CVE-2025-66478: Next.js Vulnerable to RCE in React Flight Protocol
Summary
CVE-2025-66478: Next.js is vulnerable to RCE in React flight protocol. Affects next across 7 version ranges.
>= 14.3.0-canary.77, < 15.0.5
>= 15.1.1-canary.0, < 15.1.9
>= 15.2.0-canary.0, < 15.2.6
>= 15.3.0-canary.0, < 15.3.6
>= 15.4.0-canary.0, < 15.4.8
>= 15.5.1-canary.0, < 15.5.7
>= 16.0.0-canary.0, < 16.0.7
Fixed in 7 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Next.js is a popular React framework that enables developers to build server-rendered React applications with ease. It provides features such as automatic code splitting, server-side rendering, and static site generation. However, certain versions of Next.js, specifically 15.x and 16.x, are vulnerable due to an issue in the underlying React packages, which can lead to remote code execution (RCE). This vulnerability affects applications using the App Router and can compromise the security of the application if not addressed promptly.
Vulnerability Detail
A critical vulnerability exists in specific versions of React packages (19.0.0, 19.1.0, 19.1.1, and 19.2.0) that are utilized by Next.js. This issue allows attackers to execute arbitrary code remotely, potentially leading to unauthorized access and manipulation of the application. The vulnerability is tracked as CVE-2025-55182 and has a CVSS score of 10.0, indicating a severe risk to affected systems. Users of Next.js 15.x and 16.x should be aware that this vulnerability also impacts experimental canary releases starting from version 14.3.0-canary.77.
How To Fix
Latest published version: 16.4.2 as of 22 Oct 2026
npm install next@16.4.2Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 14.3.0-canary.77, < 15.0.515.0.5npm install next@15.0.5 -
>= 15.1.1-canary.0, < 15.1.915.1.9npm install next@15.1.9 -
>= 15.2.0-canary.0, < 15.2.615.2.6npm install next@15.2.6 -
>= 15.3.0-canary.0, < 15.3.615.3.6npm install next@15.3.6 -
>= 15.4.0-canary.0, < 15.4.815.4.8npm install next@15.4.8 -
>= 15.5.1-canary.0, < 15.5.715.5.7npm install next@15.5.7
Show all 7 release lines
-
>= 16.0.0-canary.0, < 16.0.716.0.7npm install next@16.0.7
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If you are using any of the affected canary builds (14.3.0-canary.77 or later), it is recommended to downgrade to a stable release of 14.x or revert to 14.3.0-canary.76 until you can upgrade to a patched version.
Conclusion
The vulnerability CVE-2025-66478 poses a significant risk to applications using Next.js versions 15.x and 16.x due to remote code execution capabilities. It is crucial for developers to upgrade to the patched versions of Next.js and React to mitigate this risk. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for next →
FAQ
CVE-2025-66478 is a critical vulnerability in Next.js that allows for remote code execution due to issues in specific React packages.
Next.js versions 15.x and 16.x are affected, particularly when using the App Router.
You can use Vulert, which monitors open-source vulnerabilities in your software by analyzing package-lock.json. Visit Vulert Scanner to check your application without needing to sign up.
If immediate upgrading is not possible, consider downgrading to a stable version of Next.js or using the last known safe canary build.
The CVSS score for this vulnerability is 10.0, indicating a critical level of risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for next.
