life since Nov 21, 2022 | 12.3.7 | No more fixes |
Next.js 16 LTS16.4.2
Supported
Advisories in the newest release: None known
Next.js 15 LTS15.5.28
End of life on Oct 21, 2026
Advisories in the newest release: None known
Next.js 14 LTS14.2.35
End of life since Oct 26, 2025
Advisories in the newest release: No more fixes
Next.js 1313.5.11
End of life since Dec 21, 2024
Advisories in the newest release: No more fixes
Next.js 1212.3.7
End of life since Nov 21, 2022
Advisories in the newest release: No more fixes
Last checked against endoflife.date, npm, OSV.dev and deps.dev.
Recent Next.js incidents
- React2Shell (CVE-2025-55182): remote code execution through React Server Components in Next.js 15.x and 16.x apps using the App Router, disclosed in December 2025 and listed by CISA as exploited.
- Middleware bypass (CVE-2025-29927): one request header skipped middleware, and with it any authorization check done there, in self-hosted Next.js 12.x to 15.x before March 2025’s fixes.
Each incident page checks a whole repo or package.json for that one problem and says plainly when nothing matches.
How the check works
The version goes to OSV.dev, which collects Next.js advisories from the GitHub Advisory Database. Each advisory’s CVE is looked up in CISA KEV and FIRST EPSS, so the list starts with what attackers use. The release line’s dates come from endoflife.date, and the newest release in your line is checked too, so the version we suggest is one with no known advisories when there is one.
To check every package in the app, not just Next.js, use the package.json checker or paste the repo into the dependency check.
Questions
How do I find my Next.js version?
Run npm ls next in the project for the installed version, or npx next --version. package.json usually holds a range such as ^15.0.3, and the installed version can be newer.
Does Next.js include its own React?
The App Router ships its own build of React, including the React Server Components packages. That’s why Next.js publishes its own advisories for React flaws such as React2Shell, and why, for a Next.js app, your next version is the one that decides.
Does my hosting change the answer?
Sometimes. The check reports by version. Some advisories only matter for self-hosted apps: Vercel says apps on its platform weren’t affected by the middleware bypass, for example. Read the advisory before deciding an upgrade can wait.
Are canary versions checked?
Yes, as given. OSV.dev understands pre-release versions, so a canary build is matched against each advisory’s affected range.
Can I share a result?
Yes: the address bar holds ?version=…, and opening it runs the check again with today’s data. Result pages aren’t indexed by search engines.
Go further than one check
Map your repo into an architecture diagram with live health on every part, get an alert when a new critical finding lands, and hand your coding agent a brief to build from. Free to start.