GHSA-3h52-269p-cp9r
Information exposure in Next.js dev server due to lack of origin verification
Quick fix
GHSA-3h52-269p-cp9r — next: upgrade to the fixed version with the command below.
npm install next@15.2.2Details
## Summary
A low-severity vulnerability in **Next.js** has been fixed in **version 15.2.2**. This issue may have allowed limited source code exposure when the dev server was running with the App Router enabled. The vulnerability only affects local development environments and requires the user to visit a malicious webpage while `npm run dev` is active.
Because the mitigation is potentially a breaking change for some development setups, to opt-in to the fix, you must configure `allowedDevOrigins` in your next config after upgrading to a patched version. [Learn more](https://nextjs.org/docs/app/api-reference/config/next-config-js/allowedDevOrigins).
Learn more: https://vercel.com/changelog/cve-2025-48068
## Credit
Thanks to [sapphi-red](https://github.com/sapphi-red) and [Radman Siddiki](https://github.com/R4356th) for responsibly disclosing this issue.
Are you affected?
Enter the version of the package you're using.