Next.js 12.3.x Release Notes

Notes

This release patches the vendored http-proxy library so it parses proxy targets with Next.js' WHATWG-based parseUrl instead of the legacy url.parse, and updates 30 bundled dependencies to remediate 57 advisories.

Most of next's dependencies are bundled into the published package rather than installed from npm, so these updates cannot be picked up by upgrading an app's lockfile.

• Full package name(s) and version(s):
  • @neverendingsupport/next@12.3.7-next-12.3.15
  • @neverendingsupport/next-bundle-analyzer@12.3.7-next-12.3.15
  • @neverendingsupport/next-env@12.3.7-next-12.3.15
  • @neverendingsupport/next-eslint-plugin-next@12.3.7-next-12.3.15
  • @neverendingsupport/next-mdx@12.3.7-next-12.3.15
  • @neverendingsupport/next-polyfill-module@12.3.7-next-12.3.15
  • @neverendingsupport/next-polyfill-nomodule@12.3.7-next-12.3.15
  • @neverendingsupport/next-react-dev-overlay@12.3.7-next-12.3.15
  • @neverendingsupport/next-react-refresh-utils@12.3.7-next-12.3.15
  • @neverendingsupport/eslint-config-next@12.3.7-next-12.3.15

Security Fixes

• next/server (rewrites/redirects):
  • Prevent SSRF and Open Redirect via an attacker-controlled destination hostname.
    • This fixes a high-severity Server-Side Request Forgery (SSRF) and Open Redirect vulnerability (CVE-2026-64645).

