Next.js vulnerability checker

How the check works

The tool loads your page the way a browser does. It reads the page, finds the script files that belong to Next.js and looks inside them for the version string the framework puts there. It does not guess paths, send exploit code or log in. Everything it sees, any visitor can see.

With the version in hand, it asks OSV (osv.dev), the open vulnerability database run by Google, which published advisories cover that exact release. Most of them come from the GitHub Advisory Database. For each one you see the severity, the identifiers (GHSA and CVE) and the version that fixes it. Because an advisory often lists a different fix for each release line, the tool picks the fix that applies to your line, such as 14.2.x or 15.5.x. It also shows the smallest version on your current major line that fixes everything fixable there, and counts the advisories that are fixed only in a newer major version.

What the result does and does not tell you

An affected version is a reason to update, not proof that the site can be broken into. Many Next.js advisories apply only to a certain feature, such as the image optimizer, middleware, server actions or the App Router with React Server Components. Others need a particular host or setting. Read the advisory, and update either way, because fixes are cheap and attackers read advisories too.

Some sites hide the version, and then no outside tool can name the advisories. The result says so instead of guessing. In that case, run npm ls next in the project, or paste package-lock.json into the npm audit tool, which sees the exact version and every other package too.

A site behind a CDN, proxy or firewall may block some attack traffic, which does not replace updating. Only check sites you own or manage. The tool makes the same single page load a visitor makes, but you should still have permission to look.