Critical Remote Code Execution Vulnerabilities Discovered in React Server Components and Next.js

Security researchers have uncovered critical unauthenticated remote code execution vulnerabilities in React Server Components and the Next.js App Router, with near 100% exploitation success in testing environments. The vulnerabilities are tracked as CVE-2025-55182 (React) and CVE-2025-66478 (Next.js) and stem from insecure deserialization within the React Server Components Flight protocol, where insufficient input validation allows attacker-controlled data to influence server-side execution logic.

According to the React Core Team's disclosure, this creates a reliable attack vector affecting the affected versions, with 39% of cloud environments running vulnerable versions and 44% having publicly exposed Next.js instances. Upgrading to patched versions is advised, with specific patched releases listed for React and Next.js App Router. StepSecurity also highlights tools for identifying exposure, including an npm package search and Threat Center monitoring for real-time alerts.