npm/next: high 7.5
Next has a Denial of Service with Server Components - Incomplete Fix Follow-Up
Action: Upgrade next to 14.2.35 or later.
npm i next@14.2.35npm i next@15.0.7npm i next@15.1.11npm i next@15.2.8npm i next@15.3.8npm i next@15.4.10npm i next@15.5.9npm i next@15.6.0-canary.60npm i next@16.0.10npm i next@16.1.0-canary.19Affected
| introduced | fixed | last affected |
|---|---|---|
| 13.3.1-canary.0 | 14.2.35 | - |
| 15.0.6 | 15.0.7 | - |
| 15.1.10 | 15.1.11 | - |
| 15.2.7 | 15.2.8 | - |
| 15.3.7 | 15.3.8 | - |
| 15.4.9 | 15.4.10 | - |
| 15.5.8 | 15.5.9 | - |
| 15.6.0-canary.59 | 15.6.0-canary.60 | - |
| 16.0.9 | 16.0.10 | - |
| 16.1.0-canary.17 | 16.1.0-canary.19 | - |
Fixed versions
| 14.2.35 | 15.0.7 | 15.1.11 | 15.2.8 | 15.3.8 | 15.4.10 | 15.5.9 | 15.6.0-canary.60 | 16.0.10 | 16.1.0-canary.19 |
Sources
- osv: GHSA-5j59-xgg2-r9c4
- https://github.com/vercel/next.js/security/advisories/GHSA-5j59-xgg2-r9c4
- https://nvd.nist.gov/vuln/detail/CVE-2025-67779
- https://github.com/vercel/next.js
- https://nextjs.org/blog/security-update-2025-12-11
- https://react.dev/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components
- https://www.cve.org/CVERecord?id=CVE-2025-55184
- https://www.facebook.com/security/advisories/cve-2025-67779
published · modified · JSON