Skip to content
Mustafa Yalçın
All posts
2 min read

Critical Next.js Vulnerability: What You Need to Know

A serious security flaw in Next.js App Router allows attackers to execute code on your server. Here is what happened and how to fix it.

A serious security flaw was found in Next.js that could let attackers run code on your server. Here's what happened and how to protect your application.

What's the Problem?

The vulnerability exists in React Server Components, the technology that powers Next.js App Router. An attacker can send specially crafted requests to your server and potentially execute their own code.

Severity: Maximum (CVSS 10.0/10.0)

Am I Affected?

Check if you're using:

  • ❌ Next.js 15.x (any version)
  • ❌ Next.js 16.x (any version)
  • ❌ Next.js 14.3.0-canary.77 or newer canary versions

You're safe if:

  • ✅ Using Next.js 13.x
  • ✅ Using Next.js 14.x stable (not canary)
  • ✅ Using only Pages Router (not App Router)

How to Fix It

Step 1: Check Your Version

bash
npm list next

Step 2: Update to the Patched Version

Find your version below and run the corresponding command:

bash
# If you're on 15.0.x
npm install next@15.0.5
 
# If you're on 15.1.x
npm install next@15.1.9
 
# If you're on 15.2.x
npm install next@15.2.6
 
# If you're on 15.3.x
npm install next@15.3.6
 
# If you're on 15.4.x
npm install next@15.4.8
 
# If you're on 15.5.x
npm install next@15.5.7
 
# If you're on 16.0.x
npm install next@16.0.7

Step 3: Special Case - Canary Users

If you're on Next.js 14.3.0-canary or later canary versions, go back to stable:

bash
npm install next@14

Step 4: Restart Your Application

bash
# Kill your dev server and restart
npm run dev
 
# Or rebuild and redeploy production
npm run build

Why This Happened

The issue originates from React itself (CVE-2025-55182), not Next.js directly. Since Next.js uses React Server Components, it inherited this vulnerability.

Two CVEs to know:

  • CVE-2025-55182: The original React vulnerability
  • CVE-2025-66478: The Next.js-specific advisory (this one)

Timeline

  • Discovery: Security researcher Lachlan Davidson found the flaw
  • Report: Responsibly disclosed to the Next.js team
  • Fix: Patched versions released
  • Now: Public disclosure so everyone can update

Can I Work Around This?

No. There's no configuration setting to disable the vulnerable code. You must update Next.js.

Verification After Update

After updating, verify you're protected:

bash
# Check your Next.js version
npm list next
 
# Should show one of the patched versions:
# 15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7, or 16.0.7

Questions & Answers

Q: How urgent is this?
A: Update today.

Q: Will updating break my app?
A: These are patch releases - no breaking changes expected.

Q: How do I know if I've been compromised?
A: Check server logs for unusual requests. Look for unexpected process execution or file modifications.

Learn More

Key Takeaways

  1. Update immediately - This is maximum severity
  2. No workaround exists - You must update Next.js
  3. Check all your projects - Not just your main application
  4. Verify the fix - Confirm you're running a patched version
  5. Stay informed - Follow Next.js security advisories