-
Notifications
You must be signed in to change notification settings - Fork 13
Description
From Security Advisory: CVE-2025-66478:
A critical vulnerability has been identified in the React Server Components (RSC) protocol. The issue is rated CVSS 10.0 and can allow remote code execution when processing attacker-controlled requests in unpatched environments.
This vulnerability originates in the upstream React implementation (CVE-2025-55182). This advisory (CVE-2025-66478) tracks the downstream impact on Next.js applications using the App Router.
Impact
The vulnerable RSC protocol allowed untrusted inputs to influence server-side execution behavior. Under specific conditions, an attacker could craft requests that trigger unintended server execution paths. This can result in remote code execution in unpatched environments.
NextJS is currently at ^15.5.4, should be upgraded to ^15.5.7
Metadata
Metadata
Assignees
Type
Projects
Status