New deployments with vulnerable versions of the third-party package next-mdx-remote are now blocked by default

By Steven Van · 2026-02-12

Vercel now blocks new deployments using vulnerable next-mdx-remote versions, with an opt-out environment variable for those who need it.

New deployments on Vercel that contain a version of the third-party package next-mdx-remote vulnerable to CVE-2026-0969 will now automatically fail to deploy. Vercel recommends upgrading to a patched version regardless of hosting provider; the check can be disabled by setting DANGEROUSLY_DEPLOY_VULNERABLE_CVE_2026_0969=1 as an environment variable on the project.

Read the announcement.

Vercel

The platform for frontend developers — deploy, preview, and scale web apps and AI agents with zero config.

View Vercel →

Read the original announcement →