npm/next: high 7.5
Next Vulnerable to Denial of Service with Server Components
Action: Upgrade next to 14.2.34 or later.
npm i next@14.2.34npm i next@15.0.6npm i next@15.1.10npm i next@15.2.7npm i next@15.3.7npm i next@15.4.9npm i next@15.5.8npm i next@15.6.0-canary.59npm i next@16.0.9npm i next@16.1.0-canary.17Affected
| introduced | fixed | last affected |
|---|---|---|
| 13.3.0 | 14.2.34 | - |
| 15.0.0-canary.0 | 15.0.6 | - |
| 15.1.1-canary.0 | 15.1.10 | - |
| 15.2.0-canary.0 | 15.2.7 | - |
| 15.3.0-canary.0 | 15.3.7 | - |
| 15.4.0-canary.0 | 15.4.9 | - |
| 15.5.1-canary.0 | 15.5.8 | - |
| 15.6.0-canary.0 | 15.6.0-canary.59 | - |
| 16.0.0-beta.0 | 16.0.9 | - |
| 16.1.0-canary.0 | 16.1.0-canary.17 | - |
Fixed versions
| 14.2.34 | 15.0.6 | 15.1.10 | 15.2.7 | 15.3.7 | 15.4.9 | 15.5.8 | 15.6.0-canary.59 | 16.0.9 | 16.1.0-canary.17 |
Sources
- osv: GHSA-mwv6-3258-q52c
- https://github.com/vercel/next.js/security/advisories/GHSA-mwv6-3258-q52c
- https://github.com/vercel/next.js
- https://nextjs.org/blog/security-update-2025-12-11
- https://www.cve.org/CVERecord?id=CVE-2025-55184
published · modified · JSON