next@14.2.35
Review before merging.
23 known advisories (worst: critical), no fixed version found on this major.
Why this verdict
- 23 known advisories (worst: critical), no fixed version found on this major.Evidence
Confidence 100% · algorithm v1 · computed 2026-10-19. How verdicts work
Supply chain and security
- Malware reports
- None known (OSV)
- Known advisories
- 23 known
- License
- MIT
- Install scripts
- None
- Build provenance
- Signed provenance
- Weekly downloads
- 1,273,180
- GHSA-2xp9-vwfh-vxw4Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used
- GHSA-36qx-fr4f-26g5Next.js has a Middleware / Proxy bypass in Pages Router applications using i18n
- GHSA-3g8h-86w9-wvmqNext.js's Middleware / Proxy redirects can be cache-poisoned
- GHSA-3x4c-7xq6-9pq8Next.js: Unbounded next/image disk cache growth can exhaust storage
- GHSA-4633-3j49-mh5qNext.js: Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences
- GHSA-4c39-4ccg-62r3Next.js: Unbounded Server Action payload in Edge runtime
- GHSA-68g3-v927-f742Next.js: Cache confusion of response bodies for requests with bodies
- GHSA-89xv-2m56-2m9xNext.js: Server-Side Request Forgery in Server Actions on custom servers
- GHSA-8h8q-6873-q5fjNext.js Vulnerable to Denial of Service with Server Components
- GHSA-955p-x3mx-jcvpNext.js: Unauthenticated disclosure of internal Server Function endpoints
Compatibility
No compatibility boundary is crossed: this is a patch or minor release on a stable major.
Check the official release notes below for behaviour changes before merging.
Release notes
Read the Next.js changelog on Changes.Watch or the package page on npm for this version’s features and fixes.
Deprecations and deadlines
The maintainer has not deprecated this version on npm.