Issue Station
Sign In
Tools hereToolbox

nextjs - 💡(How to fix) Fix Vulnerable [email protected] bundled in dist/compiled (CVE-2026-4800) [1 comments, 2 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
vercel/next.js#92453•Fetched 2026-04-08 02:59:52
View on GitHub
Comments
1
Participants
2
Timeline
5
Reactions
0
Author
SvenLieSvenLie
Participants
github-actions[bot]github-actions[bot]SvenLieSvenLie
Timeline (top)
closed ×1commented ×1issue_type_added ×1labeled ×1

Fix Action

Fix / Workaround

Next.js bundles the full [email protected] library in pre-compiled files under dist/compiled/. This version is affected by CVE-2026-4800 (code injection via _.template), patched in [email protected].

Code Example

Operating System:
  Platform: darwin
  Arch: arm64
  Version: Darwin Kernel Version 25.3.0: Wed Jan 28 20:53:05 PST 2026; root:xnu-12377.81.4~5/RELEASE_ARM64_T6020
  Available memory (MB): 65536
  Available CPU cores: 12
Binaries:
  Node: 24.14.1
  npm: 11.11.0
  Yarn: N/A
  pnpm: N/A
Relevant Packages:
  next: 16.2.2 // Latest available version is detected (16.2.2).
  eslint-config-next: N/A
  react: 19.2.4
  react-dom: 19.2.4
  typescript: 5.9.3
Next.js Config:
  output: N/A
RAW_BUFFERClick to expand / collapse

Link to the code that reproduces this issue

https://github.com/vercel/next.js/tree/v16.2.2

To Reproduce

  1. Clone the reproduction repo or create a fresh Next.js app: npx [email protected] my-app
  2. cd my-app
  3. Run: grep -oP '4.17.\d+' node_modules/next/dist/compiled/jsonwebtoken/index.js | sort -u Output: 4.17.23
  4. Run: grep -oP '4.17.\d+' node_modules/next/dist/compiled/babel-packages/packages-bundle.js | sort -u Output: 4.17.23

Both files contain the full lodash 4.17.23 library including the vulnerable _.unset and _.omit functions.

Current vs. Expected behavior

Current behavior: Next.js 16.2.2 ships [email protected] in its vendored dist/compiled/ files (jsonwebtoken/index.js and babel-packages/packages-bundle.js). Security scanners (OWASP Dependency-Check) flag https://github.com/lodash/lodash/security/advisories/GHSA-r5fr-rjxr-66jc and downstream consumers cannot resolve it via npm audit fix or dependency overrides since the code is pre-compiled.

Expected behavior: The vendored lodash should be updated to 4.18.0+ to resolve https://github.com/lodash/lodash/security/advisories/GHSA-r5fr-rjxr-66jc (codeinjection via _.template).

Provide environment information

Operating System:
  Platform: darwin
  Arch: arm64
  Version: Darwin Kernel Version 25.3.0: Wed Jan 28 20:53:05 PST 2026; root:xnu-12377.81.4~5/RELEASE_ARM64_T6020
  Available memory (MB): 65536
  Available CPU cores: 12
Binaries:
  Node: 24.14.1
  npm: 11.11.0
  Yarn: N/A
  pnpm: N/A
Relevant Packages:
  next: 16.2.2 // Latest available version is detected (16.2.2).
  eslint-config-next: N/A
  react: 19.2.4
  react-dom: 19.2.4
  typescript: 5.9.3
Next.js Config:
  output: N/A

Which area(s) are affected? (Select all that apply)

Not sure

Which stage(s) are affected? (Select all that apply)

next build (local)

Additional context

Next.js bundles the full [email protected] library in pre-compiled files under dist/compiled/. This version is affected by CVE-2026-4800 (code injection via _.template), patched in [email protected].

extent analysis

TL;DR

Update the vendored lodash version in Next.js to 4.18.0 or later to resolve the security vulnerability.

Guidance

  • Verify the vulnerability by checking the version of lodash in the node_modules/next/dist/compiled/jsonwebtoken/index.js and node_modules/next/dist/compiled/babel-packages/packages-bundle.js files.
  • Consider upgrading Next.js to a version that includes the patched lodash library, if available.
  • As a temporary workaround, manually update the vendored lodash version in the pre-compiled files, but be aware that this may not be a sustainable solution.
  • Monitor the Next.js repository for updates that address this security issue.

Example

No code snippet is provided as this issue is related to a vulnerability in a dependency and requires an update to the library rather than a code change.

Notes

The provided information suggests that the issue is specific to Next.js version 16.2.2 and the bundled lodash library. Updating the library version should resolve the security vulnerability, but it may require waiting for an update to Next.js or manually updating the vendored library.

Recommendation

Apply workaround: Manually update the vendored lodash version to 4.18.0 or later, as updating to a fixed version of Next.js may not be immediately available.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…
#prompt issue#agent setup#task chaining#parallel task#integration issue

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING