# New deployments of vulnerable Next.js applications are now blocked by default

By Steven Van · 2025-12-05

The check can be disabled by setting the DANGEROUSLY\_DEPLOY\_VULNERABLE\_CVE\_2025\_66478=1 environment variable on the project.

[Vercel](<https://creatorstoolbox.com/tools/vercel>) now blocks new deployments that contain a version of Next.js vulnerable to CVE-2025-66478, so the deployment fails automatically. Vercel recommends upgrading to a patched version of Next.js regardless of hosting provider.

The check can be turned off by setting the **DANGEROUSLY\_DEPLOY\_VULNERABLE\_CVE\_2025\_66478=1** [environment variable](<https://vercel.com/docs/environment-variables#creating-environment-variables>) on the Vercel project.

![Vercel](<https://www.google.com/s2/favicons?domain=vercel.com&sz=128>)

Vercel

The platform for frontend developers — deploy, preview, and scale web apps and AI agents with zero config.

[View Vercel →](<https://creatorstoolbox.com/tools/vercel>)

[Original source](<https://vercel.com/docs/environment-variables#creating-environment-variables>)

[Read New deployments of vulnerable Next.js applications are now blocked by default on Creators Toolbox](<https://creatorstoolbox.com/blog/vercel-new-deployments-of-vulnerable-next-js-applications-are-now-blocked-by->)

---
Canonical source: https://creatorstoolbox.com/blog/vercel-new-deployments-of-vulnerable-next-js-applications-are-now-blocked-by-