10

GHSA-9QR9-H5GF-34MP: next Npm

CVSS: 10.0v3.1CriticalPublished
Published 03-12-2025Last modified 10-09-2026
Open JSON

Vulnerability summary

GHSA-9QR9-H5GF-34MP is a critical (CVSS 10.0) vulnerability in next Npm.

Overall risk
70/100
0100
High · default modelHow is this calculated?
CVSS score
10.0/10
010
Critical · v3.1 (OSV · Npm), selected by version preference
EPSS score
Not scored
0%100%
No EPSS score yet
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 1 · Related 3
CVE-2025-66478CGA-3QRQ-JR55-42FVCGA-JM9H-35RG-MFFJCVE-2025-71389

Timeline

  1. 03-12-2025
    PublishedVulnerability first disclosed.
  2. 10-09-2026
    Last modifiedVulnerability information updated.

Description

Next.js is vulnerable to RCE in React flight protocol A vulnerability affects certain React packages<sup>1</sup> for versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 and frameworks that use the affected packages, including Next.js 15.x and 16.x using the App Router. The issue is tracked upstream as [CVE-2025-55182](https://www.cve.org/CVERecord?id=CVE-2025-55182). Fixed in: React: 19.0.1, 19.1.2, 19.2.1 Next.js: 15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7, 16.0.7, 15.6.0-canary.58, 16.1.0-canary.12+ The vulnerability also affects experimental canary releases starting with 14.3.0-canary.77. Users on any of the 14.3 canary builds should either downgrade to a 14.x stable release or 14.3.0-canary.76. All users of stable 15.x or 16.x Next.js versions should upgrade to a patched, stable version immediately. <sup>1</sup> The affected React packages are: - react-server-dom-parcel - react-server-dom-turbopack - react-server-dom-webpack

CVSS metrics

1 score · 1 source · 1 version

EPSS trend

No EPSS score has been published for this record yet.

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Npm1 product
  • next≥ 14.3.0-canary.77, < 15.0.5 | ≥ 15.1.0-canary.0, < 15.1.9 | ≥ 15.2.0-canary.0, < 15.2.6 | ≥ 15.3.0-canary.0, < 15.3.6 | ≥ 15.4.0-canary.0, < 15.4.8 | ≥ 15.5.0-canary.0, < 15.5.7 | ≥ 16.0.0-canary.0, < 16.0.7

1 vendor · 1 product

References

5 links