Dependency Updates

• Upgrade ajv to v6.14.0 and v8.18.0.
  • Check the ajv repository v6.14.0 and release notes for v8.18.0 for details.
  • This fixes a moderate-severity regular expression denial of service (ReDoS) vulnerability when using the $data option (CVE-2025-69873).
• Upgrade ansi-regex to v3.0.1.
  • Check the ansi-regex repository v3.0.1 for details.
  • This fixes a high-severity inefficient regular expression complexity vulnerability (CVE-2021-3807).
• Upgrade @babel/runtime to v7.26.10.
  • Check the @babel/runtime release notes for details.
  • This fixes a moderate-severity inefficient regular expression complexity vulnerability (CVE-2025-27789).
• Upgrade bn.js to v4.12.3 and v5.2.3.
  • Check the bn.js repository v4.12.3 and v5.2.3 for details.
  • This fixes a moderate-severity infinite loop vulnerability (CVE-2026-2739).
• Upgrade brace-expansion to v1.1.18.
  • Check the brace-expansion repository v1.1.18 for details.
  • This fixes a high-severity denial of service vulnerability via exponential-time expansion (CVE-2026-13149).
  • This fixes a high-severity denial of service vulnerability via unbounded expansion length (CVE-2026-14257).
  • This fixes a high-severity denial of service vulnerability via unbounded intermediate arrays (CVE-2026-69152).
  • This fixes a moderate-severity process hang caused by a zero-step sequence (CVE-2026-33750).
  • This fixes a low-severity regular expression denial of service (ReDoS) vulnerability (CVE-2025-5889).
• Upgrade braces to v3.0.3.
  • Check the braces repository v3.0.3 for details.
  • This fixes a high-severity uncontrolled resource consumption vulnerability (CVE-2024-4068).
• Upgrade browserify-sign to v4.2.2.
  • Check the browserify-sign repository v4.2.2 for details.
  • This fixes a high-severity signature forgery vulnerability caused by an upper bound check issue in dsaVerify (CVE-2023-46234).
• Upgrade cipher-base to v1.0.5.
  • Check the cipher-base repository v1.0.5 for details.
  • This fixes a critical-severity hash rewind vulnerability caused by missing input type checks (CVE-2025-9287).
• Upgrade cross-spawn to v6.0.6.
  • Check the cross-spawn repository v6.0.6 for details.
  • This fixes a high-severity regular expression denial of service (ReDoS) vulnerability (CVE-2024-21538).
• Upgrade debug to v4.3.1.
  • Check the debug release notes for details.
  • This fixes a low-severity regular expression denial of service (ReDoS) vulnerability (CVE-2017-16137).
• Upgrade elliptic to v6.6.1.
  • Check the elliptic repository v6.6.1 for details.
  • This fixes a critical-severity private key extraction vulnerability when signing malformed input (GHSA-vjh7-7g9h-fjfh).
  • This fixes a moderate-severity risky cryptographic algorithm vulnerability (CVE-2020-28498).
  • This fixes five low-severity ECDSA and EDDSA signature validation vulnerabilities (CVE-2024-42459, CVE-2024-42460, CVE-2024-42461, CVE-2024-48948, CVE-2024-48949).
• Upgrade follow-redirects to v1.16.0.
  • Check the follow-redirects repository v1.16.0 for details.
  • This fixes a high-severity exposure of sensitive information vulnerability (CVE-2022-0155).
  • This fixes a moderate-severity vulnerability where the Proxy-Authorization header was kept across hosts (CVE-2024-28849).
  • This fixes a moderate-severity improper URL handling vulnerability (CVE-2023-26159).
  • This fixes a moderate-severity exposure of sensitive information vulnerability (CVE-2022-0536).
  • This fixes a moderate-severity vulnerability leaking custom authentication headers to cross-origin redirects (CVE-2026-40895).
• Upgrade json5 to v2.2.2.
  • Check the json5 release notes for details.
  • This fixes a high-severity prototype pollution vulnerability in the parse method (CVE-2022-46175).
• Upgrade jws to v3.2.3.
  • Check the jws release notes for details.
  • This fixes a high-severity improper HMAC signature verification vulnerability (CVE-2025-65945).
• Upgrade loader-utils to v2.0.4 and v3.2.1.
  • Check the loader-utils release notes for v2.0.4 and v3.2.1 for details.
  • This fixes a critical-severity prototype pollution vulnerability (CVE-2022-37601).
  • This fixes two high-severity regular expression denial of service (ReDoS) vulnerabilities in interpolateName (CVE-2022-37599, CVE-2022-37603).
• Upgrade micromatch to v4.0.8.
  • Check the micromatch release notes for details.
  • This fixes a moderate-severity regular expression denial of service (ReDoS) vulnerability (CVE-2024-4067).
• Upgrade minimatch to v3.1.4.
  • Check the minimatch repository v3.1.4 for details.
  • This fixes a high-severity ReDoS vulnerability from nested *() extglobs (CVE-2026-27904).
  • This fixes a high-severity ReDoS vulnerability from repeated wildcards with non-matching input (CVE-2026-26996).
  • This fixes a high-severity ReDoS vulnerability from matchOne() combinatorial backtracking (CVE-2026-27903).
• Upgrade nanoid to v3.3.17.
  • Check the nanoid release notes for details.
  • This fixes a high-severity denial of service vulnerability where custom generators loop indefinitely when the size is zero (CVE-2026-67213).
  • This fixes a high-severity denial of service vulnerability where non-secure generators loop indefinitely with a negative size (CVE-2026-67214).
  • This fixes a moderate-severity predictable output vulnerability for non-integer input (CVE-2024-55565).
• Upgrade node-fetch to v2.6.7.
  • Check the node-fetch release notes for details.
  • This fixes a high-severity vulnerability where secure headers were forwarded to untrusted sites (CVE-2022-0235).
• Upgrade on-headers to v1.1.0.
  • Check the on-headers release notes for details.
  • This fixes a low-severity HTTP response header manipulation vulnerability (CVE-2025-7339).
• Upgrade path-to-regexp to v6.3.0.
  • Check the path-to-regexp release notes for details.
  • This fixes a high-severity backtracking regular expression vulnerability (CVE-2024-45296).
  • See Breaking Changes below.
• Upgrade pbkdf2 to v3.1.3.
  • Check the pbkdf2 repository v3.1.3 for details.
  • This fixes a critical-severity vulnerability where predictable zero-filled memory was returned for non-normalized or unsupported digest algorithms (CVE-2025-6545).
  • This fixes a critical-severity vulnerability where Uint8Array input was silently disregarded, returning static keys (CVE-2025-6547).
  • See Breaking Changes below.
• Upgrade picomatch to v2.3.2.
  • Check the picomatch release notes for details.
  • This fixes a high-severity regular expression denial of service (ReDoS) vulnerability via extglob quantifiers (CVE-2026-33671).
  • This fixes a moderate-severity method injection vulnerability in POSIX character classes (CVE-2026-33672).
• Upgrade postcss to v8.5.23.
  • Check the postcss release notes for details.
  • This fixes a high-severity arbitrary file read and information disclosure vulnerability via an attacker-controlled sourceMappingURL (CVE-2026-45623).
  • This fixes a high-severity path traversal vulnerability in previous source map auto-loading (GHSA-r28c-9q8g-f849).
  • This fixes a moderate-severity incomplete fix of the above (CVE-2026-69153).
  • This fixes a moderate-severity cross-site scripting (XSS) vulnerability via an unescaped </style> in stringify output (CVE-2026-41305).
  • This fixes a moderate-severity line return parsing vulnerability (CVE-2023-44270).
• Upgrade semver to v7.5.2.
  • Check the semver release notes for details.
  • This fixes a high-severity regular expression denial of service (ReDoS) vulnerability (CVE-2022-25883).
• Upgrade semver to v5.7.2 and v6.3.1.
  • Check the semver release notes for v5.7.2 and v6.3.1 for details.
  • This fixes a high-severity regular expression denial of service (ReDoS) vulnerability (CVE-2022-25883).
• Upgrade sha.js to v2.4.12.
  • Check the sha.js repository v2.4.12 for details.
  • This fixes a critical-severity hash rewind vulnerability caused by missing input type checks (CVE-2025-9288).
• Upgrade tar to v6.2.1.
  • Check the tar repository v6.2.1 for details.
  • This fixes a moderate-severity denial of service vulnerability when parsing an archive with deeply nested folders (CVE-2024-28863).
• Upgrade terser to v5.14.2.
  • Check the terser repository v5.14.2 for details.
  • This fixes a high-severity regular expression denial of service (ReDoS) vulnerability (CVE-2022-25858).
• Upgrade ws to v8.21.0.
  • Check the ws release notes for details.
  • This fixes a high-severity denial of service vulnerability when handling a request with many HTTP headers (CVE-2024-37890).
  • This fixes a high-severity memory exhaustion denial of service vulnerability from tiny fragments and data chunks (CVE-2026-48779).
  • This fixes a moderate-severity uninitialized memory disclosure vulnerability (CVE-2026-45736).

