December 05, 10:29 PM PST: Vercel has released an npm package to update your affected Next.js app. Use npx fix-react2shell-next or visit the GitHub page to learn more. December 05, 3:44 PM PST: Vercel has partnered with HackerOne for responsible disclosure of critical Vercel Platform Protection workarounds. Valid reports that demonstrate a successful bypass of Vercel protections will be rewarded for this CVE only. Bounties: $25,000 for high, $50,000 for critical. Visit the HackerOne page to participate. As of December 4 at 21:04 UTC, various proof-of-concept (POC) exploits for CVE-2025-55182 are confirmed to be publicly available. This common vulnerabilities and exposures report (CVE) also impacted all Next.js apps between 15.0.0 and 16.0.6.

Every year, Black Friday and Cyber Monday reveal how people shop, browse, and discover products at global scale. For Vercel, the weekend doesn't require a different operating mode. The platform behaves the same way it does every day, only with higher traffic volume. A live dashboard showed the traffic as it played out. This year, traffic reached more than 115.8 billion total requests, reflecting 33.6% year-over-year growth with consistent performance throughout the events. The traffic shape told a familiar story. Requests dipped on Thanksgiving as people stepped away from screens, then surged on Black Friday, stayed elevated through the weekend, and built into a second wave on Cyber Monday. These rhythms played out across every major geography, and the platform adapted continuously without configuration changes or manual intervention. Below is a snapshot of what the weekend looked like.

The team behind Gel Data is joining Vercel to help us invest in the Python ecosystem. Led by Python core developer Yury Selivanov and contributor Elvis Pranskevichus, they will bring world-class support for Python on the AI Cloud.

We are expanding our partnership with AWS to make it faster for developers to build and scale with AWS infrastructure. On December 15th, Aurora PostgreSQL, Amazon DynamoDB, and Aurora DSQL will be available as native integrations in the Vercel Marketplace. These integrations bring the power and scalability of AWS databases directly into your Vercel workflow, so you can focus on shipping products, agents, and websites instead of configuring infrastructure.

We recently released v0 for iOS, Vercel’s first mobile app. As a company focused on the web, building a native app was new territory for us. Our goal was to build an app worthy of an Apple Design Award, and we were open-minded on the best tech stack to get there. To that end, we built dozens of iterations of the product prior to our public beta. We experimented with drastically different tech stacks and UI patterns.

Today we're open-sourcing Workflow Builder, a complete visual automation platform powered by the Workflow Development Kit (WDK). The project includes a visual editor, execution engine, and infrastructure, giving you what you need to build your own workflow automation tools and agents. Deploy it to Vercel and customize it for your use case.

At Vercel, we believe security should be intuitive, not intimidating. The best security tool is the one that's actually used. It should be clear, useful, and never in the way. But that's not always the norm. Security tooling can often feel like a tradeoff against shipping velocity. When UX is an afterthought, teams leave tools off or in "logging mode" forever, even when risks are high. That's why we've redesigned the Vercel Firewall experience from the ground up. The new UI helps you see more, do more, and feel confident in your app's resilience to attacks.

In April, we launched the Vercel Open Source Program to give maintainers the resources, credits, and support they need to ship faster and scale confidently. The first group joined through our spring 2025 cohort. Today we are welcoming the fall 2025 cohort. From AI-native apps and developer infrastructure to design systems and creative tooling, open-source builders continue to amaze us. Meet the creators and explore their projects.

AI has transformed how we write code. The next transformation is how we run it. At Vercel, we’re building self-driving infrastructure that autonomously manages production operations, improves application code using real-world insights, and learns from the unpredictable nature of production itself. Our vision is a world where developers express intent, not infrastructure. Where ops teams set principles, not individual configurations and alerts. Where the cloud doesn’t just host your app, it understands, optimizes, and evolves it.

The Gemini 3 Pro Preview model, released today, is now available through the Vercel AI Gateway and on v0.app. Thanks to Google, Vercel has been testing Gemini 3 Pro Preview across v0, Next.js, AI SDK, and Vercel Sandbox over the past several weeks. We've noticed the model has an increased focus on coding, multimodal reasoning, and tool use, though it's seen improvements across the board. From our testing, Gemini 3 Pro Preview delivers substantial improvements in instruction following and response consistency. It shows almost a 17% increase in correctness over its predecessor on our Next.js evals, putting in the top 2 models on the leaderboard.

Vendor lock-in matters when choosing a cloud platform. Cloud platforms can lock you in by requiring you to build against their specific primitives. Vercel takes a different approach: you write code for your framework, not for Vercel. On AWS, you configure Lambda functions, NAT Gateways, and DynamoDB tables. On Cloudflare, you write Workers, use KV stores, Durable Objects, and bind services with Worker Service Bindings. These primitives only exist with that vendor, which means migrating to another platform requires rewriting your application architecture. Too often, cloud platforms make these choices for you. They define proprietary primitives, APIs, and services that pull your code deeper into their ecosystem until leaving becomes impractical. At Vercel, we believe the opposite approach creates better software and a healthier web. We want developers to stay because they want to, not because they have to. That means building open tools, embracing standards, and ensuring your code remains portable no matter where it runs. So Vercel works differently. It interprets your framework code and provisions infrastructure automatically. Your application does not need to know it runs on Vercel. You do not need to import Vercel modules or call Vercel APIs. This is framework-defined infrastructure.

AI lab Nous Research made Hermes, their open-source language model, free for one week to increase accessibility. Within days, automated scripts overwhelmed the service with fake accounts performing high-volume inference requests across thousands of accounts to bypass rate limits. Despite having Cloudflare Turnstile in place, bulk signups continued. The abuse led to wasted inference compute and inflated identity provider bills. After the promotion ended, Nous realized that before reintroducing any kind of free tier, it needed a stronger layer of bot protection.