---
title: "Deploy Next.js | Starter Whose Lockfile Passes the CVE Gate"
description: "Next.js 16 starter: current React, lockfile audited clean, health check."
category: "Starters"
url: https://railway.com/deploy/nextjs-or-starter-whose-lockfile-passes-
---

# Deploy Next.js | Starter Whose Lockfile Passes the CVE Gate

Next.js 16 starter: current React, lockfile audited clean, health check.

**[Deploy Next.js | Starter Whose Lockfile Passes the CVE Gate on Railway](https://railway.com/template/nextjs-or-starter-whose-lockfile-passes-)**

- **Creator:** Pavel Volkov's Projects
- **Category:** Starters

## Template content

### nextjs-railway-starter

- **Source:** ak40u/nextjs-railway-starter
- **Public domain:** Yes

## Documentation

# Deploy and Host Next.js on Railway

A Next.js App Router starter on current Next and React, with a lockfile that clears Railway's vulnerability gate — so the build actually begins.

## About Hosting Next.js

Hosting Next.js is mostly undramatic: the builder installs, runs `next build`, and starts the server, which reads `PORT` on its own. The step that catches people is earlier and newer. Railway now scans the committed lockfile before building and refuses to continue when it finds a HIGH-severity advisory. A template that pinned its framework a year ago is no longer merely out of date — it is rejected outright, and the failure has nothing to do with the application code.

## Common Use Cases

- The starting point for a Next.js product or marketing site
- A React front end talking to APIs you host elsewhere on Railway
- A reference for how a Next.js project should be pinned to stay deployable

## Dependencies for Next.js Hosting

- `next` 16 and `react` / `react-dom` 19, all stable releases
- `overrides` forcing `postcss` and `sharp` past their HIGH advisories

### Deployment Dependencies

- [Next.js documentation](https://nextjs.org/docs)
- [Source repository](https://github.com/ak40u/nextjs-railway-starter)

### Implementation Details

The official Next.js template on Railway pins `next@15.2.7`. This is what the builder says about it:

```
==============================================================================
SECURITY VULNERABILITIES DETECTED
==============================================================================

Railway cannot proceed with deployment due to security vulnerabilities in your
project's dependencies.

Found 1 vulnerable package(s):

  next@15.2.7
      Source: pnpm-lock.yaml
      Severity: HIGH
      Upgrade to 15.2.8: pnpm add next@^15.2.8

      Vulnerabilities:
      - CVE-2025-67779 (HIGH)
```

It also pins React to a dated release candidate, `19.0.0-rc-69d4b800-20241021`, which no longer resolves against current Next:

```
npm error code ERESOLVE
npm error Found: react@19.0.0-rc-69d4b800-20241021
```

Simply bumping to the latest Next is not enough on its own — a fresh install still resolves `postcss` and `sharp` to versions carrying HIGH advisories, which trips the same gate. This template pins those forward with `overrides`, so:

```
$ npm audit --audit-level=high
found 0 vulnerabilities
```

One further detail, learned the hard way: `output: "standalone"` is left off. The builder starts the app with `next start`, and Next refuses to combine the two — the server logs `Ready` and then serves nothing, which reaches you as a 502 rather than as an error.

`/api/health` is wired to Railway's health check, so a broken release fails the deploy instead of quietly returning errors.

## Getting Started

Add pages under `app/`, API routes as `route.ts` files, and packages with `npm install` — then commit the updated lockfile. Before pushing, `npm audit --audit-level=high` tells you whether Railway will accept it.

## Why Deploy Next.js on Railway?

Railway is a singular platform to deploy your infrastructure stack. Railway will host your infrastructure so you don't have to deal with configuration, while allowing you to vertically and horizontally scale it.

By deploying Next.js on Railway, you are one step closer to supporting a complete full-stack application with minimal burden. Host your servers, databases, AI agents, and more on Railway.

## Similar templates

- [open-excalidraw](https://railway.com/deploy/open-excalidraw) — Self-hostable collaborative drawing built on Excalidraw
- [caring-vibrancy](https://railway.com/deploy/caring-vibrancy) — Deploy and Host caring-vibrancy with Railway
- [Appsmith](https://railway.com/deploy/appsmith-1) — Low-code platform for internal tools, dashboards, and admin panels.

Open this page in a browser: https://railway.com/deploy/nextjs-or-starter-whose-lockfile-passes-