{"record":{"id":"1e6cc76d1bf15df3","repo":"vercel/next.js","slug":"next-js-targetversion-is-affected-by-an-active-advisory","errorCode":null,"errorMessage":"Next.js ${targetVersion} is affected by an active advisory.","messagePattern":"Next\\.js (.+?) is affected by an active advisory\\.","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/next/src/lib/upgrade/prepare-upgrade.ts","lineNumber":102,"sourceCode":"      semver.lt(release.version, installedVersion)\n    ) {\n      return {\n        status: 'unaffected',\n        reason: `Next.js ${installedVersion} is newer than the latest stable release ${release.version}.`,\n      }\n    }\n\n    let pendingFutureDefaults: FutureDefaultEntry[] = []\n\n    if (targetRequest === 'future') {\n      const securitySnapshot = await readSecuritySnapshot(targetVersion)\n\n      if (\n        securitySnapshot?.ranges.some((range) =>\n          semver.satisfies(targetVersion, range)\n        )\n      ) {\n        throw new Error(\n          `Next.js ${targetVersion} is affected by an active advisory.`\n        )\n      }\n\n      const config = await loadConfig(PHASE_INFO, directory, {\n        silent: true,\n      }).finally(resetEnv)\n\n      pendingFutureDefaults = futureDefaults.filter(\n        (futureDefault) =>\n          semver.gte(targetVersion, futureDefault.availableSince) &&\n          !futureDefault.isAdopted(config)\n      )\n\n      if (\n        targetVersion === installedVersion &&\n        pendingFutureDefaults.length === 0\n      ) {","sourceCodeStart":84,"sourceCodeEnd":120,"githubUrl":"https://github.com/vercel/next.js/blob/34433fd12ee8074ea3f47af9f36255c7390d0301/packages/next/src/lib/upgrade/prepare-upgrade.ts#L84-L120","documentation":"prepareUpgrade throws this when a 'future' upgrade request resolves to a target version that still falls inside a known, non-withdrawn GitHub security advisory's vulnerable range. Rather than enabling future defaults on a vulnerable version, the upgrade is aborted. It is a deliberate safety stop, not a transient failure.","triggerScenarios":"Calling prepareUpgrade(directory, 'future') where the resolved target version (the running canary version, or npm's next/latest if the installed version is newer) semver.satisfies() one of the ranges returned by readSecuritySnapshot(). Only runs for targetRequest === 'future' (line 94-105).","commonSituations":"Running the upgrade tooling from a canary checkout that was built from a commit inside a disclosed vulnerable range; npm's latest tag momentarily points at a version affected by a just-published advisory that GHSA data already lists.","solutions":["Wait for and upgrade to a patched Next.js release, then re-run the future upgrade.","Pin targetRequest to 'security' or 'latest' which select from known-safe releases instead of allowing a canary target.","Verify the advisory is real by checking the references (GitHub advisories API) and, if the version is actually patched and the range is stale, wait for the advisory data to be corrected.","Check installedVersion: if the running canary is itself affected, move off the affected range first."],"exampleFix":"// before\nawait prepareUpgrade(dir, 'future') // throws if canary target is affected\n// after\nconst prep = await prepareUpgrade(dir, 'security') // picks a known-safe release\nif (prep.status !== 'ready') throw new Error(prep.reason)","handlingStrategy":"validation","validationCode":"import semver from 'next/dist/compiled/semver'\n// inside prepareUpgrade, before choosing 'future':\nconst snapshot = await readSecuritySnapshot(targetVersion)\nif (snapshot?.ranges.some(r => semver.satisfies(targetVersion, r))) {\n  // target vulnerable — fall back to 'security' or 'latest'\n}","typeGuard":"function isSafeTarget(version: string, ranges: string[]): boolean {\n  return !ranges.some(range => semver.satisfies(version, range))\n}","tryCatchPattern":"try {\n  const prep = await prepareUpgrade(dir, 'future')\n} catch (error) {\n  if ((error as Error).message.includes('affected by an active advisory')) {\n    const prep = await prepareUpgrade(dir, 'security')\n  } else throw error\n}","preventionTips":["Prefer 'security' or 'latest' targetRequest unless you specifically need future defaults","Keep canary checkouts current so the resolved target is not in a stale vulnerable range","Check active GitHub advisories for next before running future upgrades"],"tags":["security","versioning","semver","advisory"],"backgroundTag":"value-out-of-range","analyzedSha":"34433fd12ee8074ea3f47af9f36255c7390d0301","analyzedAt":"2026-09-20T18:20:20.576Z","contentChangedAt":"2026-09-20T18:20:20.576Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}