Skip to content

Upgrade NextJS to 15.5.7 #256

@alexfigtree

Description

@alexfigtree

From Security Advisory: CVE-2025-66478:

A critical vulnerability has been identified in the React Server Components (RSC) protocol. The issue is rated CVSS 10.0 and can allow remote code execution when processing attacker-controlled requests in unpatched environments.

This vulnerability originates in the upstream React implementation (CVE-2025-55182). This advisory (CVE-2025-66478) tracks the downstream impact on Next.js applications using the App Router.

Impact
The vulnerable RSC protocol allowed untrusted inputs to influence server-side execution behavior. Under specific conditions, an attacker could craft requests that trigger unintended server execution paths. This can result in remote code execution in unpatched environments.

NextJS is currently at ^15.5.4, should be upgraded to ^15.5.7

Metadata

Metadata

Assignees

Type

No type

Projects

Status

Release Ready

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions