CVE-2025-48068
By Steven Van ·
Next.js patches a dev-server flaw that let malicious sites read local project source code via WebSocket or script injection.
A low-severity vulnerability in the Next.js dev server has been fixed. The issue, tracked as CVE-2025-48068, affects Vercel's Next.js versions 13.0.0 through 14.2.29 and 15.0.0 through 15.2.1, and covers two related problems: Cross-Site WebSocket Hijacking and Cross-Origin Script Inclusion, both caused by missing origin validation on local dev server resources.
While running next dev, a malicious website could open a WebSocket connection to localhost and read internal component code from App Router projects, or inject a script tag pointing at predictable dev script paths (like /app/page.js) to extract source code. The flaw is scoped strictly to local development; production apps hosted on Vercel need no mitigation.
The fix ships in Next.js 14.2.30 and 15.2.2, adding a configuration option to enable origin checks on the dev server. The option is opt-in for now and is planned to become the default in a future major release. Until upgrading, the advisory recommends avoiding untrusted websites while the dev server is running, or blocking unauthorized access with local firewall or proxy rules.