Critical Vulnerability in Next.js: What Happened, What’s the Risk, and How It Was Fixed

Overview

A recently disclosed critical security vulnerability in the React Server Components (RSC) “Flight” protocol has exposed many Next.js applications to the risk of unauthenticated remote code execution (RCE). The flaw is tracked as CVE-2025-55182 (React) and affects all frameworks that rely on RSC, including Next.js. Although a secondary CVE was assigned to Next.js, it was later marked as a duplicate—the root issue lies inside React’s RSC protocol implementation.

This vulnerability received a CVSS score of 10.0, the highest possible rating, reflecting its severity and ease of exploitation.

What Was the Problem?

The vulnerability stems from an insecure deserialization flaw in the RSC “Flight” protocol. When handling requests, the server processes serialized data transmitted from the client. Due to insufficient validation, an attacker can craft a malicious payload that triggers the execution of arbitrary code on the server.

Key points:

The flaw allows remote code execution without authentication.
It affects default Next.js configurations, meaning even standard projects created with create-next-app could be vulnerable.
Impacted versions include Next.js 15.x, 16.x, and specific canary builds starting from 14.3.0-canary.77.
Any framework or environment using React Server Components may also be susceptible.

Because RSC operates deep in the framework, developers may not realize their applications are exposed—even when no unsafe custom code exists.

Potential Impact & Risks

If exploited successfully, an attacker could:

Execute arbitrary commands on the server.
Read, modify, or delete application data.
Install backdoors, steal credentials, or pivot to other systems.
Fully compromise environments running public-facing Next.js applications.

Since no authentication is required, any server accessible over the internet is a potential target.

How the Issue Was Fixed

The React and Next.js maintainers released patches that harden the deserialization logic used in the RSC protocol. The fix ensures that untrusted payloads can no longer influence server-side execution.

To eliminate the vulnerability, developers must upgrade immediately to patched versions.

Patched Next.js Versions

Update to any of the following (or newer):

15.0.5
15.1.9
15.2.6
15.3.6
15.4.8
15.5.7
16.0.7

If you are using a vulnerable canary release (e.g., 14.3.0-canary.77 or later), downgrade to the latest stable 14.x version or upgrade to a patched release.

Temporary Mitigations (If You Cannot Patch Immediately)

Restrict public network access to your Next.js server.
Place applications behind authentication layers, reverse proxies, or firewalls.
Monitor servers for unusual processes, file changes, or suspicious traffic.
Rotate any credentials or secrets stored on or accessed by the server.

These measures reduce exposure but do not replace updating to a patched version.

Why This Vulnerability Matters

This is one of the most serious issues ever found in the React ecosystem because:

It affects the server runtime, not user code.
It impacts widely-used frameworks like Next.js.
It allows full server compromise with minimal attacker effort.
It affects default configurations used by millions of developers.

The incident highlights that even mature and popular frameworks can contain deeply embedded protocol-level flaws.

Conclusion

The RSC “Flight” protocol vulnerability (CVE-2025-55182) represents a major security event for React and Next.js. Due to the severity of the flaw—unauthenticated remote code execution—developers must update their applications immediately.

If you run a Next.js app using React Server Components or the App Router, upgrading to a patched version is essential. Until then, restrict access and monitor your server closely.

This event underscores the importance of rapid patching, secure deployment practices, and maintaining awareness of framework-level vulnerabilities.