Issue Station
Sign In
Tools hereToolbox

nextjs - 💡(How to fix) Fix NextJS Latest has 1 vulnerabilities

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…

Code Example

bun audit v1.3.14 (0d9b296a)
postcss  <8.5.10
  @tailwindcss/postcss › postcss
  next › postcss
  moderate: PostCSS has XSS via Unescaped </style> in its CSS Stringify Output - https://github.com/advisories/GHSA-qx2v-qp2m-jg93

1 vulnerabilities (1 moderate)

To update all dependencies to the latest compatible versions:
  bun update

To update all dependencies to the latest versions (including breaking changes):
  bun update --latest

---

bun update v1.3.14 (0d9b296a)

↑ @types/node 20.19.42 → 25.9.2
↑ eslint 9.39.4 → 10.4.1
↑ typescript 5.9.3 → 6.0.3
↑ react 19.2.4 → 19.2.7
↑ react-dom 19.2.4 → 19.2.7

21 packages installed [20.11s]

---

bun audit v1.3.14 (0d9b296a)
postcss  <8.5.10
  @tailwindcss/postcss › postcss
  next › postcss
  moderate: PostCSS has XSS via Unescaped </style> in its CSS Stringify Output - https://github.com/advisories/GHSA-qx2v-qp2m-jg93

1 vulnerabilities (1 moderate)

To update all dependencies to the latest compatible versions:
  bun update

To update all dependencies to the latest versions (including breaking changes):
  bun update --latest

---

OS: Windows
Runtime : Bun
RAW_BUFFERClick to expand / collapse

Link to the code that reproduces this issue

https://github.com/codewithyxma

To Reproduce

\my-app> bun audit


bun audit v1.3.14 (0d9b296a)
postcss  <8.5.10
  @tailwindcss/postcss › postcss
  next › postcss
  moderate: PostCSS has XSS via Unescaped </style> in its CSS Stringify Output - https://github.com/advisories/GHSA-qx2v-qp2m-jg93

1 vulnerabilities (1 moderate)

To update all dependencies to the latest compatible versions:
  bun update

To update all dependencies to the latest versions (including breaking changes):
  bun update --latest

\my-app> bun update --latest


bun update v1.3.14 (0d9b296a)

↑ @types/node 20.19.42 → 25.9.2
↑ eslint 9.39.4 → 10.4.1
↑ typescript 5.9.3 → 6.0.3
↑ react 19.2.4 → 19.2.7
↑ react-dom 19.2.4 → 19.2.7

21 packages installed [20.11s]

\my-app> bun audit


bun audit v1.3.14 (0d9b296a)
postcss  <8.5.10
  @tailwindcss/postcss › postcss
  next › postcss
  moderate: PostCSS has XSS via Unescaped </style> in its CSS Stringify Output - https://github.com/advisories/GHSA-qx2v-qp2m-jg93

1 vulnerabilities (1 moderate)

To update all dependencies to the latest compatible versions:
  bun update

To update all dependencies to the latest versions (including breaking changes):
  bun update --latest

Current vs. Expected behavior

The Latest NextJs should have 0 vulnerabilities

Provide environment information

OS: Windows
Runtime : Bun

Which area(s) are affected? (Select all that apply)

create-next-app

Which stage(s) are affected? (Select all that apply)

next dev (local), Other (Deployed)

Additional context

It is also coming on NPM too, we still don't Have any Latest Fix

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING