---
title: "CVE-2025-66478: Critical Next.js RCE Vulnerability"
description: "Critical vulnerability in React Server Components allowing remote code execution. Immediate update required."
date: 2024-12-04
author: DjangoCFG Team
tags: [security, nextjs, critical]
---

import { Callout, Steps } from 'nextra/components'

# CVE-2025-66478: Critical Next.js RCE Vulnerability

<Callout type="error">
**CVSS Score: 10.0 (Critical)** — Remote Code Execution vulnerability in React Server Components protocol.
</Callout>

**Published:** December 4, 2024
**Affected:** Next.js 15.x, 16.x, and 14.3.0-canary.77+
**Fixed in:** 15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, **15.5.7**, 16.0.7

## Summary

A critical vulnerability has been identified in the React Server Components (RSC) protocol. The issue allows remote code execution when processing attacker-controlled requests in unpatched environments.

This vulnerability originates in the upstream React implementation (CVE-2025-55182). This advisory tracks the downstream impact on Next.js applications using the App Router.

## Impact

The vulnerable RSC protocol allowed untrusted inputs to influence server-side execution behavior. Under specific conditions, an attacker could craft requests that trigger unintended server execution paths, resulting in **remote code execution**.

## Affected Versions

| Status | Versions |
|--------|----------|
| **Affected** | Next.js 15.x, 16.x |
| **Affected** | Next.js 14.3.0-canary.77 and later canary releases |
| **Not Affected** | Next.js 13.x, Next.js 14.x stable |
| **Not Affected** | Pages Router applications |
| **Not Affected** | Edge Runtime |

## Required Action

<Steps>
### Check your Next.js version

```bash
npm list next
# or
pnpm list next
```

### Update to the patched version

```bash
# For 15.5.x
npm install next@15.5.7

# For other versions
npm install next@15.0.5   # for 15.0.x
npm install next@15.1.9   # for 15.1.x
npm install next@15.2.6   # for 15.2.x
npm install next@15.3.6   # for 15.3.x
npm install next@15.4.8   # for 15.4.x
npm install next@16.0.7   # for 16.0.x
```

### For canary 14.x users

Downgrade to the latest stable 14.x release:

```bash
npm install next@14
```

### Rebuild and redeploy

```bash
npm run build
# Deploy to your hosting provider
```
</Steps>

<Callout type="warning">
There is **no configuration option** to disable the vulnerable code path. You must update to a patched version.
</Callout>

## DjangoCFG Packages Status

All `@djangocfg/*` packages have been updated to require Next.js 15.5.7+:

| Package | Status |
|---------|--------|
| `@djangocfg/nextjs` | Updated to ^15.5.7 |
| `@djangocfg/ui` | Updated to ^15.5.7 |
| `@djangocfg/layouts` | Compatible (>=15.0.0) |
| `@djangocfg/playground` | Updated to ^15.5.7 |

Update your packages:

```bash
pnpm update @djangocfg/nextjs @djangocfg/ui @djangocfg/playground
```

## References

- [Next.js Security Advisory (CVE-2025-66478)](https://nextjs.org/blog/CVE-2025-66478)
- [React Security Advisory (CVE-2025-55182)](https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components)
- [Next.js Upgrade Guide](https://nextjs.org/docs/app/guides/upgrading)

## Timeline

| Date | Event |
|------|-------|
| Dec 4, 2024 | Vulnerability disclosed |
| Dec 4, 2024 | Patched versions released |
| Dec 4, 2024 | DjangoCFG packages updated |

---

*Thank you to Lachlan Davidson for discovering and responsibly disclosing this vulnerability.*
