Maximum Severity Alert: Critical RCE Flaw Hits Next.js (CVE-2025-66478, CVSS 10.0)

Developers using Next.js and React are facing a maximum-severity RCE flaw in the React Server Components protocol, tracked as CVE-2025-66478 with a CVSS of 10.0, reported today in a vulnerability notice. According to the official advisory, a critical vulnerability has been identified in the RSC protocol, and ignoring the patch could lead to remote code execution when processing attacker-controlled requests in unpatched environments.

The issue stems from the upstream React implementation (CVE-2025-55182) and cascades to Next.js applications using the App Router. The article notes that an attacker could craft requests that trigger unintended server execution paths, resulting in remote code execution in unpatched environments. Affected versions include Next.js 15.x, Next.js 16.x, and Next.js 14.3.0-canary. There is no workaround or configuration to disable the vulnerable code path; users are advised to update immediately.

The flaw was unearthed by security researcher Lachlan Davidson, and the PoC code is currently withheld to prevent exploitation before patches are applied, with patched releases listed as 15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7 and 16.0.7.