Is my Next.js version safe?
Paste your version, your package.json or your package-lock.json. You'll see whether it has every published security fix, and the exact version to upgrade to if it doesn't.
Patched right now: 16.4.5 on 16.x · 15.5.29 on 15.x. 14.x and older: no fixes.
npx next --version. Nothing you paste is stored.Why the "safe" version keeps moving
Next.js has shipped security releases every few weeks in 2026, several with critical, unauthenticated remote code execution bugs. Each release moves the patched floor, and older minor lines usually don't get a fix: you have to move to the newest patch of your major version. This page reads the same advisory data GuardLayer's scanner uses, so it changes when a new release is out.
For the advisories behind each floor, and what to do if you can't upgrade yet, read the latest safe Next.js version.
Questions
What is the latest safe Next.js version?+
Right now the patched releases are 16.4.5 on 16.x and 15.5.29 on 15.x. Anything below those misses at least one published security fix, and 14.x and older get no fixes at all. The floor moves with every security release, so check again after each one.
How do I find which Next.js version I'm running?+
Run npx next --version in your project, or npm ls next to see the version your lockfile actually installed. The version in package.json is often a range like ^16.4.2, which only tells you the lowest version allowed.
Is a caret range like ^16.4.2 enough?+
Not on its own. A caret range allows newer patch releases, but your lockfile pins whatever was installed, so a project can keep running the vulnerable lower bound for months. Upgrade, commit the new lockfile, and raise the range's floor to the patched version.
Is what I paste stored?+
No. The check runs on GuardLayer's server, in memory, and nothing you paste is saved or logged. A package.json or package-lock.json is only read for package names and versions.
Which packages does it check besides Next.js?+
When you paste a package.json or package-lock.json, it also checks the React Server Components packages, sharp, Satori, Supabase auth-js, NextAuth / Auth.js and a few common libraries (axios, jsonwebtoken, lodash, minimist, semver, ws) against the advisories GuardLayer tracks.
Get told when the next release lands
Connect your repo and GuardLayer checks every push: outdated Next.js, missing RLS, leaked keys and unprotected Server Actions. Free for public repos, and uploading files is free for any code.
Scan my repo