Breaking Changes

next/server (rewrites, redirects and headers)

• Route patterns with two parameters in one path segment now capture differently:
  The path-to-regexp upgrade changes how a pattern such as /:a-:b splits a matching pathname. The trailing parameter no longer matches across the literal separator, so the split point moves to the last separator instead of the first. The same applies to any literal delimiter between two parameters in a single segment, for example /:a.:b.
  This is the security fix itself: the old expression allowed catastrophic backtracking.
  Patterns with a single parameter per segment — /:slug, /:a/:b — are unaffected and capture exactly as before.
  Two consequences to check in next.config.js if you use multi-parameter segments in rewrites, redirects or headers:
  • Destinations can change. With source: '/:a-:b' and destination: '/:a/:b', the request /x-y-z previously proxied to /x/y-z and now proxies to /x-y/z.
  • Some routes stop matching entirely. A pattern that constrains the first parameter, such as /:a([^-]+)-:b, no longer matches /x-y-z at all, so the route falls through to a 404 rather than resolving with different values.
  
  To keep the previous behaviour, put an explicit pattern on the trailing parameter so it can span the separator again. Constraining the first parameter does not help — the new restriction applies to the second.
  Before:

  // next.config.js — under path-to-regexp 6.1.0 this captured a="x", b="y-z"
  module.exports = {
    async rewrites() {
      return [{ source: '/:a-:b', destination: '/:a/:b' }]
    },
  }
  
  
  After:

  // next.config.js — restores a="x", b="y-z" under 6.3.0
  module.exports = {
    async rewrites() {
      return [{ source: '/:a-:b(.*)', destination: '/:a/:b' }]
    },
  }
  
  // `/:a-:b([^/]+)` also works if the trailing value must stay within one segment.
  

crypto-browserify (browser crypto polyfill)

Affects only applications that pull Node's crypto into browser code, where Next.js substitutes the crypto-browserify polyfill.

