Next.js is vulnerable to RCE in React flight protocol
Affected releases · next
- 16.x16.0.0 – 16.0.6Fixed in 16.0.7
- 15.x15.0.0 – 15.5.6Fixed in 15.5.7
On 16.x, the newest line:
npm install next@16.0.7Affected
16.0.0 – 16.0.6
7 releases
Fixed
16.0.7 – 16.4.2
38 releases, latest
Affected
15.0.0 – 15.0.4
5 releases
Fixed
15.0.5 – 15.0.8
4 releases
Affected
15.1.0 – 15.1.8
9 releases
Fixed
15.1.9 – 15.1.12
4 releases
Affected
15.2.0 – 15.2.5
6 releases
Fixed
15.2.6 – 15.2.9
4 releases
Affected
15.3.0 – 15.3.5
6 releases
Fixed
15.3.6 – 15.3.9
4 releases
Affected
15.4.0 – 15.4.7
8 releases
Fixed
15.4.8 – 15.4.11
4 releases
Affected
15.5.0 – 15.5.6
7 releases
Fixed
15.5.7 – 15.5.28
21 releases
Is your project affected?
Paste your package.json, or type the range you declare for next. It is read in your browser and sent nowhere.
What happens
A vulnerability affects certain React packages1 for versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 and frameworks that use the affected packages, including Next.js 15.x and 16.x using the App Router. The issue is tracked upstream as CVE-2025-55182.
Fixed in: React: 19.0.1, 19.1.2, 19.2.1 Next.js: 15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7, 16.0.7, 15.6.0-canary.58, 16.1.0-canary.12+
The vulnerability also affects experimental canary releases starting with 14.3.0-canary.77. Users on any of the 14.3 canary builds should either downgrade to a 14.x stable release or 14.3.0-canary.76.
All users of stable 15.x or 16.x Next.js versions should upgrade to a patched, stable version immediately.
1 The affected React packages are:
react-server-dom-parcel
react-server-dom-turbopack
react-server-dom-webpack