# What changed in next-mdx-remote

> 5 changes in next-mdx-remote 5 to 6 from its official release notes, upgrade guides and advisories: 1 breaking, 2 security. Each one cited. Sources checked 2026-10-27. HTML: https://unstale.sh/npm/next-mdx-remote/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## next-mdx-remote 6

### Security

- Controls how JS is interpreted during MDX compilation and defaults to true for security reasons. (6.0.0) — [release notes](https://github.com/hashicorp/next-mdx-remote/releases/tag/v6.0.0)
- next-mdx-remote affected by arbitrary code execution in React server-side rendering of untrusted MDX content (6.0.0) — [security advisory](https://github.com/advisories/GHSA-G4XW-JXRG-5F6M)

## next-mdx-remote 5

### Breaking changes

- Updated to MDX v3, changing the MDX version used by next-mdx-remote. (5.0.0) — [release notes](https://github.com/hashicorp/next-mdx-remote/releases/tag/v5.0.0)

### Fixes and other changes

- Added support for React 19. (5.0.0) — [release notes](https://github.com/hashicorp/next-mdx-remote/releases/tag/v5.0.0)
- Fixed various TypeScript errors. (5.0.0) — [release notes](https://github.com/hashicorp/next-mdx-remote/releases/tag/v5.0.0)