Critical Vulnerabilities in React Server Components and Next.js

According to Unit 42, on 3 December 2025 researchers disclosed critical remote code execution vulnerabilities in the Flight protocol used by React Server Components and Next.js, tracked as CVE-2025-55182 and CVE-2025-66478 with a maximum CVSS of 10.0. The flaws arise from insecure deserialization in the RSC Flight protocol, enabling unauthenticated attackers to execute arbitrary server-side JavaScript code via specially crafted HTTP payloads, including in default configurations.

The vulnerabilities affect React versions 19.0.0 through 19.2.0 and Next.js 15.x and 16.x (App Router), with Canary builds from 14.3.0, and extend to other frameworks bundling the affected packages such as react-server-dom-webpack, react-server-dom-parcel and react-server-dom-turbopack. Palo Alto Networks telemetry identifies over 968,000 React and Next.js instances, while usage is described as roughly 40% of developers for React and 18–20% for Next.js.

Immediate upgrading to patched versions is recommended, specifically React 19.0.1, 19.1.2 or 19.2.1 and Next.js 16.0.7, 15.5.7, 15.4.8, 15.3.6, 15.2.6, 15.1.9 or 15.0.5. The article also notes testing shows near-100% reliability of the exploit and recognises post-exploitation protections via Cortex XDR and XSIAM.