npm/next CVE-2025-48068: medium 4.3, EPSS 0.20%
Information exposure in Next.js dev server due to lack of origin verification
Action: Upgrade next to 14.2.30 or later.
npm i next@15.2.2npm i next@14.2.30Affected
| introduced | fixed | last affected |
|---|---|---|
| 15.0.0 | 15.2.2 | - |
| 13.0 | 14.2.30 | - |
Fixed versions
| 15.2.2 | 14.2.30 |
Sources
- osv: GHSA-3h52-269p-cp9r
- nvd: CVE-2025-48068
- https://github.com/vercel/next.js/security/advisories/GHSA-3h52-269p-cp9r
- https://github.com/vercel/next.js
- https://vercel.com/changelog/cve-2025-48068
CVE-2025-48068 · published · modified · JSON