v0 building on vulnerable version of Next.js

I recently created a v0 chat through the API (version 2). It successfully one-shotted a website based on my brief, but when I attempted to deploy, the deployment failed with the error message “Vulnerable version of Next.js detected, please update immediately.”

The Next version that v0 used was 15.2.4. Model was v0-Max, chat ID cvXx3IuacRu.

I can easily fix this myself, but just reporting in case it’s affecting others as well.

Hi jpryor,

That deployment failure makes sense for next@15.2.4. Vercel blocks new deployments when it detects a Next.js version affected by certain security advisories, and the May 2026 Next.js security release lists 15.x versions up to 15.5.17 as affected, with 15.5.18 as the patched 15.x target.

For a generated v0 app, I’d treat this as a dependency update rather than a deployment issue. In the generated project, update package.json and the lockfile, then redeploy:

pnpm add next@15.5.18
pnpm install

If the app is already compatible with Next 16, next@16.2.6 or newer is another option, but I’d start with the patched 15.x line if you want the smallest change from 15.2.4.

For future API-generated chats, a useful follow-up prompt would be:

Update the project to a patched Next.js version that Vercel can deploy. Keep the existing app behavior the same, update package.json and the lockfile, then fix any build errors caused by the dependency update.

Relevant Vercel note: