Issue Station
Sign In
Tools hereToolbox

nextjs - 💡(How to fix) Fix Vulnerable [email protected] bundled in dist/compiled (CVE-2025-13465) [1 comments, 2 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
vercel/next.js#91152•Fetched 2026-04-08 00:18:53
View on GitHub
Comments
1
Participants
2
Timeline
4
Reactions
0
Author
jaytarr-geojaytarr-geo
Participants
github-actions[bot]github-actions[bot]jaytarr-geojaytarr-geo
Timeline (top)
closed ×1commented ×1labeled ×1locked ×1

Next.js bundles [email protected] in pre-compiled files under dist/compiled/. This version is affected by CVE-2025-13465 (prototype pollution in _.unset and _.omit), which is patched in [email protected].

Security scanners (e.g., OWASP Dependency-Check) flag these files, and since they are pre-compiled/vendored, downstream consumers cannot resolve them via npm audit fix or dependency overrides.

Root Cause

Next.js bundles [email protected] in pre-compiled files under dist/compiled/. This version is affected by CVE-2025-13465 (prototype pollution in _.unset and _.omit), which is patched in [email protected].

Security scanners (e.g., OWASP Dependency-Check) flag these files, and since they are pre-compiled/vendored, downstream consumers cannot resolve them via npm audit fix or dependency overrides.

Fix Action

Fix / Workaround

Next.js bundles [email protected] in pre-compiled files under dist/compiled/. This version is affected by CVE-2025-13465 (prototype pollution in _.unset and _.omit), which is patched in [email protected].

Code Example

npx create-next-app@16.1.6 my-app
cd my-app
grep -oP '4\.17\.\d+' node_modules/next/dist/compiled/jsonwebtoken/index.js | sort -u
# outputs: 4.17.21
grep -oP '4\.17\.\d+' node_modules/next/dist/compiled/babel-packages/packages-bundle.js | sort -u
# outputs: 4.17.21
RAW_BUFFERClick to expand / collapse

Vulnerable [email protected] bundled in dist/compiled (CVE-2025-13465)

Description

Next.js bundles [email protected] in pre-compiled files under dist/compiled/. This version is affected by CVE-2025-13465 (prototype pollution in _.unset and _.omit), which is patched in [email protected].

Security scanners (e.g., OWASP Dependency-Check) flag these files, and since they are pre-compiled/vendored, downstream consumers cannot resolve them via npm audit fix or dependency overrides.

Affected files

  • node_modules/next/dist/compiled/jsonwebtoken/index.js
  • node_modules/next/dist/compiled/babel-packages/packages-bundle.js

Both contain [email protected] as of Next.js 16.1.6.

Steps to reproduce

npx [email protected] my-app
cd my-app
grep -oP '4\.17\.\d+' node_modules/next/dist/compiled/jsonwebtoken/index.js | sort -u
# outputs: 4.17.21
grep -oP '4\.17\.\d+' node_modules/next/dist/compiled/babel-packages/packages-bundle.js | sort -u
# outputs: 4.17.21

Expected behavior

The vendored lodash should be updated to 4.17.23+ to resolve CVE-2025-13465.

Context

This is the same pattern as #83459 (cross-spawn in dist/compiled) and #79331 (@babel/runtime in compiled deps). Downstream teams cannot remediate these vulnerabilities without an upstream update from Next.js.

extent analysis

Fix Summary

Upgrade Next.js to a version that bundles lodash ≥ 4.17.23.
If you cannot upgrade immediately, patch the vendored lodash in node_modules/next/dist/compiled/ with patch-package (or a simple post‑install script) so the compiled code uses the safe version.

1️⃣ Upgrade Path (preferred)

# 1. Check the latest Next.js release that contains lodash ≥ 4.17.23
npm view next versions --json | jq -r '.[]' | grep -E '16\.[0-9]+\.[0-9]+'

# 2. Upgrade (example: 16.2.0 or later)
npm install next@^16.2.0   # or yarn add next@^16.2.0

Verification

grep -oP '4\.17\.\d+' node_modules/next/dist/compiled/**/lodash* | sort -u
# should output 4.17.23 (or newer)
npm audit | grep lodash   # no CVE‑2025‑13465 reported

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…

FAQ

Expected behavior

The vendored lodash should be updated to 4.17.23+ to resolve CVE-2025-13465.

#api#ssr#installation#tensor shape#autograd error#search optimization#API routing#API middleware#SSR setup#ISR setup

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING

nextjs - 💡(How to fix) Fix Vulnerable lodash@4.17.21 bundled in dist/compiled (CVE-2025-13465) [1 comments, 2 participants]