Issue Station
Sign In
Tools hereToolbox

nextjs - 💡(How to fix) Fix Next.js 14: Backport "glob" security vulnerability CVE-2025-64756 [1 comments, 2 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
vercel/next.js#87126•Fetched 2026-04-08 02:07:44
View on GitHub
Comments
1
Participants
2
Timeline
6
Reactions
0
Author
enzofereyenzoferey
Participants
enzofereyenzofereygithub-actions[bot]github-actions[bot]
Timeline (top)
labeled ×2closed ×1commented ×1issue_type_added ×1

Code Example

Operating System:
  Platform: darwin
  Arch: arm64
  Version: Darwin Kernel Version 25.1.0: Mon Oct 20 19:32:56 PDT 2025; root:xnu-12377.41.6~2/RELEASE_ARM64_T8132
  Available memory (MB): 16384
  Available CPU cores: 10
Binaries:
  Node: 22.14.0
  npm: 10.9.2
  Yarn: 4.0.0-rc.48
  pnpm: N/A
Relevant Packages:
  next: 14.2.35 // An outdated version detected (latest is 16.0.10), upgrade is highly recommended!
  eslint-config-next: 14.2.35
  react: 18.3.1
  react-dom: 18.3.1
  typescript: 5.3.2
Next.js Config:
  output: N/A
RAW_BUFFERClick to expand / collapse

Link to the code that reproduces this issue

https://github.com/vercel/next.js/blob/7b940d9ce96faddb9f92ff40f5e35c34ace04eb2/packages/eslint-plugin-next/package.json#L15

To Reproduce

(sorry if this not the right format for bringing this one up, none of the options nor templates provided make sense for this one)

As pinned at https://github.com/vercel/next.js/blob/7b940d9ce96faddb9f92ff40f5e35c34ace04eb2/packages/eslint-plugin-next/package.json#L15, latest v14 version requires [email protected] which is vulnerable to the security issue CVE-2025-64756.

Are you planning to backport a fix to v14?

Current vs. Expected behavior

We would like to have glob >= 15.0.0 in order to resolve the security issue.

Provide environment information

Operating System:
  Platform: darwin
  Arch: arm64
  Version: Darwin Kernel Version 25.1.0: Mon Oct 20 19:32:56 PDT 2025; root:xnu-12377.41.6~2/RELEASE_ARM64_T8132
  Available memory (MB): 16384
  Available CPU cores: 10
Binaries:
  Node: 22.14.0
  npm: 10.9.2
  Yarn: 4.0.0-rc.48
  pnpm: N/A
Relevant Packages:
  next: 14.2.35 // An outdated version detected (latest is 16.0.10), upgrade is highly recommended!
  eslint-config-next: 14.2.35
  react: 18.3.1
  react-dom: 18.3.1
  typescript: 5.3.2
Next.js Config:
  output: N/A

Which area(s) are affected? (Select all that apply)

Linting

Which stage(s) are affected? (Select all that apply)

Other (Deployed)

Additional context

No response

extent analysis

TL;DR

Upgrade the glob package to version 15.0.0 or later to resolve the security issue CVE-2025-64756.

Guidance

  • Check the dependencies of your project to ensure that glob is not being used directly or indirectly by other packages.
  • Consider upgrading next.js to the latest version (16.0.10) which may include the updated glob package.
  • If upgrading next.js is not feasible, try to update the glob package manually by running npm install [email protected] or yarn add [email protected].
  • Verify that the updated glob package is being used by your project by checking the node_modules directory or running npm ls glob or yarn why glob.

Example

No code snippet is provided as this issue is related to package dependencies.

Notes

The issue is specific to the glob package version used by next.js and the solution involves updating the package to a version that fixes the security issue.

Recommendation

Apply workaround: Update the glob package to version 15.0.0 or later to resolve the security issue, as upgrading to the latest version of next.js may not be feasible for all users.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…
#logging issue#authentication issue#prompt issue#agent setup#task chaining

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING