{"id":"CVE-2025-66478","aliases":["CLSA-2026-1775521836","CLSA-2026-1792195728","CLSA-2026-1792196724","CLSA-2026-1792206288","CLSA-2026-1792256963","CLSA-2026-1792272227","CLSA-2026-1792293002","CLSA-2026-1792304718","CLSA-2026-1792326294","CLSA-2026-1792338229","CLSA-2026-1792346468","CLSA-2026-1792358586","CLSA-2026-1792363987","CLSA-2026-1792367389","EUVD-2025-200984","GHSA-9qr9-h5gf-34mp"],"status":"rejected","title":"Next.js is vulnerable to RCE in React flight protocol","description":"This CVE is a duplicate of CVE-2025-55182.","severity":{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-502"],"published":"2025-12-03T18:15:47.2Z","modified":"2026-11-09T19:10:00Z","exploits":[{"source":"pocgithub","id":"Saied25/fix-react2shell-next","title":"Saied25/fix-react2shell-next","date":"2025-10-01","url":"https://github.com/Saied25/fix-react2shell-next"},{"source":"pocgithub","id":"abtonc/next-cve-2025-66478","title":"abtonc/next-cve-2025-66478","date":"2025-12-03","url":"https://github.com/abtonc/next-cve-2025-66478"},{"source":"metasploit","id":"exploit/multi/http/react2shell_unauth_rce_cve_2025_55182","title":"Unauthenticated RCE in React Server Components (React2Shell)","type":"exploit","platform":"Linux,Unix,Windows","date":"2025-12-03","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/multi/http/react2shell_unauth_rce_cve_2025_55182"},{"source":"pocgithub","id":"Malayke/Next.js-RSC-RCE-Scanner-CVE-2025-66478","title":"Malayke/Next.js-RSC-RCE-Scanner-CVE-2025-66478","date":"2025-12-04","url":"https://github.com/Malayke/Next.js-RSC-RCE-Scanner-CVE-2025-66478"},{"source":"pocgithub","id":"wangxso/CVE-2025-66478-POC","title":"wangxso/CVE-2025-66478-POC","date":"2025-12-04","url":"https://github.com/wangxso/CVE-2025-66478-POC"},{"source":"pocgithub","id":"hackersatyamrastogi/react2shell-ultimate","title":"hackersatyamrastogi/react2shell-ultimate","date":"2025-12-05","url":"https://github.com/hackersatyamrastogi/react2shell-ultimate"},{"source":"pocgithub","id":"aiexz/CVE-2025-66478-kinda-waf","title":"aiexz/CVE-2025-66478-kinda-waf","date":"2025-12-06","url":"https://github.com/aiexz/CVE-2025-66478-kinda-waf"},{"source":"pocgithub","id":"namest504/CVE-2025-66478-Exploit-Poc","title":"namest504/CVE-2025-66478-Exploit-Poc","date":"2025-12-06","url":"https://github.com/namest504/CVE-2025-66478-Exploit-Poc"},{"source":"pocgithub","id":"vercel-labs/fix-react2shell-next","title":"vercel-labs/fix-react2shell-next","date":"2025-12-06","url":"https://github.com/vercel-labs/fix-react2shell-next"},{"source":"pocgithub","id":"Jibaru/CVE-2025-66478-github-patcher","title":"Jibaru/CVE-2025-66478-github-patcher","date":"2025-12-07","url":"https://github.com/Jibaru/CVE-2025-66478-github-patcher"},{"source":"pocgithub","id":"Rhyru9/CVE-2025-66478","title":"Rhyru9/CVE-2025-66478","date":"2025-12-07","url":"https://github.com/Rhyru9/CVE-2025-66478"},{"source":"pocgithub","id":"ExpTechTW/CVE-2025-66478","title":"ExpTechTW/CVE-2025-66478","date":"2025-12-08","url":"https://github.com/ExpTechTW/CVE-2025-66478"},{"source":"pocgithub","id":"Letalandroid/cve-2025-66478_rce_vulnerable","title":"Letalandroid/cve-2025-66478_rce_vulnerable","date":"2025-12-08","url":"https://github.com/Letalandroid/cve-2025-66478_rce_vulnerable"},{"source":"pocgithub","id":"abhirajranjan/cve-2025-66478","title":"abhirajranjan/cve-2025-66478","date":"2025-12-08","url":"https://github.com/abhirajranjan/cve-2025-66478"},{"source":"pocgithub","id":"strainxx/react2shell-honeypot","title":"strainxx/react2shell-honeypot","date":"2025-12-08","url":"https://github.com/strainxx/react2shell-honeypot"},{"source":"pocgithub","id":"Code42Cate/nexts-cve-2025-66478-exploit","title":"Code42Cate/nexts-cve-2025-66478-exploit","date":"2025-12-11","url":"https://github.com/Code42Cate/nexts-cve-2025-66478-exploit"},{"source":"pocgithub","id":"changgun-lee/Next.js-RSC-RCE-Scanner-CVE-2025-66478","title":"changgun-lee/Next.js-RSC-RCE-Scanner-CVE-2025-66478","date":"2025-12-11","url":"https://github.com/changgun-lee