Security58 mOctober 24, 2026, 03:50

84% of abandoned v0 apps run a known-exploited Next.js

Of 274 abandoned v0-built apps found on public GitHub, 231 (84%) declare a Next.js version inside the React2Shell range (CVE-2025-55182), which CISA lists as actively exploited. 226 are pinned to Next.js 15.2.4, and none runs the current patched release 16.4.2.

DEV Community

Open source

84% of abandoned v0 apps run a known-exploited Next.js

231 of 274 apps (84%) run a Next.js version vulnerable to React2Shell
226 apps are pinned to Next.js 15.2.4 with no range operator
Next.js 15 left security support on October 21, 2026; fixes go to 16 only
266 of 274 apps are hosted on vercel.app behind Vercel's firewall

#Next.js#V0#Vercel#React

Next.js 16.4 makes Cache Components the default caching path

Security

Next.js Ships Out-of-Band Patch for Two Critical RCE Flaws

Security

CVE-2026-96889: Critical RCE in Next.js Image Optimization

Security

84% of abandoned v0 apps run a known-exploited Next.js

Next.js 16.4 makes Cache Components the default caching path

Next.js Ships Out-of-Band Patch for Two Critical RCE Flaws

CVE-2026-96889: Critical RCE in Next.js Image Optimization

Critical CVE-2026-94545 hits Next.js next/og and Satori