SecurityVercel7 months ago
Vercel blocks vulnerable Next.js deployments by default
1 min read
Vercel now automatically blocks any new deployment running a Next.js version vulnerable to CVE-2025-66478. The protection can be disabled by setting the DANGEROUSLY_DEPLOY_VULNERABLE_CVE_2025_66478=1 environment variable. Upgrading to a patched version is recommended regardless of hosting provider.
Level
Hype check
Tap to vote and see what everyone thinks.