LowGHSA-3h52-269p-cp9rCVE-2025-48068

Information exposure in Next.js dev server due to lack of origin verification

Published 28 May 2025 · Updated 10 Sept 2026

Affected packages

nextnpm

Affected: >=15.0.0 <15.2.2
Fixed in: 15.2.2

Update to the fixed version for your release line, for example:npm install next@15.2.2

nextnpm

Affected: >=13.0 <14.2.30
Fixed in: 14.2.30

Update to the fixed version for your release line, for example:npm install next@14.2.30

Details

Summary

A low-severity vulnerability in Next.js has been fixed in version 15.2.2. This issue may have allowed limited source code exposure when the dev server was running with the App Router enabled. The vulnerability only affects local development environments and requires the user to visit a malicious webpage while npm run dev is active.

Because the mitigation is potentially a breaking change for some development setups, to opt-in to the fix, you must configure allowedDevOrigins in your next config after upgrading to a patched version. Learn more.

Learn more: https://vercel.com/changelog/cve-2025-48068

Credit

Thanks to sapphi-red and Radman Siddiki for responsibly disclosing this issue.

Is GHSA-3h52-269p-cp9r in any of your client repos?

Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected next, and gives you the command that fixes it.

Scan a project free, no signup Or connect GitHub to scan every repo

References

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.