Frontend framework
Next.js: supported versions and open vulnerabilities today
Next.js 16 and 15 are supported (15 until Oct 21, 2026); 14 reached end of life on Oct 26, 2025; the latest release is 16.4.2. 20 high or critical advisories for Next.js were published in the last 12 months; one advisory (CVE-2025-55182) is on CISA’s list of vulnerabilities exploited in the wild.
Last checked against endoflife.date, npm, OSV.dev, CISA KEV, FIRST EPSS and deps.dev.
- Latest release
- 16.4.2
- npm downloads last week
- 67.5M
- GitHub stars
- 143.3k
- Licence
- MIT
- OpenSSF Scorecard
- 6.2 / 10
Supported versions
Security advisories
44 advisories published in the last 12 months, 20 of them high or critical. 73 in total since records began. Checked packages: next.
Next.js is vulnerable to RCE in React flight protocol
Fixed in 15.3.6, 15.4.8, 15.5.7 and 16.0.7.
Exploited in the wild (CISA)Used in ransomwareEPSS: top 1%Next.js has Server-Side Request Forgery in Image Optimization
Fixed in 16.3.8.
EPSS: top 86%Next.js: Remote Code Execution in next/og ImageResponse
Fixed in 16.3.6.
Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used
Fixed in 15.5.24 and 16.3.3.
Next.js: Unauthenticated Remote Code Execution on windows-hosted servers
Fixed in 15.5.24 and 16.3.3.
EPSS: top 19%Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale
Fixed in 16.2.11.
EPSS: top 51%Next.js: Server-Side Request Forgery in Server Actions on custom servers
Fixed in 15.5.21 and 16.2.11.
EPSS: top 62%Next.js: Denial of Service in App Router using Server Actions
Fixed in 15.5.21 and 16.2.11.
EPSS: top 43%
Maintenance and supply chain
OpenSSF Scorecard 6.2 / 10 (scored )
The Scorecard rates the repository’s security practices, not known vulnerabilities. Recent activity: 30 commits and 4 issue updates found in the last 90 days.
Weakest checks
- Over-privileged CI tokens (Token-Permissions 0/10)
- Binaries checked into the repo (Binary-Artifacts 0/10)
- No static analysis (SAST 0/10)
Production checklist
Next.js production checklist: 7 checks before launch
- Must do: Check auth in every Server Action and Route Handler, not only in middleware
- Must do: Never put secrets in NEXT_PUBLIC_ variables
- Must do: Stay on a supported Next.js line with the latest patch
Alternatives
Nuxt
Full-stack Vue framework for server-rendered and static web apps
Strengths
- Server-side rendering and static generation
- File-based routing
Trade-offs
- Vue-only
- Smaller ecosystem than React-based frameworks
Example stacks with Next.js
Docs and release notes
Check Next.js in your own stack
This page checks Next.js in general. Your repo pins specific versions: the free dependency check reads your manifests and lists what to fix first. Prism Agent runs the same live checks on your whole stack and turns them into a plan your coding agent can build.