Security Advisory: CVE-2025-66478

Wednesday, December 3rd 2025

Forked from

Josh Story @joshcstory Sebastian Markbåge @sebmarkbage

December 06, 7:29 AM PST: An npm package has been released to update affected Next.js apps. Use npx fix-react2shell-next to update now, or visit the GitHub repository to learn more.

Overview

A critical vulnerability has been discovered in the React Server Components (RSC) protocol used in Next.js applications. It is rated CVSS 10.0, which is the highest severity score, meaning it can allow attackers to run arbitrary code on your server if your application is not patched.

In simpler terms, if your app is affected and you do not update, an attacker could potentially take control of parts of your server remotely.

Impact

The vulnerable RSC protocol allowed untrusted inputs to influence server-side execution behavior. Attackers could craft requests that exploit this behavior, potentially triggering remote code execution in unpatched environments.

This affects applications using React Server Components with the App Router. Apps using the Pages Router, older stable versions, or running in the Edge Runtime are not affected.

Affected Next.js Versions

  • Next.js 15.x
  • Next.js 16.x
  • Next.js 14.3.0-canary.77 and later canary releases

Fixed Versions

The following releases have patched this vulnerability:

  • 15.0.5
  • 15.1.9
  • 15.2.6
  • 15.3.6
  • 15.4.8
  • 15.5.7
  • 16.0.7

Patched canary releases:

  • 15.6.0-canary.58 (for 15.x canary releases)
  • 16.1.0-canary.12 (for 16.x canary releases)

Required Action

All users of affected Next.js versions should upgrade immediately to the latest patched release in their version line.

npm install next@15.0.5   # for 15.0.x
npm install next@15.1.9   # for 15.1.x
npm install next@15.2.6   # for 15.2.x
npm install next@15.3.6   # for 15.3.x
npm install next@15.4.8   # for 15.4.x
npm install next@15.5.7   # for 15.5.x
npm install next@16.0.7   # for 16.0.x
npm install next@15.6.0-canary.58   # for 15.x canary releases
npm install next@16.1.0-canary.12   # for 16.x canary releases

If you are on a canary release of Next.js 14.3.0 or later, downgrade to the latest stable 14.x release:

npm install next@14

To automate version updates safely, run:

npx fix-react2shell-next

Why This Matters

This vulnerability is severe because it allows attackers to exploit server-side logic in your application. Without updating, your app could be compromised, potentially exposing sensitive data or allowing malicious operations.

Even if your app isn’t public-facing, any environment using the affected versions is at risk if it processes untrusted inputs.

Discovery

Thanks to Lachlan Davidson for responsibly disclosing this vulnerability. This advisory intentionally limits technical details to prevent exploitation of unpatched systems.

References

Summary

In short: if you use Next.js 15.x, 16.x, or 14.3.0-canary.77+, **update immediately. Run the automated tool or manually upgrade to patched versions. There is no workaround — upgrading is the only safe option.