/Next.js-RSC-RCE-Scanner-CVE-2025-66478"},{"source":"pocgithub","id":"abdozkaya/rsc-security-auditor","title":"abdozkaya/rsc-security-auditor","date":"2025-12-12","url":"https://github.com/abdozkaya/rsc-security-auditor"},{"source":"pocgithub","id":"viperh/poc-cve-next","title":"viperh/poc-cve-next","date":"2025-12-12","url":"https://github.com/viperh/poc-cve-next"},{"source":"pocgithub","id":"DavionGowie/-vercel-application-is-vulnerable-to-CVE-2025-66478.","title":"DavionGowie/-vercel-application-is-vulnerable-to-CVE-2025-66478.","date":"2025-12-14","url":"https://github.com/DavionGowie/-vercel-application-is-vulnerable-to-CVE-2025-66478."},{"source":"pocgithub","id":"DavionGowie/-vercel-prod.yml-application-is-vulnerable-to-CVE-2025-66478.","title":"DavionGowie/-vercel-prod.yml-application-is-vulnerable-to-CVE-2025-66478.","date":"2025-12-14","url":"https://github.com/DavionGowie/-vercel-prod.yml-application-is-vulnerable-to-CVE-2025-66478."},{"source":"pocgithub","id":"zhixiangyao/CVE-2025-66478-Exploit-PoC","title":"zhixiangyao/CVE-2025-66478-Exploit-PoC","date":"2025-12-15","url":"https://github.com/zhixiangyao/CVE-2025-66478-Exploit-PoC"},{"source":"pocgithub","id":"khadafigans/React2Shell","title":"khadafigans/React2Shell","date":"2025-12-30","url":"https://github.com/khadafigans/React2Shell"},{"source":"pocgithub","id":"Z3ROROOT3R/CVE-2025-66478","title":"Z3ROROOT3R/CVE-2025-66478","date":"2025-12-31","url":"https://github.com/Z3ROROOT3R/CVE-2025-66478"},{"source":"pocgithub","id":"imad457/NextJS-RCE-Root-Takeover","title":"imad457/NextJS-RCE-Root-Takeover","date":"2026-01-05","url":"https://github.com/imad457/NextJS-RCE-Root-Takeover"},{"source":"pocgithub","id":"JotaEspig/CVE-2025-66478-PoC-Reverse-Shell","title":"JotaEspig/CVE-2025-66478-PoC-Reverse-Shell","date":"2026-08-30","url":"https://github.com/JotaEspig/CVE-2025-66478-PoC-Reverse-Shell"}],"fixes":[{"ecosystem":"npm","package":"next","fixed_in":["15.0.5","15.2.6","15.3.6","15.4.8","16.0.7","15.1.9","15.5.7"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"create-next-app","fixed_in":["16.0.6-tuxcare.3"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@next/eslint-plugin-next","fixed_in":["16.0.6-tuxcare.3"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@next/bundle-analyzer","fixed_in":["16.0.6-tuxcare.3"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"next-rspack","fixed_in":["16.0.6-tuxcare.3"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@next/plugin-storybook","fixed_in":["16.0.6-tuxcare.3"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@next/polyfill-module","fixed_in":["16.0.6-tuxcare.3"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@next/polyfill-nomodule","fixed_in":["16.0.6-tuxcare.3"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@next/react-refresh-utils","fixed_in":["16.0.6-tuxcare.3"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@next/third-parties","fixed_in":["16.0.6-tuxcare.3"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@next/swc-linux-x64-gnu","fixed_in":["16.0.6-tuxcare.3"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@next/codemod","fixed_in":["16.0.6-tuxcare.3"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@next/mdx","fixed_in":["16.0.6-tuxcare.3"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@next/swc-linux-arm64-gnu","fixed_in":["16.0.6-tuxcare.3"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14.3.0-canary.77"},{"fixed":"15.0.5"}]}]},{"source":"ghsa","ecosystem":"npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.2.0-canary.0"},{"fixed":"15.2.6"}]}]},{"source":"ghsa","ecosystem":"npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.3.0-canary.0"},{"fixed":"15.3.6"}]}]},{"source":"ghsa","ecosystem":"npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.4.0-canary.0"},{"fixed":"15.4.8"}]}]},{"source":"ghsa","ecosystem":"npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.0-canary.0"},{"fixed":"16.0.7"}]}]},{"source":"ghsa","ecosystem":"npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