New deployments of vulnerable Next.js applications are now blocked by default

T1Covered by 1 source · first reported by Vercel (blog + changelog) at 05 Dec 2025, 13:00 UTC

CVE-2025-66478 Any new deployment containing a version of Next.js that is vulnerable towill now automatically fail to deploy on Vercel. Learn more We strongly recommend upgrading to a patched version regardless of your hosting provider. DANGEROUSLY_DEPLOY_VULNERABLE_CVE_2025_66478=1 Learn more This…

security

Sources

• T1New deployments of vulnerable Next.js applications are now blocked by defaultVercel (blog + changelog)05 Dec 2025, 13:00

Vulnerabilities

• CVE-2025-66478