Next.js Versions on Crypto Frontends: Known Critical Flaws

By the Guardian team Updated November 2026 6 min read

Quick answer. In our November 2026 scan of 249 top crypto sites by TVL, 105 ran Next.js. Of the 104 exposing a version, 62 were in range of a critical Next.js advisory. A version match does not prove exploitability.

Watch: Next.js Versions on Crypto Frontends: Known Critical Flaws 1:47

Video transcript

We scanned 249 top crypto sites by TVL. Of the 104 exposing a Next.js version, 62 sat in range of a critical advisory.

Next.js ran on 105 of the 245 sites we could read. Every page it renders shows its version to anyone, attackers included.

Next.js has published seven critical advisories since March 2025, five in the 72 days before our scan. In total, 59.6 percent of versioned sites sit in at least one range.

The two 2025 flaws, the middleware bypass and React2Shell, account for 19 sites. The 2026 image flaws reach far more, with the SVG advisory alone matching 62.

Old flaws linger in old builds. 594 days after the middleware bypass, 18 sites remain in range. React2Shell is the exception. 72 of 74 App Router sites sit outside it.

A version in range is a reason to check, not proof of a hole. Each critical needs a condition, like authorization in middleware, a server runtime, the image optimizer, or a Windows host.

Run window dot next dot version in your live console, and npm ls next in each repository. Upgrade to 16.4.1, or 15.5.28 on the 15 line. Never rely on middleware alone for authorization.

Guardian's Managed Security matches new disclosures to your stack in real time, and a web application pentest attacks the frontend and its backend. Read the full census, or talk to Guardian.

Next.js is the framework behind many crypto frontends. It served 105 of the 245 top crypto sites we could read (42.9%).

Its version is public. The Next.js client sets window.next.version on every page it renders, so one page load shows it to anyone, attackers included.

Next.js has published seven critical advisories since March 2025. Five came in the 72 days before our scan.

We measured how many crypto frontends sit inside those affected ranges, and how long after each disclosure. It pairs with our guide to securing a dApp frontend build pipeline.

How We Counted

Sample. The top 300 entries by TVL in DefiLlama's protocol list on November 5, 2026, exchanges included.
Sites. We loaded the website URL each entry lists. Four entries listed none, and shared hostnames were loaded once, leaving 249 sites.
Method. One headless browser visit per site, reading what the page exposes: window.next.version, Next.js markers and response headers.
No probing. No extra paths, crafted headers or exploit attempts. Images and fonts were not downloaded.
Matching. Each version was compared with the affected ranges of every Critical advisory on Next.js's GitHub.
Reporting. Aggregate counts only. We name no site or protocol.

Four sites returned a bot challenge or an error page. One Next.js site did not expose its version.

Release dates come from the npm registry. Everything here can be rebuilt from DefiLlama's API, the GitHub advisories and npm.

Next.js ran on 105 of the 245 sites we could read. Exchanges used it a little more often than DeFi protocols.

Group	Sites read	On Next.js
DeFi and other protocols	211	88 (42%)
Centralized exchanges	34	17 (50%)
All	245	105 (42.9%)

Of the 104 with a version, 74 use the App Router and 30 the older Pages Router. The router decides whether two of the advisories apply.

Response headers point to Vercel hosting for 54 of them and Netlify for 2. The other 48 showed neither.

Major version	Sites
16	55
15	25
14	15
13	5
12 or older	4

Versions With a Known Critical

As of November 5, 2026, Next.js's GitHub lists seven advisories rated Critical, scored 9.0 to 10.0.

Advisory	Published	Needs	Sites in range
CVE-2025-29927, middleware bypass	Mar 21, 2025	Authorization in middleware, self-hosted	18
CVE-2025-55182, React2Shell	Dec 3, 2025	App Router running on a server	2
CVE-2026-75604, remote code execution	Aug 25, 2026	A server on a Windows filesystem	46
GHSA-2xp9-vwfh-vxw4, AVIF images	Aug 25, 2026	Image optimizer processing AVIF files	55
CVE-2026-94545, next/og	Sep 22, 2026	Node ImageResponse fed attacker input	15
CVE-2026-96889, SVG images	Oct 14, 2026	Image optimizer with SVGs, glibc Linux, older sharp	62
GHSA-673q-mjm6-r5xr, use cache	Oct 14, 2026	App Router `use cache` returning typed arrays	20

Counts are out of the 104 sites with a version. For the two App Router advisories, we counted App Router sites only.

In total, 62 of 104 (59.6%) sit inside at least one critical range. That is 25.3% of every site we could read.

The two 2025 criticals account for 19 (18.3%). The other 43 match only the five 2026 advisories.

Exchanges fare worse: 13 of the 16 exchange sites with a version are in range, against 49 of 88 for DeFi. Sixteen is a small group, so read that gap as a signal, not a rate.

The two 2025 criticals

CVE-2025-29927 lets a request skip authorization checks that run in middleware. Next.js fixed it in 15.2.3, 14.2.25, 13.5.9 and 12.3.5.

