Deploy and Host Next.js on Railway

A Next.js App Router starter on current Next and React, with a lockfile that clears Railway's vulnerability gate — so the build actually begins.

About Hosting Next.js

Hosting Next.js is mostly undramatic: the builder installs, runs next build, and starts the server, which reads PORT on its own. The step that catches people is earlier and newer. Railway now scans the committed lockfile before building and refuses to continue when it finds a HIGH-severity advisory. A template that pinned its framework a year ago is no longer merely out of date — it is rejected outright, and the failure has nothing to do with the application code.

Common Use Cases

The starting point for a Next.js product or marketing site
A React front end talking to APIs you host elsewhere on Railway
A reference for how a Next.js project should be pinned to stay deployable

Dependencies for Next.js Hosting

next 16 and react / react-dom 19, all stable releases
overrides forcing postcss and sharp past their HIGH advisories

Deployment Dependencies

Implementation Details

The official Next.js template on Railway pins next@15.2.7. This is what the builder says about it:

==============================================================================
SECURITY VULNERABILITIES DETECTED
==============================================================================

Railway cannot proceed with deployment due to security vulnerabilities in your
project's dependencies.

Found 1 vulnerable package(s):

  next@15.2.7
      Source: pnpm-lock.yaml
      Severity: HIGH
      Upgrade to 15.2.8: pnpm add next@^15.2.8

      Vulnerabilities:
      - CVE-2025-67779 (HIGH)

It also pins React to a dated release candidate, 19.0.0-rc-69d4b800-20241021, which no longer resolves against current Next:

npm error code ERESOLVE
npm error Found: react@19.0.0-rc-69d4b800-20241021

Simply bumping to the latest Next is not enough on its own — a fresh install still resolves postcss and sharp to versions carrying HIGH advisories, which trips the same gate. This template pins those forward with overrides, so:

$ npm audit --audit-level=high
found 0 vulnerabilities

One further detail, learned the hard way: output: "standalone" is left off. The builder starts the app with next start, and Next refuses to combine the two — the server logs Ready and then serves nothing, which reaches you as a 502 rather than as an error.

/api/health is wired to Railway's health check, so a broken release fails the deploy instead of quietly returning errors.

Getting Started

Add pages under app/, API routes as route.ts files, and packages with npm install — then commit the updated lockfile. Before pushing, npm audit --audit-level=high tells you whether Railway will accept it.

Why Deploy Next.js on Railway?

Railway is a singular platform to deploy your infrastructure stack. Railway will host your infrastructure so you don't have to deal with configuration, while allowing you to vertically and horizontally scale it.

By deploying Next.js on Railway, you are one step closer to supporting a complete full-stack application with minimal burden. Host your servers, databases, AI agents, and more on Railway.