.1.0-canary.0"},{"fixed":"15.1.9"}]}]},{"source":"ghsa","ecosystem":"npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.5.0-canary.0"},{"fixed":"15.5.7"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"create-next-app","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.6-tuxcare.0"},{"fixed":"16.0.6-tuxcare.3"}]}],"versions":["16.0.6"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/eslint-plugin-next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.6-tuxcare.0"},{"fixed":"16.0.6-tuxcare.3"}]}],"versions":["16.0.6"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/bundle-analyzer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.6-tuxcare.0"},{"fixed":"16.0.6-tuxcare.3"}]}],"versions":["16.0.6"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"next-rspack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.6-tuxcare.0"},{"fixed":"16.0.6-tuxcare.3"}]}],"versions":["16.0.6"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/plugin-storybook","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.6-tuxcare.0"},{"fixed":"16.0.6-tuxcare.3"}]}],"versions":["16.0.6"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/polyfill-module","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.6-tuxcare.0"},{"fixed":"16.0.6-tuxcare.3"}]}],"versions":["16.0.6"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/polyfill-nomodule","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.6-tuxcare.0"},{"fixed":"16.0.6-tuxcare.3"}]}],"versions":["16.0.6"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/react-refresh-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.6-tuxcare.0"},{"fixed":"16.0.6-tuxcare.3"}]}],"versions":["16.0.6"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/third-parties","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.6-tuxcare.0"},{"fixed":"16.0.6-tuxcare.3"}]}],"versions":["16.0.6"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/swc-linux-x64-gnu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.6-tuxcare.0"},{"fixed":"16.0.6-tuxcare.3"}]}],"versions":["16.0.6"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/codemod","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.6-tuxcare.0"},{"fixed":"16.0.6-tuxcare.3"}]}],"versions":["16.0.6"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/mdx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.6-tuxcare.0"},{"fixed":"16.0.6-tuxcare.3"}]}],"versions":["16.0.6"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/swc-linux-arm64-gnu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.6-tuxcare.0"},{"fixed":"16.0.6-tuxcare.3"}]}],"versions":["16.0.6"]},{"source":"osv","ecosystem":"npm","package":"next","ranges":[{"type":"SEMVER","events":[{"introduced":"14.3.0-canary.77"},{"fixed":"15.0.5"}]}]},{"source":"osv","ecosystem":"npm","package":"next","ranges":[{"type":"SEMVER","events":[{"introduced":"15.1.0-canary.0"},{"fixed":"15.1.9"}]}]},{"source":"osv","ecosystem":"npm","package":"next","ranges":[{"type":"SEMVER","events":[{"introduced":"15.2.0-canary.0"},{"fixed":"15.2.6"}]}]},{"source":"osv","ecosystem":"npm","package":"next","ranges":[{"type":"SEMVER","events":[{"introduced":"15.3.0-canary.0"},{"fixed":"15.3.6"}]}]},{"source":"osv","ecosystem":"npm","package":"next","ranges":[{"type":"SEMVER","events":[{"introduced":"15.4.0-canary.0"},{"fixed":"15.4.8"}]}]},{"source":"osv","ecosystem":"npm","package":"next","ranges":[{"type":"SEMVER","events":[{"introduced":"15.5.0-canary.0"},{"fixed":"15.5.7"}]}]},{"source":"osv","ecosystem":"npm","package":"next","ranges":[{"type":"SEMVER","events":[{"introduced":"16.0.0-canary.0"},{"fixed":"16.0.7"}]}]}],"references":[{"url":"https://github.com/vercel/next.js/security/advisories/GHSA-9qr9-h5gf-34mp","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-66478"},{"url":"https://github.com/vercel/next.js","tags":["package"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-55182","tags":["advisory"]},{"url":"https://github.com/facebook/react/security/advisories/GHSA-fv66-9v8q-g76r","tags":["web"]},{"url":"https://github.com/vitejs/vite-plugin-react/security/advisories/GHSA-fmh4-wr37-44fp","tags":["web"]},{"url":"https://github.com/advisories/GHSA-9qr9-h5gf-34mp"}],"sources":{"cve":[{"id":"CVE-2025-66478","description":"This