Eighteen sites run an affected version: 6 on the App Router, 12 on the Pages Router. Eleven show no Vercel or Netlify headers, so their hosting does not rule them out.

React2Shell (CVE-2025-55182) is a CVSS 10.0 remote code execution flaw in React Server Components. AWS saw exploitation attempts within hours of the December 3, 2025 disclosure.

Only 2 of the 74 App Router sites still run an affected version. Next.js 13.x, 14.x stable and Pages Router apps are not affected.

The 2026 criticals

Five critical advisories followed between August 25 and October 14, 2026. Three sit in Next.js's image handling.

The SVG flaw has the widest range: every release from 10.0.0 through 15.5.27, and 16.x through 16.4.0. The fixes, 15.5.28 and 16.4.1, shipped on October 14.

Its advisory gives a workaround: make sure Next.js uses sharp 0.35.5 or later. Fresh installs already get it.

Patch Lag After Disclosure

One snapshot cannot show when each site patched. It can show which have not, and how long after each disclosure.

Advisory	Days since disclosure	Still in range
Middleware bypass	594	18 of 104
React2Shell	337	2 of 74 App Router sites
AVIF images	72	55 of 104
SVG images	22	62 of 104

Old flaws linger in old builds. Of the 18 sites in the middleware-bypass range, 17 run a release published before its disclosure.

The median site runs a Next.js release published 98 days before our scan. 42 run one under 30 days old, and 20 one over a year old.

Twenty-four sites run 14.x or older. The 2026 image and Windows advisories list fixes only in the 15.5 and 16.x lines.

React2Shell is the exception. 337 days on, 72 of the 74 App Router sites sit outside its range.

What a Version Does Not Prove

A version in range is a reason to check, not proof of a hole. Each critical needs a feature, a host or a configuration.

Middleware. CVE-2025-29927 matters only where middleware enforces authorization. Vercel says its own, Netlify and Cloudflare Workers deployments were not affected.
Servers. Static exports have no server runtime, so the middleware bypass and React2Shell do not apply.
Images. The AVIF and SVG flaws need the built-in image optimizer. The SVG flaw also needs glibc Linux and sharp below 0.35.5.
Windows. CVE-2026-75604 applies only to servers on a Windows filesystem.
Scope. We loaded the URL DefiLlama lists, often a marketing site. An app on another host may run a different build.

Set aside the AVIF, SVG and Windows advisories, which need a particular host setup, and 40 of 104 (38.5%) still sit in range of at least one critical.

A site outside every range is not safe by default either. Five criticals arrived in the 72 days before our scan.

How to Check Your Own App

Open your live site's browser console and run window.next.version. That is what we read, and what attackers read.
Run npm ls next in each repository to confirm what you build and ship.
Compare it with the Next.js security advisories, and turn on dependency alerts.
Upgrade to 16.4.1 or later, or 15.5.28 or later on 15.x. Both sit outside all seven critical ranges.
On 14.x or older, plan the move to 15.5 or 16. Until then, confirm sharp is 0.35.5 or later, the SVG advisory's workaround.
If you cannot patch CVE-2025-29927, strip the x-middleware-subrequest header at your edge.
Do not rely on middleware alone for authorization. Check again where the data is served.
If an App Router app ran unpatched on December 4, 2025, rotate its secrets, as Next.js advises.

Speed matters once an advisory is public. See how fast disclosed bugs get attacked.

How Guardian Helps

Guardian's Managed Security ingests vulnerability disclosures in real time and matches them against your system.

Where one reaches you, an engineer confirms the exposure and works with you to patch it.

Shield, part of Managed Security, covers everything you have facing the internet: hosts, services, certificates, edge rules and names.

A web application pentest attacks the frontend and its backend, including supply-chain exposure in the bundle.

For the wider picture, read where crypto hack losses come from.

Frequently Asked Questions

How do I check which Next.js version my site runs?

Run npm ls next in your project, or enter window.next.version in the browser console on your live site. The console shows what any visitor, attackers included, can read.

Is a site vulnerable if its Next.js version is in an advisory's range?

Not necessarily. Each critical needs a feature or setup, such as authorization in middleware, the App Router on a server, the image optimizer or a Windows host. A version in range means check those conditions, then upgrade.

Which Next.js version fixes every known critical?

As of November 5, 2026, 16.4.1 or later, or 15.5.28 or later on the 15.x line, sits outside the affected range of all seven critical advisories on Next.js's GitHub.

Did Vercel hosting protect against these flaws?

For CVE-2025-29927, yes: the advisory says Vercel deployments were automatically protected. For React2Shell, Next.js said there was no workaround and upgrading was required. The 2026 advisories do not mention Vercel.

Sources

Match new advisories to your stack

Guardian checks each disclosure against what you run, confirms the exposure and works with you on the patch.

Talk to Guardian Explore Managed Security