Output export for new CVE-2025-66478

[jsmithy1748]

Summary

I can see a lot of the information talking about server side communications for the CVE. However I cant see any clarification for users who run nextjs set up with:

output: 'export',

The app should be running with no node runtime so in theory shouldn't have any server side issues?

Thanks

Additional information

No response

Example

No response

[icyJoseph]

Even if that's true, you definitely should upgrade, there's no reason to stay in a version with a known vulnerability. Just imagine, over a period of time, this app migrates to using server side features, but nobody remembered to update to a fixed version... hopefully some automation and other checks could catch that before deploying.

[jsmithy1748]

Thanks for the reply,

Absolutely I get upgrading is the best action, but in the short term of for apps who can't currently?

Also I completely agree about the transition from static to server based. For most static apps this would be a large transition so should hopefully be caught by anyone doing the updates pre launch.