Is next 7.0 vulnerable?
npm · 4 releases from 7.0.0 to 7.0.3 · latest next is 16.4.4 · checked 2 Nov 2026
Yes: 8 known advisories
Yes. next 7.0.3, the last 7.0 release, is affected by 8 known security advisories (1 high, 5 medium, 2 low), including CVE-2021-43803, CVE-2025-57752, CVE-2025-55173. 1 more affects earlier 7.0.x releases. Upgrade to 14.2.32 or later to fix all of them.
npm install next@14.2.32Advisories affecting next 7.0.3
Next.js Affected by Cache Key Confusion for Image Optimization API Routes
- Affected
- >=0.9.9 <14.2.31 · >=15.0.0 <15.4.5
- Fixed in
- 14.2.31, 15.4.5
Next.js Content Injection Vulnerability for Image Optimization
- Affected
- >=0.9.9 <14.2.31 · >=15.0.0 <15.4.5
- Fixed in
- 14.2.31, 15.4.5
Next.js Improper Middleware Redirect Handling Leads to SSRF
- Affected
- >=0.9.9 <14.2.32 · >=15.0.0-canary.0 <15.4.7
- Fixed in
- 14.2.32, 15.4.7
Next.js Race Condition to Cache Poisoning
- Affected
- >=0.9.9 <14.2.24 · >=15.0.0 <15.1.6
- Fixed in
- 14.2.24, 15.1.6
Next.js missing cache-control header may lead to CDN caching empty reply
- Affected
- >=0.9.9 <13.4.20-canary.13
- Fixed in
- 13.4.20-canary.13
Unexpected server crash in Next.js.
- Affected
- >=12.0.0 <12.0.5 · >=0.9.9 <11.1.3
- Fixed in
- 11.1.3, 12.0.5
Open Redirect in Next.js
- Affected
- >=0.9.9 <11.1.0
- Fixed in
- 11.1.0
Directory Traversal in Next.js
- Affected
- >=0.9.9 <9.3.2
- Fixed in
- 9.3.2
Fixed within 7.0.x, affecting earlier releases
Next.js has cross site scripting (XSS) vulnerability via the 404 or 500 /_error page
- Affected
- >=7.0.0 <7.0.2
- Fixed in
- 7.0.2
Which of your client projects are still on next 7.0?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact next version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other next versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the npm registry. Refreshed daily.