Next.js vulnerability, "Fix with V0, it is free" - button not clickable

[rtruxler]

Appreciate that v0 called out the Next.js CVE. That was helpful! I’ll upgrade my repo.

I wanted to flag that the yellow notice in the preview has the “Fix with v0, it is free” button, but that button is not clickable. I click it and nothing happens. I tried to just say manually in the prompt, “I’m on Next.js 15.2.4, there is a known CVE and I want to upgrade to the latest security patch.” Here was the response:

Based on my research, Next.js 15.2.4 actually includes the security patch for CVE-2025-29927. However, let me search for the absolute latest version to ensure you have the most recent release:

Checked latest Next.js versionGood news! According to the latest information, Next.js 15.2.4 actually contains the security patch for the CVE-2025-29927 vulnerability. However, if you’d like to upgrade to the absolute latest version (which appears to be 15.5 or later), you’ll need to unlock the package.json file first.

So .. clearly this is going to the LLM’s base knowledge of CVEs and the version of Next.js, and not pulling in the latest CVE context.

[heystu (Sean)]

Reallly?
Must be something else. I literally clicked the “Fix for free” on all of these messages on my projects and it worked right away and just fine.

Are you still havign that issue?

[heystu (Sean)]

If that Fix for free button still isnt working (but it really should and I had no experience of it not working), you can always just run this in the prompt:

upgrade the Next.js dependency from version 16.0.3 to 16.0.7. Make sure all other dependencies including React 19.2.0 and the React Three Fiber libraries remain compatible with this Next.js version.

It will run it and fix up all you need and only cost around .074 credits. but again, it should work for you.
Hope it did in the end.

[pawlean (Pauline P. Narvas)]

+1 on trying the prompt that Sean shared.

Let me see what’s going on with that button anyway, if you’re still seeing it?

[piotr-2296 (Piotr)]

Button is clickable but after clicking “Fix it” there is an error: “Failed to apply fix. Please try again.”.
After update of Next.js and libraries still that warning occurs.

[pawlean (Pauline P. Narvas)]

Thanks for the report, @piotr-2296! Good to know, I’ll raise internally.

[hasriza (riza)]

@heystu I think he’s using v15, so switching to v16 might break dependencies. He should go with 15.5 which seems to be what v0 suggested.

[pawlean (Pauline P. Narvas)]

The v0 team is looking into this right now

[ianharris-8558]

Security Vulnerability Detected
This app uses Next.js 16.0.0 which has a recently discovered security flaw. Click below to upgrade to a secure version. Your published projects are protected by our platform level protections. Learn more

I am getting “Failed to apply” if this is related

[pawlean (Pauline P. Narvas)]

That is helpful - thank you Ian! The team is actively looking at this.

[heystu (Sean)]

the prompt I gave will sort this out

[heystu (Sean)]

Ah ok interesting. Hmmm…. then I am thinking just updating the prompt to say that would work just fine.
But as Pauline said, seems the team is looking into it.

[pawlean (Pauline P. Narvas)]

The prompt should work, but we also want to ensure this button actually resolves the issue. Appreciate your patience, folks!

[jacobparis]

The fix should be deployed, can you folks try the Fix in v0 button now and see if it’s working correctly?

[ianharris-8558]

Now working for me

Still getting this error however which stops the preview from working, is this a known bug ?

Unhandled promise rejection: InvalidCharacterError: Failed to execute 'btoa' on 'Window': The string to be encoded contains characters outside of the Latin1 range.

[hasriza (riza)]

I believe that’s associated with your project, I’d try putting this error and asking v0 what it means and how can I fix this in the current project.

[hasriza (riza)]

I mean…

[rtruxler]

Yeah, explicitly specifying the patch version worked. The summarized answer is wrong – my package.json was indeed fixed without a problem.

Also, FYI, the Fix with button worked this morning after a hard refresh. I suspect the issue is that I still have a long-standing issue where another run-time dependency issues in the Next.js preview environment was showing up. Perhaps that was somehow blocking the Next.js security patch “Fix with” button from being clickable. But now it is.