CVE is a duplicate of CVE-2025-55182.","status":"rejected","modified":"2025-12-03T18:04:08.459Z","updated_at":"2026-11-02T14:32:53.157279Z"}],"euvd":[{"id":"EUVD-2025-200984","description":"Next.js is vulnerable to RCE in React flight protocol","status":"published","published":"2025-12-03T19:07:11Z","modified":"2025-12-11T19:31:04Z","updated_at":"2026-11-02T19:49:06.185947Z"}],"ghsa":[{"id":"GHSA-9qr9-h5gf-34mp","title":"Next.js is vulnerable to RCE in React flight protocol","description":"A vulnerability affects certain React packages\u003csup\u003e1\u003c/sup\u003e for versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 and frameworks that use the affected packages, including Next.js 15.x and 16.x using the App Router. The issue is tracked upstream as [CVE-2025-55182](https://www.cve.org/CVERecord?id=CVE-2025-55182). \n\nFixed in:\nReact: 19.0.1, 19.1.2, 19.2.1\nNext.js: 15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7, 16.0.7, 15.6.0-canary.58, 16.1.0-canary.12+\n\nThe vulnerability also affects experimental canary releases starting with 14.3.0-canary.77. Users on any of the 14.3 canary builds should either downgrade to a 14.x stable release or 14.3.0-canary.76.\n\nAll users of stable 15.x or 16.x Next.js versions should upgrade to a patched, stable version immediately.\n\n\u003csup\u003e1\u003c/sup\u003e The affected React packages are:\n- react-server-dom-parcel\n- react-server-dom-turbopack\n- react-server-dom-webpack","status":"published","published":"2025-12-03T19:07:11Z","modified":"2025-12-11T19:31:08Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:39:12.222121Z"}],"nvd":[{"id":"CVE-2025-66478","description":"Rejected reason: This CVE is a duplicate of CVE-2025-55182.","status":"rejected","published":"2025-12-03T18:15:47.2Z","modified":"2026-11-09T19:10:00.163Z","updated_at":"2026-11-09T22:15:49.627752Z"}],"osv":[{"id":"GHSA-9qr9-h5gf-34mp","title":"Next.js is vulnerable to RCE in React flight protocol","description":"A vulnerability affects certain React packages\u003csup\u003e1\u003c/sup\u003e for versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 and frameworks that use the affected packages, including Next.js 15.x and 16.x using the App Router. The issue is tracked upstream as [CVE-2025-55182](https://www.cve.org/CVERecord?id=CVE-2025-55182). \n\nFixed in:\nReact: 19.0.1, 19.1.2, 19.2.1\nNext.js: 15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7, 16.0.7, 15.6.0-canary.58, 16.1.0-canary.12+\n\nThe vulnerability also affects experimental canary releases starting with 14.3.0-canary.77. Users on any of the 14.3 canary builds should either downgrade to a 14.x stable release or 14.3.0-canary.76.\n\nAll users of stable 15.x or 16.x Next.js versions should upgrade to a patched, stable version immediately.\n\n\u003csup\u003e1\u003c/sup\u003e The affected React packages are:\n- react-server-dom-parcel\n- react-server-dom-turbopack\n- react-server-dom-webpack","status":"published","published":"2025-12-03T19:07:11Z","modified":"2026-09-10T03:50:31.796397588Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T15:46:44.225359Z"},{"id":"CLSA-2026-1775521836","title":"TuxCare security update for 22 packages (1 CVE)","description":"TuxCare rebuilt 22 packages to address 1 CVE. Fixed in 16.0.6-tuxcare.3.","status":"withdrawn","published":"2026-08-04T14:52:22Z","modified":"2026-10-26T13:21:31Z","updated_at":"2026-11-02T15:43:44.009773Z"},{"id":"CLSA-2026-1792195728","title":"TuxCare security update for create-next-app (1 CVE)","description":"TuxCare rebuilt create-next-app to address 1 CVE. Fixed in 16.0.6-tuxcare.3.","status":"published","published":"2026-10-17T00:08:44Z","modified":"2026-10-17T01:30:10.600826485Z","updated_at":"2026-11-02T15:43:51.747192Z"},{"id":"CLSA-2026-1792196724","title":"TuxCare