Every CVE Search/ Get API key

CVE-2025-66478

Next.js is vulnerable to RCE in React flight protocol

10.0 CriticalPublic exploitFix availableRejected

This CVE is a duplicate of CVE-2025-55182.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

What each source reports

GitHub Advisories Score usedGHSA-9qr9-h5gf-34mp 10.0

Next.js is vulnerable to RCE in React flight protocol

A vulnerability affects certain React packages<sup>1</sup> for versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 and frameworks that use the affected packages, including Next.js 15.x and 16.x using the App Router. The issue is tracked upstream as CVE-2025-55182.

Fixed in: React: 19.0.1, 19.1.2, 19.2.1 Next.js: 15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7, 16.0.7, 15.6.0-canary.58, 16.1.0-canary.12+

The vulnerability also affects experimental canary releases starting with 14.3.0-canary.77. Users on any of the 14.3 canary builds should either downgrade to a 14.x stable release or 14.3.0-canary.76.

All users of stable 15.x or 16.x Next.js versions should upgrade to a patched, stable version immediately.

<sup>1</sup> The affected React packages are:

  • react-server-dom-parcel
  • react-server-dom-turbopack
  • react-server-dom-webpack
Record
GHSA-9qr9-h5gf-34mp
CVSS 3.1
10.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness
CWE-502
Updated
2026-11-02
CVE List No score

This CVE is a duplicate of CVE-2025-55182.

Record
CVE-2025-66478
Updated
2026-11-02
EUVDEUVD-2025-200984 No score

Next.js is vulnerable to RCE in React flight protocol

Record
EUVD-2025-200984
Updated
2026-11-02
NVD No score

Rejected reason: This CVE is a duplicate of CVE-2025-55182.

Record
CVE-2025-66478
Updated
2026-11-02
OSVGHSA-9qr9-h5gf-34mp 10.0

Next.js is vulnerable to RCE in React flight protocol

A vulnerability affects certain React packages<sup>1</sup> for versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 and frameworks that use the affected packages, including Next.js 15.x and 16.x using the App Router. The issue is tracked upstream as CVE-2025-55182.

Fixed in: React: 19.0.1, 19.1.2, 19.2.1 Next.js: 15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7, 16.0.7, 15.6.0-canary.58, 16.1.0-canary.12+

The vulnerability also affects experimental canary releases starting with 14.3.0-canary.77. Users on any of the 14.3 canary builds should either downgrade to a 14.x stable release or 14.3.0-canary.76.

All users of stable 15.x or 16.x Next.js versions should upgrade to a patched, stable version immediately.

<sup>1</sup> The affected React packages are:

  • react-server-dom-parcel
  • react-server-dom-turbopack
  • react-server-dom-webpack
Record
GHSA-9qr9-h5gf-34mp
CVSS 3.1
10.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness
CWE-502
Updated
2026-11-02
OSVCLSA-2026-1775521836 No score

TuxCare security update for 22 packages (1 CVE)

TuxCare rebuilt 22 packages to address 1 CVE. Fixed in 16.0.6-tuxcare.3.

Record
CLSA-2026-1775521836
Updated
2026-11-02
Show 13 moreShow less
OSVCLSA-2026-1792195728 No score

TuxCare security update for create-next-app (1 CVE)

TuxCare rebuilt create-next-app to address 1 CVE. Fixed in 16.0.6-tuxcare.3.

Record
CLSA-2026-1792195728
Updated
2026-11-02
OSVCLSA-2026-1792196724 No score

TuxCare security update for @next/eslint-plugin-next (1 CVE)

TuxCare rebuilt @next/eslint-plugin-next to address 1 CVE. Fixed in 16.0.6-tuxcare.3.

Record
CLSA-2026-1792196724
Updated
2026-11-02
OSVCLSA-2026-1792206288 No score

TuxCare security update for @next/bundle-analyzer (1 CVE)

TuxCare rebuilt @next/bundle-analyzer to address 1 CVE. Fixed in 16.0.6-tuxcare.3.

Record
CLSA-2026-1792206288
Updated
2026-11-02
OSVCLSA-2026-1792256963 No score

TuxCare security update for next-rspack (1 CVE)

TuxCare rebuilt next-rspack to address 1 CVE. Fixed in 16.0.6-tuxcare.3.

