Critical Security Vulnerability CVE-2025-66478 in React Server Components Protocol
By
connor11528
Slow-proofed and worth the wait. Worth its weight in flour.
Summary
A critical security vulnerability (CVE-2025-66478) has been discovered in the React Server Components (RSC) protocol with a CVSS score of 10.0, allowing remote code execution. The advisory provides urgent instructions for affected Next.js applications, including rotating secrets for applications that were online and unpatched as of December 4th, 2025, and updating via an npm package or GitHub repository.
Key quotes
· 4 pulledA critical vulnerability has been identified in the React Server Components (RSC) protocol. The issue is rated CVSS 10.0 and can allow remote code execution when processing attacker-controlled requests in un
If your application was online and unpatched as of December 4th, 2025 at 1:00 PM PT, we strongly encourage you to rotate any secrets it uses, starting with your most critical ones.
An npm package has been released to update affected Next.js apps. Use npx fix-react2shell-next to update now, or visit the GitHub repository to learn more.
A critical vulnerability (CVE-2025-66478) has been identified in the React Server Components protocol. Users should upgrade to patched versions immediately.
You might also wanna read
September 2025 NPM supply-chain attack compromises popular JavaScript packages
In September 2025, a coordinated software supply-chain attack targeted multiple popular NPM packages in the JavaScript ecosystem. The attack
VS Code Remote-SSH Vulnerability Enables Lateral Movement from Developer Machines to Cloud Servers
A critical vulnerability in Visual Studio Code's Remote-SSH extension creates a post-compromise attack path enabling threat actors to pivot
cybersecuritynews.com·3d ago
Microsoft patches high-severity SharePoint RCE vulnerability CVE-2026-45659
Microsoft has patched a high-severity remote code execution vulnerability (CVE-2026-45659) in SharePoint that affects SharePoint Server Subs
helpnetsecurity.com·4d ago
Microsoft uncovers supply chain attack: Compromised @antv npm packages steal CI/CD credentials via Mini Shai-Hulud malware
Microsoft has identified an active supply chain attack targeting the @antv npm package ecosystem. A threat actor compromised an @antv mainta