security update for @next/eslint-plugin-next (1 CVE)","description":"TuxCare rebuilt @next/eslint-plugin-next to address 1 CVE. Fixed in 16.0.6-tuxcare.3.","status":"published","published":"2026-10-17T00:25:22Z","modified":"2026-10-17T01:30:11.753016876Z","updated_at":"2026-11-02T15:43:51.747192Z"},{"id":"CLSA-2026-1792206288","title":"TuxCare security update for @next/bundle-analyzer (1 CVE)","description":"TuxCare rebuilt @next/bundle-analyzer to address 1 CVE. Fixed in 16.0.6-tuxcare.3.","status":"published","published":"2026-10-17T03:04:46Z","modified":"2026-10-17T07:00:39.594138292Z","updated_at":"2026-11-02T15:43:51.747192Z"},{"id":"CLSA-2026-1792256963","title":"TuxCare security update for next-rspack (1 CVE)","description":"TuxCare rebuilt next-rspack to address 1 CVE. Fixed in 16.0.6-tuxcare.3.","status":"published","published":"2026-10-17T17:09:19Z","modified":"2026-10-17T19:01:45.477681723Z","updated_at":"2026-11-02T15:43:52.288832Z"},{"id":"CLSA-2026-1792272227","title":"TuxCare security update for @next/plugin-storybook (1 CVE)","description":"TuxCare rebuilt @next/plugin-storybook to address 1 CVE. Fixed in 16.0.6-tuxcare.3.","status":"published","published":"2026-10-17T21:23:45Z","modified":"2026-10-18T01:30:33.788185102Z","updated_at":"2026-11-02T15:43:52.288832Z"},{"id":"CLSA-2026-1792293002","title":"TuxCare security update for @next/polyfill-module (1 CVE)","description":"TuxCare rebuilt @next/polyfill-module to address 1 CVE. Fixed in 16.0.6-tuxcare.3.","status":"published","published":"2026-10-18T03:09:58Z","modified":"2026-10-18T07:15:11.898875498Z","updated_at":"2026-11-02T15:43:52.288832Z"},{"id":"CLSA-2026-1792304718","title":"TuxCare security update for @next/polyfill-nomodule (1 CVE)","description":"TuxCare rebuilt @next/polyfill-nomodule to address 1 CVE. Fixed in 16.0.6-tuxcare.3.","status":"published","published":"2026-10-18T06:25:16Z","modified":"2026-10-18T07:15:16.405257177Z","updated_at":"2026-11-02T15:43:52.545698Z"},{"id":"CLSA-2026-1792326294","title":"TuxCare security update for @next/react-refresh-utils (1 CVE)","description":"TuxCare rebuilt @next/react-refresh-utils to address 1 CVE. Fixed in 16.0.6-tuxcare.3.","status":"published","published":"2026-10-18T12:24:51Z","modified":"2026-10-18T13:15:57.13562631Z","updated_at":"2026-11-02T15:43:52.545698Z"},{"id":"CLSA-2026-1792338229","title":"TuxCare security update for @next/third-parties (1 CVE)","description":"TuxCare rebuilt @next/third-parties to address 1 CVE. Fixed in 16.0.6-tuxcare.3.","status":"published","published":"2026-10-18T15:43:45Z","modified":"2026-10-18T19:15:40.948318178Z","updated_at":"2026-11-02T15:43:52.545698Z"},{"id":"CLSA-2026-1792346468","title":"TuxCare security update for @next/swc-linux-x64-gnu (1 CVE)","description":"TuxCare rebuilt @next/swc-linux-x64-gnu to address 1 CVE. Fixed in 16.0.6-tuxcare.3.","status":"published","published":"2026-10-18T18:01:08Z","modified":"2026-10-18T19:16:08.321664453Z","updated_at":"2026-11-02T15:43:52.782414Z"},{"id":"CLSA-2026-1792358586","title":"TuxCare security update for @next/codemod (1 CVE)","description":"TuxCare rebuilt @next/codemod to address 1 CVE. Fixed in 16.0.6-tuxcare.3.","status":"published","published":"2026-10-18T21:23:04Z","modified":"2026-10-19T07:46:04.54564732Z","updated_at":"2026-11-02T15:43:53.071325Z"},{"id":"CLSA-2026-1792363987","title":"TuxCare security update for @next/mdx (1 CVE)","description":"TuxCare rebuilt @next/mdx to address 1 CVE. Fixed in 16.0.6-tuxcare.3.","status":"published","published":"2026-10-18T22:53:03Z","modified":"2026-10-19T07:46:05.848448208Z","updated_at":"2026-11-02T15:43:53.071325Z"},{"id":"CLSA-2026-1792367389","title":"TuxCare security update for @next/swc-linux-arm64-gnu (1 CVE)","description":"TuxCare rebuilt @next/swc-linux-arm64-gnu to address 1 CVE. Fixed in 16.0.6-tuxcare.3.","status":"published","published":"2026-10-18T23:49:49Z","modified":"2026-10-19T07:46:31.601327731Z","updated_at":"2026-11-02T15:43:53.353888Z"}]}}