Next.js is a React framework for building full-stack web applications. In versions starting from 13.0 to before 14.2.30 and 15.0.0 to before 15.2.2, Next.js may have allowed limited source code exposure when the dev server was running with the App Router enabled. The vulnerability only affects local development environments and requires the user to visit a malicious webpage while npm run dev is active. This issue has been patched in versions 14.2.30 and 15.2.2.

The version of Next.js installed on the remote host is 13.0.0 prior to 14.2.30 or 15.x prior to 15.2.2. It is, therefore, affected by an information disclosure vulnerability in the development server due to a lack of origin verification, allowing a malicious website visited by the developer to access sensitive development data.

Note that the scanner has not attempted to exploit this issue but has instead relied only on application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Next.js is a React framework for building full-stack web applications. In versions starting from 13.0 to     before 14.2.30 and 15.0.0 to before 15.2.2, Next.js may have allowed limited source code exposure when the     dev server was running with the App Router enabled. The vulnerability only affects local development     environments and requires the user to visit a malicious webpage while npm run dev is active. This issue     has been patched in versions 14.2.30 and 15.2.2. (CVE-2025-48068)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Next.js is a React framework for building full-stack web applications. In versions starting from 13.0 to
    before 14.2.30 and 15.0.0 to before 15.2.2, Next.js may have allowed limited source code exposure when the
    dev server was running with the App Router enabled. The vulnerability only affects local development
    environments and requires the user to visit a malicious webpage while npm run dev is active. This issue
    has been patched in versions 14.2.30 and 15.2.2. (CVE-2025-48068)

ID	Name	Product	Family	Type	Severity
115787	Next.js 15.x < 15.2.2 Information Disclosure	Web App Scanning	Component Vulnerability	Version Based	low
115786	Next.js 13.0.0 < 14.2.30 Information Disclosure	Web App Scanning	Component Vulnerability	Version Based	low
260222	Linux Distros Unpatched Vulnerability : CVE-2025-48068	Nessus	Misc.	Local	low
427758	SCA: security update for next (GHSA-3h52-269p-cp9r)	Tenable Cloud Security	SCA Checks	Local	low
427758	SCA: security update for next (GHSA-3h52-269p-cp9r)	Tenable Self-Hosted Container Security	SCA Checks	Local	low

Detections

Analytics

CVE-2025-48068

low

Tenable Plugins

low

low

low

low

low