Remote code execution in the React Flight protocol (React Server Components)
Original title: Next.js is vulnerable to RCE in React flight protocol
What happens
The flaw is in the React Server Components packages (react-server-dom-webpack, react-server-dom-turbopack, react-server-dom-parcel) versions 19.0.0, 19.1.0, 19.1.1 and 19.2.0, and in frameworks that use them, including Next.js 15.x and 16.x with the App Router. No authentication is needed. CVSS 10, the maximum.
Who is affected
- Next.js 15.x and 16.x using the App Router (an
app/directory). - Canary releases from
14.3.0-canary.77.
Affected and fixed versions
| Affected | Fixed in |
|---|---|
>= 14.3.0-canary.77, < 15.0.5 | 15.0.5 |
>= 15.2.0-canary.0, < 15.2.6 | 15.2.6 |
>= 15.3.0-canary.0, < 15.3.6 | 15.3.6 |
>= 15.4.0-canary.0, < 15.4.8 | 15.4.8 |
>= 16.0.0-canary.0, < 16.0.7 | 16.0.7 |
>= 15.1.0-canary.0, < 15.1.9 | 15.1.9 |
>= 15.5.0-canary.0, < 15.5.7 | 15.5.7 |
What to do
- Upgrade Next.js to the fixed version for your line in the table below. On the React side the fixes are 19.0.1, 19.1.2 and 19.2.1.
- On a 14.3 canary: go back to a stable 14.x release or
14.3.0-canary.76.
Check yourself
- Run
npm ls next react-server-dom-webpackand compare with the table below. - A project with an
app/directory uses the App Router.
Sources
- GitHub Advisory Database GHSA-9qr9-h5gf-34mp
- vercel/next.js GHSA-9qr9-h5gf-34mp
- facebook/react GHSA-fv66-9v8q-g76r
- NVD CVE-2025-55182
Rewritten from the original advisory; versions from the GitHub Advisory Database (CC-BY-4.0), updated 2026-10-29. Where they differ, the original advisory wins.