• pbkdf2 no longer returns zero-filled keys for non-normalized or unsupported digest names:
  In browser builds, pbkdf2() and pbkdf2Sync() previously returned a zero-filled buffer when the digest name was not exactly lowercase-canonical (SHA256, sha-256) or was unsupported (sha3-256), raising no error. Callers received a completely predictable key. Non-normalized names now resolve to the correct algorithm and return a real derived key; genuinely unsupported algorithms now throw Digest algorithm not supported: <name>.
  Canonical lowercase names such as 'sha256' and 'sha512' are unaffected and produce identical output.
  If your application derived keys with a non-canonical digest name and persisted anything encrypted under the result, that data was encrypted with an all-zero key and will not decrypt after upgrading. Re-derive and re-encrypt it, and switch to canonical lowercase digest names. There is no escape hatch.
  Before:

  // Returned 32 zero bytes in the browser — silently, with no error
  const key = pbkdf2Sync(password, salt, 100000, 32, 'SHA256')
  
  
  After:

  // Returns a correctly derived key
  const key = pbkdf2Sync(password, salt, 100000, 32, 'sha256')
  

Notes

• Full package name(s) and version(s):
  • @neverendingsupport/next@12.3.7-next-12.3.14
  • @neverendingsupport/next-bundle-analyzer@12.3.7-next-12.3.14
  • @neverendingsupport/next-env@12.3.7-next-12.3.14
  • @neverendingsupport/next-eslint-plugin-next@12.3.7-next-12.3.14
  • @neverendingsupport/next-mdx@12.3.7-next-12.3.14
  • @neverendingsupport/next-polyfill-module@12.3.7-next-12.3.14
  • @neverendingsupport/next-polyfill-nomodule@12.3.7-next-12.3.14
  • @neverendingsupport/next-react-dev-overlay@12.3.7-next-12.3.14
  • @neverendingsupport/next-react-refresh-utils@12.3.7-next-12.3.14
  • @neverendingsupport/eslint-config-next@12.3.7-next-12.3.14

Security Fixes

• next/image-optimizer: Cap image optimizer local fetch to prevent memory DoS.
  • This fixes a medium-severity Denial of Service (DoS) vulnerability (CVE-2026-44577).
• next/server (i18n data routes): Prevent i18n middleware bypass via locale-less data routes.
  • This fixes a high-severity Broken Access Control vulnerability (CVE-2026-44573).
• next/server (middleware): Reject externally-supplied x-nextjs-data marker on middleware requests.
  • This fixes a low-severity Broken Redirect / Cache Poisoning vulnerability (CVE-2026-44572).

Notes

This release patches the http-proxy library dependency.

• Full package name(s) and version(s):
  • @neverendingsupport/next@12.3.7-next-12.3.13
  • @neverendingsupport/next-bundle-analyzer@12.3.7-next-12.3.13
  • @neverendingsupport/next-env@12.3.7-next-12.3.13
  • @neverendingsupport/next-eslint-plugin-next@12.3.7-next-12.3.13
  • @neverendingsupport/next-mdx@12.3.7-next-12.3.13
  • @neverendingsupport/next-polyfill-module@12.3.7-next-12.3.13
  • @neverendingsupport/next-polyfill-nomodule@12.3.7-next-12.3.13
  • @neverendingsupport/next-react-dev-overlay@12.3.7-next-12.3.13
  • @neverendingsupport/next-react-refresh-utils@12.3.7-next-12.3.13
  • @neverendingsupport/eslint-config-next@12.3.7-next-12.3.13

Security Fixes

• next/image-optimizer: Add disk cache with configurable images.maximumDiskCacheSize to prevent unbounded cache growth.
  • This fixes a medium-severity Denial of Service (DoS) vulnerability (CVE-2026-27980).
• next/server (rewrites): Prevent HTTP request smuggling through rewritten routes by patching the vendored http-proxy library.
  • This fixes a medium-severity HTTP Request Smuggling vulnerability (CVE-2026-29057).

Notes

• Full package name(s) and version(s):
  • @neverendingsupport/next@12.3.7-next-12.3.12
  • @neverendingsupport/next-bundle-analyzer@12.3.7-next-12.3.12
  • @neverendingsupport/next-env@12.3.7-next-12.3.12
  • @neverendingsupport/next-eslint-plugin-next@12.3.7-next-12.3.12
  • @neverendingsupport/next-mdx@12.3.7-next-12.3.12
  • @neverendingsupport/next-polyfill-module@12.3.7-next-12.3.12
  • @neverendingsupport/next-polyfill-nomodule@12.3.7-next-12.3.12
  • @neverendingsupport/next-react-dev-overlay@12.3.7-next-12.3.12
  • @neverendingsupport/next-react-refresh-utils@12.3.7-next-12.3.12
  • @neverendingsupport/eslint-config-next@12.3.7-next-12.3.12

Security Fixes

• next/image-optimizer: Add maximum response body size enforcement to prevent excessive memory usage from oversized remote images. The optimizer now implements two-stage validation: Content-Length header checks reject large responses before buffering, and post-buffer validation catches cases where Content-Length is missing or dishonest.
  • This fixes a medium-severity Denial of Service (DoS) vulnerability (CVE-2025-59471).

