Executive Summary
Effective February 12, 2026, Vercel will automatically block any new deployment that includes a version of the `next-mdx-remote` package with the known security vulnerability CVE-2026-0969. This security measure is designed to proactively protect applications on the platform. While Vercel strongly recommends all users upgrade to a patched version, an override option is available via an environment variable for specific cases.
Key Takeaways
* New Policy: Deployments containing a vulnerable version of the `next-mdx-remote` package will now automatically fail on Vercel.
* Affected Vulnerability: The policy specifically targets CVE-2026-0969.
* Recommendation: Users are strongly encouraged to upgrade to a patched version of the package, regardless of their hosting provider.
* Manual Override: The automatic block can be disabled by setting the `DANGEROUSLY_DEPLOY_VULNERABLE_CVE_2026_0969=1` environment variable in the Vercel project settings.
Strategic Importance
This move signals Vercel's commitment to platform security by actively preventing the deployment of known vulnerabilities, shifting responsibility from user awareness to platform enforcement.