next@15.5.23
Skip this version — install 15.5.28 instead.
4 known advisories (worst: critical), fixed in 15.5.27.
Why this verdict
- 4 known advisories (worst: critical), fixed in 15.5.27.Evidence
Confidence 100% · algorithm v1 · computed 2026-10-19. How verdicts work
Supply chain and security
- Malware reports
- None known (OSV)
- Known advisories
- 4 known
- License
- MIT
- Install scripts
- None
- Build provenance
- Signed provenance
- Weekly downloads
- 270,282
- GHSA-2xp9-vwfh-vxw4Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used
- GHSA-4jqv-mc3x-m676Next.js has cache poisoning of SSG and ISR pages in self-hosted applications
- GHSA-mcj8-r9mp-w47pNext.js has cache poisoning in SSG/ISR rendering that leads to cross-user content substitution and persistent denial of service
- GHSA-p293-qw3h-jr36Next.js: Unauthenticated Remote Code Execution on windows-hosted servers
Compatibility
No compatibility boundary is crossed: this is a patch or minor release on a stable major.
3 issues mention this version in vercel/next.js within 14 days of release. See them on GitHub
Check the official release notes below for behaviour changes before merging.
Release notes
Read the Next.js changelog on Changes.Watch or the package page on npm for this version’s features and fixes.
Deprecations and deadlines
The maintainer has not deprecated this version on npm.