Breaking Changes

• next/image-optimizer: The image optimizer now enforces a maximum response body size of 50MB for remote images. Requests for images that exceed this limit will be rejected with a 413 - Content Too Large response status code. This change prevents excessive memory usage and potential DoS attacks from oversized remote images.
  • This limit can be configured in applications by setting the MaxResponseBodySize property to a custom value in bytes in a next.config.js file.

    // next.config.js
    module.exports = {
      images: {
        maximumResponseBody: 25_000, // bytes
      },
    }
    

Notes

• Full package name(s) and version(s):
  • @neverendingsupport/next@12.3.7-next-12.3.11
  • @neverendingsupport/next-bundle-analyzer@12.3.7-next-12.3.11
  • @neverendingsupport/next-env@12.3.7-next-12.3.11
  • @neverendingsupport/next-eslint-plugin-next@12.3.7-next-12.3.11
  • @neverendingsupport/next-mdx@12.3.7-next-12.3.11
  • @neverendingsupport/next-polyfill-module@12.3.7-next-12.3.11
  • @neverendingsupport/next-polyfill-nomodule@12.3.7-next-12.3.11
  • @neverendingsupport/next-react-dev-overlay@12.3.7-next-12.3.11
  • @neverendingsupport/next-react-refresh-utils@12.3.7-next-12.3.11
  • @neverendingsupport/eslint-config-next@12.3.7-next-12.3.11

Security Fixes

• next/image-optimizer:
  • Improve image optimizer logic to avoid falling back to the upstream's Content-Type header when magic number detection fails. This ensures that responses are only cached when confidently identified as image content and do not mistakenly reuse cache keys for user-specific responses.
    • This fixes a medium-severity Content Injection vulnerability (CVE-2025-55173).
  • Improve image optimizer by ensuring request headers aren't forwarded to the request that is proxied to the image endpoint. This ensures that the image endpoint cannot be used to serve images that require authorization data and thus cannot be cached.
    • This fixes a medium-severity Cache Poisoning vulnerability (CVE-2025-57752).

Notes

• This release implements a new package naming scheme for the Next.js packages. More information about the change can be found in the NES Decoupled Namespace Specification.
• Full package name(s) and version(s):
  • @neverendingsupport/next@12.3.7-next-12.3.10
  • @neverendingsupport/next-bundle-analyzer@12.3.7-next-12.3.10
  • @neverendingsupport/next-env@12.3.7-next-12.3.10
  • @neverendingsupport/next-eslint-plugin-next@12.3.7-next-12.3.10
  • @neverendingsupport/next-mdx@12.3.7-next-12.3.10
  • @neverendingsupport/next-polyfill-module@12.3.7-next-12.3.10
  • @neverendingsupport/next-polyfill-nomodule@12.3.7-next-12.3.10
  • @neverendingsupport/next-react-dev-overlay@12.3.7-next-12.3.10
  • @neverendingsupport/next-react-refresh-utils@12.3.7-next-12.3.10
  • @neverendingsupport/eslint-config-next@12.3.7-next-12.3.10

Security Fixes

• next/image-optimizer: Added validation to detect and reject recursive URLs in the Image Optimization endpoint. Includes defensive decoding of URL pathnames to properly detect encoded recursion attempts, preventing resource exhaustion.
  • This fixes a high-severity Denial of Service vulnerability (CVE-2024-47831).
• next/server:
  • Added locale parameter validation to prevent authorization bypass through malicious __nextLocale and __nextDefaultLocale query parameters. Validation happens at two critical points in the request lifecycle to prevent bypass through middleware parameter reintroduction.
    • This fixes a high-severity Authorization Bypass vulnerability (CVE-2024-51479).
  • Strip the x-now-route-matches header from all incoming requests to prevent race condition causing cache poisoning where incorrect content types are cached and served to users.
    • This fixes a low-severity Cache Poisoning vulnerability (CVE-2025-32421).

      Note: This version removes the potential cache poisoning attack vector of CVE-2025-32421 by stripping the x-now-route-matches header from incoming requests. This header is not part of the public Next.js API.

      ⚠️ Self-hosted Next.js deployments should additionally implement CDN-level protection by stripping the x-now-route-matches header at the CDN layer for defense in depth.