Fix React Server Components RCE vulnerability - #88
Draft
vercel[bot] wants to merge 1 commit into
Draft
Conversation
Security Advisory Fix: React Flight / Next.js RCE Vulnerability (CVE-2025-55182) ## Summary Implemented security patches to address critical RCE vulnerability in React Server Components (CVE-2025-55182). The project uses Next.js, which was affected by this vulnerability. ## Changes Made ### Modified Files: 1. **package.json** - Upgraded `next` from 15.5.3 → 15.5.7 (patched version for 15.5.x) - Upgraded `react` from 19.1.1 → 19.1.2 (patched version for affected 19.1.x) - Upgraded `react-dom` from 19.1.1 → 19.1.2 (patched version for affected 19.1.x) 2. **pnpm-lock.yaml** - Updated lockfile to resolve Next.js 15.5.7 - Updated all React dependencies to 19.1.2 throughout the dependency tree ## Vulnerability Details ### Affected Packages - Next.js 15.5.3 (project was using a vulnerable pre-release version) - React 19.1.1 (affected version per advisory) - react-dom 19.1.1 (affected version per advisory) ### Patched Versions - Next.js: 15.5.7 (as per official advisory) - React: 19.1.2 (as per official React security advisory) - react-dom: 19.1.2 (as per official React security advisory) ## Detection Results ✓ Project uses Next.js 15.x (affected) ✓ Project does NOT use react-server-dom-webpack, react-server-dom-parcel, or react-server-dom-turbopack ✓ Security patches were applied correctly ✓ Lockfile was updated successfully via `pnpm install` ✓ No additional manual patches or overrides needed ## Key Implementation Notes - This is a single-package.json project (not a monorepo) - No React Flight packages are used, so only standard React/react-dom updates were needed - Next.js automatically provides patched React versions, but the project had pinned versions that needed explicit updates - Used pnpm package manager for dependency resolution - All transitive dependencies correctly updated to use React 19.1.2 ## Security Impact These patches address a critical remote code execution (RCE) vulnerability in React Server Components that allows unauthenticated attackers to execute arbitrary code. The vulnerability affects: - React versions: 19.0.0, 19.1.0, 19.1.1, 19.2.0 - React Flight packages: react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack - Next.js versions >= 14.3.0-canary.77, all 15.x and 16.x ## Testing & Verification - Dependencies installed successfully via `pnpm install` - Lockfile resolves to exact patched versions - Pre-existing build errors are unrelated to these security patches Co-authored-by: Vercel <vercel[bot]@users.noreply.github.com>
Author
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Important
This is an automatic PR generated by Vercel to help you with patching efforts. We can't guarantee it's comprehensive, and it may contain mistakes. Please review our guidance before merging these changes.
A critical remote code execution (RCE) vulnerability in React Server Components, impacting frameworks such as Next.js, was identified in the project cockpit. The vulnerability enables unauthenticated RCE on the server via insecure deserialization in the React Flight protocol.
This issue is tracked under:
GitHub Security Advisory: GHSA-9qr9-h5gf-34mp
React Advisory: CVE-2025-55182
Next.js Advisory: CVE-2025-66478
This automated pull request upgrades the affected React and Next.js packages to patched versions that fully remediate the issue.
More Info | security@vercel.com