About
The React Framework
What detecting next tells you about a site
next in the bundle means the site is a Next.js application — the dominant React meta-framework — and that brings a whole architecture with it: file-system routing, server components or getServerSideProps, image optimization, and deployment shaped around Vercel or a Node server. Its presence usually also means you'll see `/_next/static/` asset URLs and a `__NEXT_DATA__` payload in the HTML.
Why the exact next version matters
The Next.js version is the cleanest way to tell which router and rendering model a site uses. Versions 13.4+ default to the App Router with React Server Components; earlier versions are Pages Router. Next 15 moved to React 19 and made caching opt-in. The exact version read from the bundled `next/package.json` settles the App-vs-Pages question that detection heuristics otherwise only guess at — and flags sites stuck on known-vulnerable releases.
next in a real-world stack
When you find next in a bundle, it rarely travels alone. react and react-dom (matching versions), often @sentry/nextjs for monitoring, and frequently tailwindcss for styling.
Quick facts
npm install nextThis package powers Next.js
The next package is the canonical implementation of Next.js. Sourcemap Explorer uses this exact npm package as the framework-level fingerprint when it flags Next.js on a page — both via the bundled node_modules/next/ source paths and via the embedded package.json inside the JavaScript sourcemap.
Common pairings
Packages this one expects to find in the same project. Each is also a Sourcemap Explorer detection target.
What next pulls in
next declares 6 direct dependencies — each one also rides into any bundle that ships next, so they are detection targets too. Reading them is a quick way to understand the package's real footprint .
How Sourcemap Explorer detects next
next ships as v16.3.0, published 2026-08-03 and carries 6 direct dependencies, 6 peer dependencies (sass, react, react-dom), 3,877 versions on the registry. Those exact numbers are the footprint Sourcemap Explorer matches when next rides inside a deployed bundle — here is how the detection works.
We catch next from two complementary signals: bundled source paths and the embedded package.json. Modern bundlers (webpack, Vite, esbuild, Rollup, Turbopack) preserve the original node_modules/next/ paths inside the JavaScript sourcemap's sources[] array — that's the canonical signal. When the matching package.json is also captured in sourcesContent[], we read the exact version field — patch number included. No regex guessing, no version inference.
- 1
Confirm the site exposes sourcemaps
In DevTools Network, check the response headers of any application script for `SourceMap` or `X-SourceMap`. Failing that, fetch the script's last 4 KB and look for a `//# sourceMappingURL=` comment — that map is where the `next` paths live.
- 2
Find the package in the bundle
Open DevTools → Network → reload. Click any application script and look at its sourcemap. Inside, search `sources[]` for entries matching `node_modules/next/` — every match confirms the package is bundled. The matching `sourcesContent[i]` for `node_modules/next/package.json` gives you the exact installed version.
- 3
Read the version directly from package.json
Run `jq -r '. as $m | $m.sources | to_entries[] | select(.value | endswith("node_modules/next/package.json")) | $m.sourcesContent[.key] | fromjson | .version' bundle.js.map`. Sourcemap Explorer automates the same query in the popup.
Major releases of next
When each major version first landed. Major bumps are where breaking changes live, so this timeline is the fastest way to date the next version a site actually ships against the ecosystem.
Recent security advisories for next
The 5 most recent advisories affecting some versions of next, aggregated from OSV.dev (GitHub Advisory + CVE data). A listing here doesn't mean the version a given site ships is affected — each advisory applies to a specific version range. Sourcemap Explorer reads the exact bundled version so you can check it against these ranges.
Next.js: Server-Side Request Forgery in Server Actions on custom servers
Next.js: Cache confusion of response bodies for requests with bodies
Next.js: Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences
Next.js: Unbounded Server Action payload in Edge runtime
Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname
Recent versions
next README
Live mirror of the GitHub README, for reference. Updated whenever the repo's default branch changes.
Next.js
Getting Started
Visit https://nextjs.org/learn to get started with Next.js.
Documentation
Visit https://nextjs.org/docs to view the full documentation.
Who is using Next.js?
Next.js is used by the world's leading companies. Check out the Next.js Showcase to learn more.
Community
The Next.js community can be found on GitHub Discussions, where you can ask questions, voice ideas, and share your projects.
To chat with other community members you can join the Next.js Discord.
Our Code of Conduct applies to all Next.js community channels.
Contributing
Please see our contributing.md.
Good First Issues
We have a list of good first issues that contain bugs which have a relatively limited scope. This is a great place to get started, gain experience, and get familiar with our contribution process.
Authors
- Tim Neutkens (@timneutkens) – Vercel
- Naoyuki Kanezawa (@nkzawa) – Vercel
- Guillermo Rauch (@rauchg) – Vercel
- Arunoda Susiripala (@arunoda)
- Tony Kovanen (@tonykovanen)
- Dan Zajdband (@impronunciable)
FAQ
What is next used for?
The React Framework
How can I tell if a website is using next?
Open the page in Chrome with the Sourcemap Explorer extension installed and read the Stack tab. We catch `next` from two complementary signals: `node_modules/next/` paths inside the JavaScript sourcemap, and the embedded `package.json` we read for exact-version detection. Without the extension you can do the same lookup manually in DevTools — the steps are listed in the "How Sourcemap Explorer detects" section above.
How do I find out which version of next a website is running?
Read it straight from the site's JavaScript sourcemap. When a build ships source maps, the bundled `next/package.json` carries the exact `version` string — Sourcemap Explorer extracts it in one click on the Stack tab, and you can do it by hand in DevTools by opening the `.map` file and searching for `node_modules/next/package.json`. That is far more reliable than inferring the version from an asset-hash or a `?ver=` query string, which is all surface-level detectors have to go on. The current npm release is 16.3.0, but real deployments frequently run an older pinned version — which is exactly why reading the bundled number matters.
What is the latest version of next?
16.3.0, as published on the npm registry. The "Recent versions" table on this page lists the most recent 8 releases with their release dates. Sourcemap Explorer reports the version actually bundled into a site, which can lag the latest release by months on real-world deployments.
Is next actively maintained?
Very actively maintained — the last release shipped within the past three months. The last published release was 2026-08-03. Source code: https://github.com/vercel/next.js.
What is the relationship between next and Next.js?
next is the canonical npm package for Next.js. Sourcemap Explorer treats finding `next` in a bundle as the framework-level signal that Next.js is on the page, and the page you're reading is the canonical Sourcemap Explorer entry for the package itself.
Does next have known security vulnerabilities?
5 recent advisories affecting some versions of next are listed in the "Recent security advisories" section above, aggregated from OSV.dev (GitHub Advisory + CVE data). Whether a particular site is exposed depends entirely on the exact version it ships — each advisory applies to a specific version range, not to the package as a whole. That is why the precise bundled version matters: Sourcemap Explorer reads the version a site actually runs, so you can check it against the affected ranges instead of assuming the latest release is what's deployed.
Where can I read more?
Project homepage: https://nextjs.org. Source code: https://github.com/vercel/next.js. Published on npm: https://www.npmjs.com/package/next. Licensed as MIT.
Keep reading on Sourcemap Explorer
Practical guides
Detection deep dives
Alternative tools
Detected by Sourcemap Explorer
When a bundle ships sourcemaps, we read the embedded package.json for next and report the precise version (the registry's latest is v16.3.0, published 2026-08-03; the bundled copy is often older). Without sourcemaps, an import / require in the page's scripts is enough to flag it.