New deployments of vulnerable Next.js applications are now blocked by default

By Steven Van · 2025-12-05

The check can be disabled by setting the DANGEROUSLY_DEPLOY_VULNERABLE_CVE_2025_66478=1 environment variable on the project.

Vercel now blocks new deployments that contain a version of Next.js vulnerable to CVE-2025-66478, so the deployment fails automatically. Vercel recommends upgrading to a patched version of Next.js regardless of hosting provider.

The check can be turned off by setting the DANGEROUSLY_DEPLOY_VULNERABLE_CVE_2025_66478=1 environment variable on the Vercel project.

Vercel

The platform for frontend developers — deploy, preview, and scale web apps and AI agents with zero config.

View Vercel →

Original source