A major security flaw CVE-2025-66478 has turned up in some Next.js apps that use React Server Components (RSC) with the App Router. With a perfect CVSS score of 10.0, this one’s about as bad as it gets. If someone exploits it, they can run their own code right on your server.

This blog post explaining this does a good job: it breaks down what’s wrong, who’s at risk, and how to fix it. If you run a public-facing Next.js app in production, don’t wait. This really needs your attention right now.

1. What’s Going On Here?

CVE-2025-66478 is a Next.js vulnerability, but it actually starts with a problem in React itself CVE-2025-55182. The whole thing hinges on how React Server Components handle certain server-side requests.

In some situations, the RSC protocol lets outside input mess with what the server does. To put it plainly: an attacker can craft a sneaky request that makes your server execute code it should never touch.

If someone pulls this off, here’s what could happen:

• Attackers have the ability to execute arbitrary code on a server. 
• Unauthorized individuals may gain access to restricted areas of an application.
• Confidential information and environment variables might be exposed.  
• An attacker could take full control of the application.

This bug is deep within the framework, so regular protections like firewalls or input checks won’t help. The best solution is to upgrade to a version of Next.js that has the fix.

2. Who’s At Risk?

You’re affected if all of these are true:

• You use Next.js with the App Router
• React Server Components are enabled (they are by default with App Router)
• You’re running one of the following:
  – Next.js 15.x
  – Next.js 16.x
  – Next.js 14.3.0-canary.77 or any later canary
  – Your app was public and unpatched before December 4, 2025

This covers a lot of production sites anything running on a VPS, cloud service, or platforms like Vercel, Netlify, AWS, or Google Cloud. Same goes for SaaS dashboards, internal tools on the internet, or APIs built with App Router and server actions.

Who’s Safe
You’re in the clear if you use:

• – Next.js 13.x stable
• – Next.js 14.x stable (not canary)
• – The Pages Router instead of App Router
• – The Edge Runtime for everything

Not sure which router or version you’re on? Not every Next.js app is in trouble. It depends on the version you’re using and your setup. The following steps help you to check the Next.js version: 

If you wish to check from the CLI: 
Navigate to your project’s root directory in your terminal and run one of the following commands:

• npx next –version 
• npm list next (lists the installed next package and its version)

A much easier option is checking package.json file: 

• Open the package.json file in root directory of your project.
• Find “next” entry under the “dependencies” or “devDependencies” section.
• The value next to “next” is your installed version. 

3. How To Fix CVE-2025-66478

There is no quick solution available. You have to upgrade Next.js and redeploy your app.

Step 1: Upgrade

Install the right patched version for your release line:
npm install next@15.0.5 # for 15.0.x
npm install next@15.1.9 # for 15.1.x
npm install next@15.2.6 # for 15.2.x
npm install next@15.3.6 # for 15.3.x
npm install next@15.4.8 # for 15.4.x
npm install next@15.5.7 # for 15.5.x
npm install next@16.0.7 # for 16.0.x

For canary builds:

npm install next@15.6.0-canary.58
npm install next@16.1.0-canary.12

If you’re on Next.js 14 canary, downgrade to the latest stable 14.x:

npm install next@14

Step 2: Use the Official Fix Tool (Optional)

Next.js has an official tool that finds vulnerable versions, upgrades them for you, and makes mistakes less likely. To use it:

npx fix-react2shell-next

Handy for anyone running lots of repos.

Step 3: Rotate All Your Secrets

If your app was exposed before you implemented the patch, consider all your secrets compromised. Once you’ve upgraded and redeployed, be sure to follow these steps:

• Make sure to regularly rotate or update your API keys.
• Create new database credentials.  
• Update your OAuth secrets. 
• Please ensure that all tokens are correctly substituted in your environment variables for optimal functionality.

It is important to take these steps to ensure the security of your app after implementing the fix.

Need Help? Contact SupportPRO

If you are experiencing issues or want to ensure that everything is properly managed, please reach out to SupportPRO. Don’t delay—waiting only gives attackers more time to cause damage. Contact SupportPRO today to have your application secured by experienced professionals.

Final Thoughts

CVE-2025-66478 is one of the most serious threats Next.js has seen. Don’t take chances patch your app now and stay safe.

Partner with SupportPRO for 24/7 proactive cloud support that keeps your business secure, scalable, and ahead of the curve.