Next.js CVE check: is your app on a vulnerable version?

Q: Is my static-export Next.js site affected by React2Shell?

The vulnerability is in the server that handles React Server Components requests. A pure static export (output: 'export') serves prebuilt files and does not support server features such as Server Actions, per the Next.js docs, so there is no Next.js server to attack in production. Upgrade anyway: your lockfile will keep being flagged, and the moment you drop static export the risk is real.

Q: I'm on Vercel. Do I still need to upgrade?

Yes. For React2Shell, Vercel says its WAF rules are an extra layer that cannot guarantee protection against all variants, and that upgrading is the only complete fix. (For the older CVE-2025-29927 middleware bypass, the advisory notes Vercel-hosted deployments were protected automatically.)

Q: How do I check my installed version?

Run npm ls next (or pnpm why next / yarn why next). That shows the version actually installed from your lockfile, which is what matters, not the range in package.json. On a running site you can also run next.version in the browser console.

Q: What does FixMyVibe check?

Paid audits run osv-scanner on your lockfile, which checks the exact installed versions of Next.js, React and every other dependency against the public OSV database. If there is no lockfile, every scan (including the free one) compares the declared Next.js version against critical advisories such as CVE-2025-29927.

Q: Does upgrading break my app?

Patch releases within your minor line (for example 15.5.x to 15.5.28) are meant to be drop-in. Jumping a major version (15 to 16) can need code changes; read the upgrade guide, run your build and click through the critical flows before deploying.

Abstract render of a stack of thin glass layers where one repaired layer glows green

By the FixMyVibe team · Last reviewed 16 October 2026

Find the exact next version in your lockfile and compare it with the table below. As of 16 October 2026, the latest critical fixes are Next.js 15.5.28 for the 15.x line and 16.4.1 for 16.x; older versions are affected by at least one critical advisory.

Scan my repo free (read-only)See an example report

How to find your exact Next.js version

package.json usually holds a range such as ^15.3.0. The version that actually runs is pinned in your lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock). Check it with:

npm ls next react react-dom

Am I affected?

Critical advisories, newest first. Always check the official advisory list for anything newer; there are also high/moderate advisories not listed here.

Advisory	What	Affected	Fixed in
GHSA-2464-fhr4-w9xw 14 Oct 2026 · Critical (CVSS 4.0: 9.5)	RCE in Image Optimization when SVG files are used (upstream image library, glibc Linux)	>= 10.0.0 <= 15.5.27; 16.0.0 – 16.4.0	15.5.28, 16.4.1 (workaround: sharp >= 0.35.5)
GHSA-673q-mjm6-r5xr 14 Oct 2026 · Critical (CVSS 4.0: 9.5)	Unauthenticated RCE in 'use cache' functions returning typed arrays (App Router + Cache Components)	16.0.0 – 16.4.0	16.4.1
GHSA-vcvr-r3jv-pc5j 22 Sep 2026 · Critical (CVSS 4.0: 9.5)	RCE in next/og ImageResponse (Node.js runtime) with attacker-controlled SVG values	>= 16.2.0 < 16.3.6	16.3.6
CVE-2025-55182 (React2Shell) 3 Dec 2025 · Critical (CVSS 3.1: 10.0)	RCE via React Server Components in App Router apps	15.x, 16.x, 14.3.0-canary.77+	15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7, 16.0.10 (Vercel bulletin; Next.js blog lists 16.0.7)
CVE-2025-29927 21 Mar 2025 · Critical (CVSS 3.1: 9.1)	Authorization bypass in middleware via the x-middleware-subrequest header	11.1.4 up to the fixed versions	12.3.5, 13.5.9, 14.2.25, 15.2.3

CVE-2025-29927: middleware authorization bypass

If your app does its authorization checks in middleware.ts, an attacker could skip middleware entirely by sending an x-middleware-subrequest header (CVSS 9.1). Fixed in 12.3.5, 13.5.9, 14.2.25 and 15.2.3. If you cannot upgrade, block external requests carrying that header. According to the disclosure, apps hosted on Vercel or Netlify and static exports (where middleware does not run) were not affected. Either way: don't rely on middleware alone; check auth again in each route handler and server action.

CVE-2025-55182 / CVE-2025-66478 (React2Shell): RSC remote code execution

A CVSS 10.0 flaw in the React Server Components protocol let crafted requests trigger remote code execution on the server. It is tracked upstream in React as CVE-2025-55182; Next.js published CVE-2025-66478 for the downstream impact, but that ID was later rejected as a duplicate of CVE-2025-55182, so you will see both numbers. Affected: App Router apps on Next.js 15.x, 16.x and 14.3.0-canary.77 and later canaries (13.x, 14.x stable and Pages Router apps are not affected). React itself was fixed in 19.0.1, 19.1.2 and 19.2.1. Next.js offers an interactive fixer:

npx fix-react2shell-next

Vercel and Next.js also recommend rotating your app's secrets if it was online and unpatched as of 4 December 2025. Follow-up React Server Components issues (CVE-2025-55183, CVE-2025-55184) were published on 11 December 2025; see Vercel's bulletin.

The October 2026 critical advisories

On 14 October 2026 Next.js published two critical RCE advisories: one in Image Optimization when SVG files are used (fixed in 15.5.28 and 16.4.1; workaround: make sure sharp is at least 0.35.5), and one in use cache functions returning typed arrays (16.x only, fixed in 16.4.1, no workaround). In September, an RCE in the Node.js next/og ImageResponse was fixed in 16.3.6.

Patch steps

Install the latest patch release of your line:

npm install next@15.5.28   # 15.x
npm install next@16.4.1    # 16.x

Commit the updated lockfile together with package.json.
Run npm ls next again and confirm the version.
Build, test the critical flows, deploy.
If you were exposed to an RCE advisory, rotate your secrets after deploying (see leaked API keys).

Why "hosted on Vercel" is not a full answer

Hosting platforms can add WAF rules, and for some advisories (like CVE-2025-29927) Vercel-hosted apps were protected by the platform. For React2Shell, Vercel itself states that WAF rules cannot guarantee protection against all variants and that upgrading is the only complete fix. Older preview deployments can also still run a vulnerable version, which is why Vercel recommends deployment protection on non-production deployments.