# CVE-2025-48068

By Steven Van · 2025-05-28

Next.js patches a dev-server flaw that let malicious sites read local project source code via WebSocket or script injection.

A low-severity vulnerability in the Next.js dev server has been fixed. The issue, tracked as CVE-2025-48068, affects [Vercel](<https://creatorstoolbox.com/tools/vercel>)'s Next.js versions 13.0.0 through 14.2.29 and 15.0.0 through 15.2.1, and covers two related problems: Cross-Site WebSocket Hijacking and Cross-Origin Script Inclusion, both caused by missing origin validation on local dev server resources.

While running next dev, a malicious website could open a WebSocket connection to localhost and read internal component code from App Router projects, or inject a script tag pointing at predictable dev script paths (like /app/page.js) to extract source code. The flaw is scoped strictly to local development; production apps hosted on Vercel need no mitigation.

The fix ships in Next.js 14.2.30 and 15.2.2, adding a configuration option to enable origin checks on the dev server. The option is opt-in for now and is planned to become the default in a future major release. Until upgrading, the [advisory](<https://vercel.com/changelog/cve-2025-48068>) recommends avoiding untrusted websites while the dev server is running, or blocking unauthorized access with local firewall or proxy rules.

[![](<https://nextjs.org/api/docs-og?title=Next.js%20Docs&sig=10b5e00dde2672ad>)](<https://nextjs.org/docs>)

![Vercel](<https://www.google.com/s2/favicons?domain=vercel.com&sz=128>)

Vercel

The platform for frontend developers — deploy, preview, and scale web apps and AI agents with zero config.

[View Vercel →](<https://creatorstoolbox.com/tools/vercel>)

[Original source](<https://nextjs.org/docs>)

[Read CVE-2025-48068 on Creators Toolbox](<https://creatorstoolbox.com/blog/vercel-cve-2025-48068>)

---
Canonical source: https://creatorstoolbox.com/blog/vercel-cve-2025-48068