StackPrism

npm package

next vulnerabilities by version

The latest release, 16.4.2 (Oct 15, 2026), has no known vulnerabilities. 67% of last week’s 67.5M downloads went to versions with known vulnerabilities. OSV.dev lists 73 advisories for next; the newest was published on Oct 7, 2026.

npm (opens in a new tab) describes it as “The React Framework”

Latest release
16.4.2
Oct 15, 2026, no known vulnerabilities
Downloads last week
67.5M
All versions, from npm
Advisories on OSV.dev
73
Newest Oct 7, 2026
Licence
MIT
OpenSSF Scorecard
6.2/10
vercel/next.js (opens in a new tab)

Most-downloaded versions last week

From npm’s per-version download counts for the last 7 days, each checked against OSV.dev. Open a version for its advisories and what to upgrade to.

VersionKnown vulnerabilitiesDownloads
16.3.8Sep 30, 2026No known vulnerabilities13.5M
16.4.0Oct 6, 2026No known vulnerabilities5.4M
16.3.6Sep 22, 20266 known vulnerabilities, worst rated critical5.1M
16.3.4Aug 31, 20267 known vulnerabilities, worst rated critical3.5M
15.5.27Sep 30, 2026No known vulnerabilities2.9M
16.2.6May 7, 202617 known vulnerabilities, worst rated critical2.8M
16.3.3Aug 25, 20267 known vulnerabilities, worst rated critical2.5M
16.3.5Sep 11, 20267 known vulnerabilities, worst rated critical2.3M

Who is still on a vulnerable next

67% of last week’s 67.5M next downloads went to versions with known vulnerabilities.

From npm’s per-version download counts for the last 7 days, each version checked against OSV.dev. The versions checked cover over 99% of downloads.

Release lines

Support dates from endoflife.date (opens in a new tab). A line past its end date gets no more security fixes.

LineLatestSecurity support
16LTS16.4.2No end date announced
15LTS15.5.28Until Oct 21, 2026
14LTS14.2.35Ended Oct 26, 2025
1313.5.11Ended Dec 21, 2024
1212.3.7Ended Nov 21, 2022
1111.1.4Ended Jan 27, 2022

Newest advisories

The 5 most recently published, with the versions each one affects.

  1. WarningCVE-2026-94544 on OSV.dev (opens in a new tab)GHSA-3w37-wq28-93x7

    Next.js: Pending `use cache` fill can leak Draft Mode content into regular responses and persisted pages

    Affects >= 16.3.0, < 16.3.8. Published Oct 7, 2026.

  2. WarningCVE-2026-94543 on OSV.dev (opens in a new tab)GHSA-4jqv-mc3x-m676

    Next.js has cache poisoning of SSG and ISR pages in self-hosted applications

    Affects >= 15.0.0, < 15.5.27; >= 16.0.0, < 16.3.8. Published Oct 7, 2026.

  3. LowCVE-2026-94486 on OSV.dev (opens in a new tab)GHSA-39w2-rjm5-chcv

    Next.js has information disclosure in development server's Model Context Protocol endpoint

    Affects >= 16.0.0, < 16.3.8. Published Oct 7, 2026.

  4. WarningCVE-2026-94485 on OSV.dev (opens in a new tab)GHSA-f87g-xv8r-7p7x

    Next.js has information disclosure in App Router metadata image routes via dynamicParams bypass

    Affects >= 16.0.0, < 16.3.8. Published Oct 7, 2026.

  5. WarningCVE-2026-94484 on OSV.dev (opens in a new tab)GHSA-mcj8-r9mp-w47p

    Next.js has cache poisoning in SSG/ISR rendering that leads to cross-user content substitution and persistent denial of service

    Affects >= 16.0.0, < 16.3.8; >= 15.0.0, < 15.5.27. Published Oct 7, 2026.

All 73 advisories are on OSV.dev (opens in a new tab).

Which next do you have?

Paste a public GitHub repo or drop your package.json and see every vulnerable, end-of-life or deprecated dependency, with one fix task for your coding agent. Free, no sign-up.

Check your whole repo

How this page is checked

StackPrism reads every OSV.dev advisory for next, merges duplicates filed under several ids, and asks OSV.dev which ones affect each version listed. Releases and their dates come from deps.dev, downloads from npm, support dates from endoflife.date. No AI writes this page: every sentence comes from that data, refreshed every few hours.

Last checked against OSV.dev, CISA KEV, npm, deps.dev and endoflife.date.