Next.js has launched a formal security advisory program that centralizes framework vulnerabilities in GitHub Security Advisories with its own CVE numbering. For companies running Next.js in production, this means structured, verifiable notifications — but also a shorter exploitation window.
What changes in practice: from informal reports to a CVE process
Previously, a Next.js security flaw arrived scattered: an untagged commit, a Discord thread, a brief changelog note. Now each relevant vulnerability gets its own CVE and a GitHub Security Advisory with affected version, patched version, and documented attack vector, which automatically triggers tools like Dependabot or Snyk.
Why Vercel became a CVE Numbering Authority (CNA)
Vercel has taken on the CNA role for the framework: it can reserve the CVE, coordinate embargo with the reporter, and publish advisory and patch in sync, without intermediaries. That's a real transparency improvement over the previous model, where many security fixes slipped into minor releases unlabeled.
Severity score of CVE-2025-29927 (Next.js middleware authorization bypass), per the official GHSA-f82v-jwr5-mffw advisory published in March 2025.
A formal advisory with a detailed CVE also hands attackers an exact map of what to look for. Once Vercel publishes the patch alongside the advisory, anyone can diff the fix commit against the vulnerable version and derive the exact attack vector — exactly what happened with CVE-2025-29927, exploited within days.
The blind spot almost nobody mentions: self-hosted vs Vercel
If your Next.js app doesn't run on Vercel's infrastructure, the advisory program doesn't automatically protect you. When CVE-2025-29927 hit, Vercel rolled out platform-level WAF mitigations only for hosted customers; self-hosted Next.js depended entirely on manual patching.
- Check the exact deployed version with next --version in production.
- Verify whether your hosting is Vercel or self-hosted.
- Enable Dependabot or Snyk alerts on the repository.
- Check whether middleware.ts is used for access control.
What a Spanish SME running Next.js in production should do
Not every company needs an external audit. With a minimally disciplined dependency update process and CI/CD scanning, the formal Next.js program simply makes that process more reliable, not heavier.
- Set an internal patch SLA by severity
- Assign someone to review alerts weekly
- Document whether deployment is Vercel or self-hosted
- Audit middleware.ts usage
When external help actually makes sense
It's worth it when the app handles sensitive data and the internal team can't maintain a real patch SLA, when multiple self-hosted apps lack a clear version inventory, or when there's already been an incident tied to outdated dependencies.
Is your Next.js app running on your own infrastructure and you're not sure the latest security advisory affects you? We review your deployment before an attacker does.
Solicitar diagnóstico