Vulnerability Description
Next.js is a React framework for building full-stack web applications. In versions starting from 13.0 to before 14.2.30 and 15.0.0 to before 15.2.2, Next.js may have allowed limited source code exposure when the dev server was running with the App Router enabled. The vulnerability only affects local development environments and requires the user to visit a malicious webpage while npm run dev is active. This issue has been patched in versions 14.2.30 and 15.2.2.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Vercel | Next.Js | >= 13.0.0, < 14.2.30 |
Related Weaknesses (CWE)
References
- https://github.com/vercel/next.js/security/advisories/GHSA-3h52-269p-cp9rVendor Advisory
- https://vercel.com/changelog/cve-2025-48068Vendor Advisory
FAQ
What is CVE-2025-48068?
CVE-2025-48068 is a vulnerability with a CVSS score of 4.3 (MEDIUM). Next.js is a React framework for building full-stack web applications. In versions starting from 13.0 to before 14.2.30 and 15.0.0 to before 15.2.2, Next.js may have allowed limited source code exposu...
How severe is CVE-2025-48068?
CVE-2025-48068 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-48068?
Check the references section above for vendor advisories and patch information. Affected products include: Vercel Next.Js.