Post by Uptycs MDR Team

Contributed by: Nandakumar KJ & Nageswra Rao C

Technical Details:

A critical vulnerability has been discovered in the React Server Components (RSC) 'Flight' protocol, impacting on the React 19 ecosystem and the frameworks built on top of it most notably Next.js. Tracked as CVE-2025-55182 for React and CVE-2025-66478 for Next.js, this vulnerability enables unauthenticated remote code execution (RCE) on the server due to insecure deserialization. Because the vulnerability is present in default configurations, typical deployments are exposed immediately. Given its critical nature and ease of exploitation, immediate patching is required.

CVE-2025-55182

CVE-2025-55182 is an insecure deserialization flaw within RSC. A remote, unauthenticated attacker could take advantage of the issue by sending a maliciously crafted payload to a susceptible React Server Function endpoint. If the attack succeeds, it could lead to remote code execution on the server.

CVE-2025-66478

CVE-2025-66478 is the RCE vulnerability in Next.js, which inherits the same underlying vulnerability through its implementation of the RSC "Flight" protocol.

Which products are affected?

Uptycs Coverage for these vulnerabilities:

We have coverage for these vulnerabilities CVE-2025-55182 and CVE-2025-66478. Please click on the Vulnerabilities section on the left pane and search (use the Addfilter option to add the filter for the specific CVE) for the CVE to identify the Vulnerable resources.

Additionally, using below SQL, you can list the affected packages and hosts.

SQL
select * from npm_packages where 
(name='next' and (version like '15.%' or version like '16.%' or version like '14.3.0-canary.%') and version not in ('15.0.5','15.1.9','15.2.6','15.3.6','15.4.8' ,'15.5.7','16.0.7','14.3.0-canary.88')) or (name in ('react-server-dom-parcel' , 'react-server-dom-webpack' ,'react-server-dom-turbopack') and version in ('19.0' , '19.1.0' , '19.1.1' , '19.2.0'))  and upt_day>=20251203

Mitigation Guidance:

1. Update React and its related packages to the secured versions listed above. This is the only reliable fix.
2. If you are using other RSC-enabled frameworks (Redwood, Waku, etc.), check their official channels for updates regarding the bundled react-server version and update immediately.

Reference:

• Critical Security Vulnerability in React Server Components (react.dev)
• Security Advisory: CVE-2025-66478 (NEXT.js)