December 06, 9:05 PM PST: If your application was online and unpatched as of December 4th, 2025 at 1:00 PM PT, we strongly encourage you to rotate any secrets it uses, starting with your most critical ones.
December 06, 7:29 AM PST: An npm package has been released to update affected Next.js apps. Use npx fix-react2shell-next to update now, or visit the GitHub repository to learn more.
A critical vulnerability has been identified in the React Server Components (RSC) protocol. The issue is rated CVSS 10.0 and can allow remote code execution when processing attacker-controlled requests in unpatched environments.
This vulnerability originates in the upstream React implementation ( CVE-2025-55182 ).
This is an excerpt. The full article is published by Next.js Blog.
Continue reading at Next.js Blog