Record
CLSA-2026-1792256963
Updated
2026-11-02
OSVCLSA-2026-1792272227 No score

TuxCare security update for @next/plugin-storybook (1 CVE)

TuxCare rebuilt @next/plugin-storybook to address 1 CVE. Fixed in 16.0.6-tuxcare.3.

Record
CLSA-2026-1792272227
Updated
2026-11-02
OSVCLSA-2026-1792293002 No score

TuxCare security update for @next/polyfill-module (1 CVE)

TuxCare rebuilt @next/polyfill-module to address 1 CVE. Fixed in 16.0.6-tuxcare.3.

Record
CLSA-2026-1792293002
Updated
2026-11-02
OSVCLSA-2026-1792304718 No score

TuxCare security update for @next/polyfill-nomodule (1 CVE)

TuxCare rebuilt @next/polyfill-nomodule to address 1 CVE. Fixed in 16.0.6-tuxcare.3.

Record
CLSA-2026-1792304718
Updated
2026-11-02
OSVCLSA-2026-1792326294 No score

TuxCare security update for @next/react-refresh-utils (1 CVE)

TuxCare rebuilt @next/react-refresh-utils to address 1 CVE. Fixed in 16.0.6-tuxcare.3.

Record
CLSA-2026-1792326294
Updated
2026-11-02
OSVCLSA-2026-1792338229 No score

TuxCare security update for @next/third-parties (1 CVE)

TuxCare rebuilt @next/third-parties to address 1 CVE. Fixed in 16.0.6-tuxcare.3.

Record
CLSA-2026-1792338229
Updated
2026-11-02
OSVCLSA-2026-1792346468 No score

TuxCare security update for @next/swc-linux-x64-gnu (1 CVE)

TuxCare rebuilt @next/swc-linux-x64-gnu to address 1 CVE. Fixed in 16.0.6-tuxcare.3.

Record
CLSA-2026-1792346468
Updated
2026-11-02
OSVCLSA-2026-1792358586 No score

TuxCare security update for @next/codemod (1 CVE)

TuxCare rebuilt @next/codemod to address 1 CVE. Fixed in 16.0.6-tuxcare.3.

Record
CLSA-2026-1792358586
Updated
2026-11-02
OSVCLSA-2026-1792363987 No score

TuxCare security update for @next/mdx (1 CVE)

TuxCare rebuilt @next/mdx to address 1 CVE. Fixed in 16.0.6-tuxcare.3.

Record
CLSA-2026-1792363987
Updated
2026-11-02
OSVCLSA-2026-1792367389 No score

TuxCare security update for @next/swc-linux-arm64-gnu (1 CVE)

TuxCare rebuilt @next/swc-linux-arm64-gnu to address 1 CVE. Fixed in 16.0.6-tuxcare.3.

