next has 5 known vulnerabilities on the latest version (16.3.3). DepScope rates its health at 60/100 (moderate risk).

What is the latest version of next?

The latest version of next is 16.3.3, released 2026-08-25.

Does next have known vulnerabilities?

Yes. next has 5 known vulnerabilities. See depscope.dev/pkg/npm/next for details.

No, next is actively maintained. Latest release: 16.3.3 (2026-08-25).

What are alternatives to next?

Popular alternatives to next in npm include: ?, semver, minimatch, ansi-styles, brace-expansion.

next 16.3.3 security: 5 vulnerabilities, health 60/100

npmv16.3.3

The React Framework

License MITpermissive3917 versions4 maintainers6 deps31,997,567 weekly dl

vercel/next.js

/ 100

Health

update required

[email protected] has vulnerabilities — update to latest

Update to >= 16.1.0-canary.17 to fix known vulnerabilities

Moderate health score (60/100) — verify manually
2 high severity vulnerabilities

Health breakdown0 – 100

25/25

maintenance

20/20

popularity

11/25

security

15/15

maturity

14/15

community

0/15

popularity_floor

Vulnerabilities

Advisories (5)

Severity	ID	Summary	Fixed in
medium	CVE-2025-59472	Next.js has Unbounded Memory Consumption via PPR Resume Endpoint	15.6.0-canary.61
high	GHSA-5j59-xgg2-r9c4	Next has a Denial of Service with Server Components - Incomplete Fix Follow-Up	16.1.0-canary.19
low	CVE-2023-46298	Next.js missing cache-control header may lead to CDN caching empty reply	13.4.20-canary.13

Bundle & TypeScript

🌟

TypeScript

10/10typed

bundled

Quality signals

OSS Criticality

0.80critical

Download trend

stable(+6.7%)

Publish security

npm attested

Health History

Dependency Tree

License Audit

Dependencies (6)

postcss @next/env styled-jsx @swc/helpers caniuse-lite baseline-browser-mapping

API access

Get this data programmatically — free, no authentication.

curl https://depscope.dev/api/check/npm/next