Open-source package vulnerability · npm

GHSA-9qr9-h5gf-34mp: Next.js is vulnerable to RCE in React flight protocol

criticalCVSS 3.1 10.0

A vulnerability affects certain React packages 1 for versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 and frameworks that use the affected packages, including Next.js 15.x and 16.x using the App Router. The issue is tracked upstream as CVE-2025-55182.

Published Dec 3, 2025 · Updated Dec 11, 2025

Affected packages

Ecosystem: npm
Affected: >= 14.3.0-canary.77, < 15.0.5
Fixed in: 15.0.5
Check: npm ls next

Ecosystem: npm
Affected: >= 15.2.0-canary.0, < 15.2.6
Fixed in: 15.2.6
Check: npm ls next

Ecosystem: npm
Affected: >= 15.3.0-canary.0, < 15.3.6
Fixed in: 15.3.6
Check: npm ls next

Ecosystem: npm
Affected: >= 15.4.0-canary.0, < 15.4.8
Fixed in: 15.4.8
Check: npm ls next

Ecosystem: npm
Affected: >= 16.0.0-canary.0, < 16.0.7
Fixed in: 16.0.7
Check: npm ls next

Ecosystem: npm
Affected: >= 15.1.0-canary.0, < 15.1.9
Fixed in: 15.1.9
Check: npm ls next

Ecosystem: npm
Affected: >= 15.5.0-canary.0, < 15.5.7
Fixed in: 15.5.7
Check: npm ls next

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

A vulnerability affects certain React packages1 for versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 and frameworks that use the affected packages, including Next.js 15.x and 16.x using the App Router. The issue is tracked upstream as CVE-2025-55182.

Fixed in: React: 19.0.1, 19.1.2, 19.2.1 Next.js: 15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7, 16.0.7, 15.6.0-canary.58, 16.1.0-canary.12+

The vulnerability also affects experimental canary releases starting with 14.3.0-canary.77. Users on any of the 14.3 canary builds should either downgrade to a 14.x stable release or 14.3.0-canary.76.

All users of stable 15.x or 16.x Next.js versions should upgrade to a patched, stable version immediately.

1 The affected React packages are:

react-server-dom-parcel
react-server-dom-turbopack
react-server-dom-webpack

Credited to lachlan2k, bytera, larskaare, mswilson, conorfitch, tockn, yusuke-koyoshi, bottarocarlo, jcburgo.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More npm vulnerabilities

All npm entries