vercel/next.js · error · Error

Next.js is affected by an active advisory.

Error message

Next.js ${targetVersion} is affected by an active advisory.

What it means

prepareUpgrade throws this when a 'future' upgrade request resolves to a target version that still falls inside a known, non-withdrawn GitHub security advisory's vulnerable range. Rather than enabling future defaults on a vulnerable version, the upgrade is aborted. It is a deliberate safety stop, not a transient failure.

Solutions

1. Wait for and upgrade to a patched Next.js release, then re-run the future upgrade.
2. Pin targetRequest to 'security' or 'latest' which select from known-safe releases instead of allowing a canary target.
3. Verify the advisory is real by checking the references (GitHub advisories API) and, if the version is actually patched and the range is stale, wait for the advisory data to be corrected.
4. Check installedVersion: if the running canary is itself affected, move off the affected range first.

Example fix

// before
await prepareUpgrade(dir, 'future') // throws if canary target is affected
// after
const prep = await prepareUpgrade(dir, 'security') // picks a known-safe release
if (prep.status !== 'ready') throw new Error(prep.reason)

import semver from 'next/dist/compiled/semver'
// inside prepareUpgrade, before choosing 'future':
const snapshot = await readSecuritySnapshot(targetVersion)
if (snapshot?.ranges.some(r => semver.satisfies(targetVersion, r))) {
  // target vulnerable — fall back to 'security' or 'latest'
}

function isSafeTarget(version: string, ranges: string[]): boolean {
  return !ranges.some(range => semver.satisfies(version, range))
}

try {
  const prep = await prepareUpgrade(dir, 'future')
} catch (error) {
  if ((error as Error).message.includes('affected by an active advisory')) {
    const prep = await prepareUpgrade(dir, 'security')
  } else throw error
}

When it happens

Trigger: Calling prepareUpgrade(directory, 'future') where the resolved target version (the running canary version, or npm's next/latest if the installed version is newer) semver.satisfies() one of the ranges returned by readSecuritySnapshot(). Only runs for targetRequest === 'future' (line 94-105).

Common situations: Running the upgrade tooling from a canary checkout that was built from a commit inside a disclosed vulnerable range; npm's latest tag momentarily points at a version affected by a just-published advisory that GHSA data already lists.

Understand the failure class

Background: "value must be between 0 and 1" / "out of range" / "must not be negative" errors: fixing range-validation failures across open-source libraries — this error's family across 42 libraries.

Related errors

• No safe Next.js update is currently available.
• The running Next.js version is not valid semver.
• Could not check for security updates.
• Could not check Next.js security advisories. Continuing…
• Could not determine the installed Next.js version.

AI-assisted analysis of vercel/next.js@34433fd12e (2026-09-20). Data as JSON: /api/errors/1e6cc76d1bf15df3. Report an issue: GitHub.

Appendix: source

Thrown at packages/next/src/lib/upgrade/prepare-upgrade.ts:102

      semver.lt(release.version, installedVersion)
    ) {
      return {
        status: 'unaffected',
        reason: `Next.js ${installedVersion} is newer than the latest stable release ${release.version}.`,
      }
    }

    let pendingFutureDefaults: FutureDefaultEntry[] = []

    if (targetRequest === 'future') {
      const securitySnapshot = await readSecuritySnapshot(targetVersion)

      if (
        securitySnapshot?.ranges.some((range) =>
          semver.satisfies(targetVersion, range)
        )
      ) {
        throw new Error(
          `Next.js ${targetVersion} is affected by an active advisory.`
        )
      }

      const config = await loadConfig(PHASE_INFO, directory, {
        silent: true,
      }).finally(resetEnv)

      pendingFutureDefaults = futureDefaults.filter(
        (futureDefault) =>
          semver.gte(targetVersion, futureDefault.availableSince) &&
          !futureDefault.isAdopted(config)
      )

      if (
        targetVersion === installedVersion &&
        pendingFutureDefaults.length === 0
      ) {

View on GitHub (pinned to 34433fd12e)