npm package
next 10.0.4 vulnerabilities
OSV.dev didn’t answer just now, so we can’t say whether next 10.0.4 has known vulnerabilities. This page checks again within the hour. Next.js 10 reached end of life on Jun 15, 2021 and gets no more security fixes. Move to Next.js 16 (LTS).
npm (opens in a new tab) describes it as “The React Framework”
- Known vulnerabilities
- Not checked
- OSV.dev didn’t answer
- Released
- Dec 22, 2020
- Latest is 16.4.2
- Downloads last week
- 1.5K
- Under 1% of next downloads
- Next.js 10 support
- End of life
- Since Jun 15, 2021
- Licence
- MIT
- Pulls in
- 652 packages
- Resolved by deps.dev
What to upgrade to
16.4.2 is the closest release with no known vulnerabilities that we checked.
Newest 10.x release. Released May 24, 2021.
16 known vulnerabilities, worst rated warning16.4.2Upgrade to this
Latest release. Released Oct 15, 2026.
No known vulnerabilities
16.4.2 came out on Oct 15, 2026. A coding agent trained before then doesn’t know it exists, so it may suggest an older release. AI knowledge cutoff dates
Hand the fix to your coding agent
One task with the upgrade, the file to change and why. Paste it into Claude Code, Cursor or Codex.
Findings
- CriticalEnd of life
Next.js 10 is end-of-life
Support ended 2021-06-15. No more security fixes — upgrade to Next.js 16 LTS (16.4.2).
- WarningOutdated
next 10.0.4 is 6 major versions behind
Latest release is 16.4.2.
Who is still on a vulnerable next
59% of last week’s 41M next downloads went to versions with known vulnerabilities.
From npm’s per-version download counts for the last 7 days, each version checked against OSV.dev. The versions checked cover over 99% of downloads.
Is next the only one?
Paste a public GitHub repo or drop your package.json and see every vulnerable, end-of-life or deprecated dependency, with one fix task. Free, no sign-up.
How this page is checked
StackPrism asks OSV.dev which advisories affect exactly next 10.0.4, merges duplicates filed under several ids, and ranks them with CISA’s Known Exploited Vulnerabilities list and FIRST EPSS. Release dates and deprecation come from deps.dev and npm, support dates from endoflife.date. No AI writes this page: every sentence comes from that data, refreshed every few hours.
Last checked against npm, OSV.dev (didn’t answer), deps.dev and endoflife.date. Findings from that source may be missing; this page refreshes soon.