Next.js Server Actions Source Code Exposure Vulnerability in Next Package
Summary
GHSA-w37m-7fhw-fmv9: Next Server Actions Source Code Exposure. Affects next across 9 version ranges.
>= 15.0.0-canary.0, < 15.0.6
>= 15.1.1-canary.0, < 15.1.10
>= 15.2.0-canary.0, < 15.2.7
>= 15.3.0-canary.0, < 15.3.7
>= 15.4.0-canary.0, < 15.4.9
>= 15.5.1-canary.0, < 15.5.8
>= 15.6.0-canary.0, < 15.6.0-canary.59
>= 16.0.0-beta.0, < 16.0.9
>= 16.1.0-canary.0, < 16.1.0-canary.17
Fixed in 9 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Next.js is a popular React framework that enables developers to build server-rendered applications with ease. It provides features like automatic code splitting, server-side rendering, and static site generation. However, certain versions of the Next package are vulnerable to a security issue that can expose sensitive server-side logic through crafted HTTP requests.
Vulnerability Detail
A vulnerability exists in specific versions of the Next package (19.0.0 to 19.2.1) and frameworks using these packages, including Next.js 15.x and 16.x with the App Router. This issue allows attackers to send malicious HTTP requests to App Router endpoints, potentially revealing compiled source code of Server Functions. While this could expose business logic, it does not directly reveal secrets unless hardcoded within the Server Function code. The vulnerability is tracked as CVE-2025-55183.
How To Fix
Latest published version: 16.4.2 as of 22 Oct 2026
npm install next@16.4.2Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 15.0.0-canary.0, < 15.0.615.0.6npm install next@15.0.6 -
>= 15.1.1-canary.0, < 15.1.1015.1.10npm install next@15.1.10 -
>= 15.2.0-canary.0, < 15.2.715.2.7npm install next@15.2.7 -
>= 15.3.0-canary.0, < 15.3.715.3.7npm install next@15.3.7 -
>= 15.4.0-canary.0, < 15.4.915.4.9npm install next@15.4.9 -
>= 15.5.1-canary.0, < 15.5.815.5.8npm install next@15.5.8
Show all 9 release lines
-
>= 15.6.0-canary.0, < 15.6.0-canary.5915.6.0-canary.59npm install next@15.6.0-canary.59 -
>= 16.0.0-beta.0, < 16.0.916.0.9npm install next@16.0.9 -
>= 16.1.0-canary.0, < 16.1.0-canary.1716.1.0-canary.17npm install next@16.1.0-canary.17
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, ensure that sensitive business logic is not hardcoded in Server Functions and consider implementing additional access controls to restrict unauthorized access to App Router endpoints.
Conclusion
The Next.js Server Actions Source Code Exposure vulnerability poses a risk to applications using affected versions of the Next package. It is crucial to update to the patched versions to mitigate this risk and protect sensitive business logic from exposure.
See every vulnerability recorded for next →
FAQ
Versions 19.0.0 to 19.2.1 of the Next package and Next.js 15.x and 16.x using the App Router are affected.
The CVSS score of this vulnerability is 5.3, indicating a moderate level of risk.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
If immediate updates are not possible, implement access controls to limit exposure and avoid hardcoding sensitive logic in Server Functions.
More information can be found in the CVE record at https://www.cve.org/CVERecord?id=CVE-2025-55183.
References
Related vulnerabilities
Recent vulnerabilities recorded for next.