Record
CLSA-2026-1792367389
Updated
2026-11-02

Affected packages

Affected packages
PackageAffectedFixed
next
npm
 14.3.0-canary.77 up to 15.0.5
15.0.5
next
npm
 15.2.0-canary.0 up to 15.2.6
15.2.6
next
npm
 15.3.0-canary.0 up to 15.3.6
15.3.6
next
npm
 15.4.0-canary.0 up to 15.4.8
15.4.8
next
npm
 16.0.0-canary.0 up to 16.0.7
16.0.7
next
npm
 15.1.0-canary.0 up to 15.1.9
15.1.9
next
npm
 15.5.0-canary.0 up to 15.5.7
15.5.7
create-next-app
TuxCare:npm
 16.0.6-tuxcare.0 up to 16.0.6-tuxcare.3, plus listed versions
16.0.6
16.0.6-tuxcare.3
@next/eslint-plugin-next
TuxCare:npm
 16.0.6-tuxcare.0 up to 16.0.6-tuxcare.3, plus listed versions
16.0.6
16.0.6-tuxcare.3
@next/bundle-analyzer
TuxCare:npm
 16.0.6-tuxcare.0 up to 16.0.6-tuxcare.3, plus listed versions
16.0.6
16.0.6-tuxcare.3
Show 10 moreShow less
Affected packages
PackageAffectedFixed
next-rspack
TuxCare:npm
 16.0.6-tuxcare.0 up to 16.0.6-tuxcare.3, plus listed versions
16.0.6
16.0.6-tuxcare.3
@next/plugin-storybook
TuxCare:npm
 16.0.6-tuxcare.0 up to 16.0.6-tuxcare.3, plus listed versions
16.0.6
16.0.6-tuxcare.3
@next/polyfill-module
TuxCare:npm
 16.0.6-tuxcare.0 up to 16.0.6-tuxcare.3, plus listed versions
16.0.6
16.0.6-tuxcare.3
@next/polyfill-nomodule
TuxCare:npm
 16.0.6-tuxcare.0 up to 16.0.6-tuxcare.3, plus listed versions
16.0.6
16.0.6-tuxcare.3
@next/react-refresh-utils
TuxCare:npm
 16.0.6-tuxcare.0 up to 16.0.6-tuxcare.3, plus listed versions
16.0.6
16.0.6-tuxcare.3
@next/third-parties
TuxCare:npm
 16.0.6-tuxcare.0 up to 16.0.6-tuxcare.3, plus listed versions
16.0.6
16.0.6-tuxcare.3
@next/swc-linux-x64-gnu
TuxCare:npm
 16.0.6-tuxcare.0 up to 16.0.6-tuxcare.3, plus listed versions
16.0.6
16.0.6-tuxcare.3
@next/codemod
TuxCare:npm
 16.0.6-tuxcare.0 up to 16.0.6-tuxcare.3, plus listed versions
16.0.6
16.0.6-tuxcare.3
@next/mdx
TuxCare:npm
 16.0.6-tuxcare.0 up to 16.0.6-tuxcare.3, plus listed versions
16.0.6
16.0.6-tuxcare.3
@next/swc-linux-arm64-gnu
TuxCare:npm
 16.0.6-tuxcare.0 up to 16.0.6-tuxcare.3, plus listed versions
16.0.6
16.0.6-tuxcare.3

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubSaied25/fix-react2shell-next2025-10-01
PoC in GitHubabtonc/next-cve-2025-664782025-12-03
MetasploitUnauthenticated RCE in React Server Components (React2Shell)2025-12-03
PoC in GitHubMalayke/Next.js-RSC-RCE-Scanner-CVE-2025-664782025-12-04
PoC in GitHubwangxso/CVE-2025-66478-POC2025-12-04
PoC in GitHubhackersatyamrastogi/react2shell-ultimate2025-12-05
PoC in GitHubaiexz/CVE-2025-66478-kinda-waf2025-12-06
PoC in GitHubnamest504/CVE-2025-66478-Exploit-Poc2025-12-06
PoC in GitHubvercel-labs/fix-react2shell-next2025-12-06
PoC in GitHubJibaru/CVE-2025-66478-github-patcher2025-12-07
Show 16 moreShow less
Public exploits
SourceLinkDate
PoC in GitHubRhyru9/CVE-2025-664782025-12-07
PoC in GitHubExpTechTW/CVE-2025-664782025-12-08
PoC in GitHubLetalandroid/cve-2025-66478_rce_vulnerable2025-12-08
PoC in GitHubabhirajranjan/cve-2025-664782025-12-08
PoC in GitHubstrainxx/react2shell-honeypot2025-12-08
PoC in GitHubCode42Cate/nexts-cve-2025-66478-exploit2025-12-11
PoC in GitHubchanggun-lee/Next.js-RSC-RCE-Scanner-CVE-2025-664782025-12-11
PoC in GitHubabdozkaya/rsc-security-auditor2025-12-12
PoC in GitHubviperh/poc-cve-next2025-12-12
PoC in GitHubDavionGowie/-vercel-application-is-vulnerable-to-CVE-2025-66478.2025-12-14
PoC in GitHubDavionGowie/-vercel-prod.yml-application-is-vulnerable-to-CVE-2025-66478.2025-12-14
PoC in GitHubzhixiangyao/CVE-2025-66478-Exploit-PoC2025-12-15
PoC in GitHubkhadafigans/React2Shell2025-12-30
PoC in GitHubZ3ROROOT3R/CVE-2025-664782025-12-31
PoC in GitHubimad457/NextJS-RCE-Root-Takeover2026-01-05
PoC in GitHubJotaEspig/CVE-2025-66478-PoC-Reverse-Shell2026-08-30

History

History
RecordedChangedSources
exploits
affected
first indexedCVE List, EUVD, GitHub Advisories, Metasploit, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-66478 has been rejected by its source and should not be treated as a live vulnerability, published December 3, 2025. Public exploit code exists. Fixed in next 15.0.5.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open