| Package | Affected versions | Patched versions |
|---|---|---|
| next.js | ≥ 13.0.0, < 14.2.30≥ 15.0.0, < 15.2.2 | 14.2.3015.2.2 |
| next | ≥ 13.0, < 14.2.30≥ 15.0.0, < 15.2.2 | 14.2.3015.2.2 |
A low-severity vulnerability in Next.js has been fixed in version 15.2.2. This issue may have allowed limited source code exposure when the dev server was running with the App Router enabled. The vulnerability only affects local development environments and requires the user to visit a malicious webpage while npm run dev is active.
Because the mitigation is potentially a breaking change for some development setups, to opt-in to the fix, you must configure allowedDevOrigins in your next config after upgrading to a patched version. Learn more.
Learn more: https://vercel.com/changelog/cve-2025-48068
Thanks to sapphi-red and Radman Siddiki for responsibly disclosing this issue.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free