MediumGHSA-gx5p-jg67-6x7hCVE-2026-44580

Next.js has cross-site scripting in beforeInteractive scripts with untrusted input

Published 11 May 2026 · Updated 10 Sept 2026

Affected packages

nextnpm

Affected: >=13.0.0 <15.5.16
Fixed in: 15.5.16

Update to the fixed version for your release line, for example:npm install next@15.5.16

nextnpm

Affected: >=16.0.0 <16.2.5
Fixed in: 16.2.5

Update to the fixed version for your release line, for example:npm install next@16.2.5

Details

Impact

Applications that use beforeInteractive scripts together with untrusted content can be vulnerable to cross-site scripting. In affected versions, serialized script content was not escaped safely before being embedded into the document, which could allow attacker-controlled input to break out of the intended script context and execute arbitrary JavaScript in a visitor's browser.

Fix

We now HTML-escape serialized beforeInteractive script content before embedding it into the page, preventing attacker-controlled content from breaking out of the inline script boundary.

Workarounds

If you cannot upgrade immediately, do not pass untrusted data into beforeInteractive scripts. If that pattern is unavoidable, sanitize or escape the content before embedding it.

Is GHSA-gx5p-jg67-6x7h in any of your client repos?

Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected next, and gives you the command that fixes it.

Scan a project free, no signup Or connect GitHub to scan every repo

References

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.