CVE-2025-48068

score

<0.1

cvss

4.3

epss

0.2%

published

2025-05-30

kev added

—

first seen

2026-10-21

Next.js 13.0 to <14.2.30 and 15.0.0 to <15.2.2 contains an information disclosure caused by source code exposure in the dev server with App Router enabled, letting attackers expose limited source code, exploit requires user to visit a malicious webpage while npm run dev is active.