Two additional vulnerabilities have been identified in the React Server Components (RSC) protocol. These issues were discovered while security researchers examined the patches for React2Shell . Importantly, neither of these new issues allow for Remote Code Execution. The patch for React2Shell remains fully effective.
These vulnerabilities originate in the upstream React implementation ( CVE-2025-55183 , CVE-2025-55184 ). This advisory tracks the downstream impact on Next.js applications using the App Router. For full details, see the React blog post .
Addendum: The initial fix for CVE-2025-55184 was incomplete. A complete fix has been issued under CVE-2025-67779 . If you previously upgraded to one of the initially recommended versions, please upgrade again to the latest patched versions listed below.
This is an excerpt. The full article is published by Next.js Blog.
Continue reading at Next.js Blog