Critical React and Next.js Vulnerabilities Enable Remote Attackers to Execute Malicious Code

Two critical vulnerabilities have been discovered in the React Server Components (RSC) “Flight” protocol, allowing unauthenticated attackers to execute malicious code on vulnerable servers.

The flaws, designated as CVE-2025-55182 in React and CVE-2025-66478 in Next.js, pose an immediate threat to millions of web applications across cloud environments.

The Vulnerability

The vulnerabilities stem from insecure deserialization in the RSC payload handling logic within the react-server package.

When a server receives specially crafted, malformed RSC payloads, it fails to properly validate their structure.

This allows attacker-controlled data to influence server-side execution logic, resulting in the execution of privileged JavaScript code with near 100% reliability during exploitation tests.

The critical aspect of this flaw is that default configurations are vulnerable. A standard Next.js application created with create-next-app and built for production can be exploited without any code modifications by the developer.

The attack requires only an unauthenticated remote HTTP request, making it exceptionally dangerous.

Real-World Impact

Wiz Research indicates that the threat landscape is extensive. Analysis of cloud environments reveals that 39% contain vulnerable instances of Next.js or React running susceptible versions.

More alarmingly, Next.js is present in 69% of cloud environments overall, with 61% of those having publicly exposed instances.

This means approximately 44% of all monitored cloud environments have publicly accessible Next.js applications vulnerable to exploitation.

The vulnerability affects React 19 ecosystem versions and frameworks implementing RSC. React versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 of the react-server package are vulnerable, while Next.js versions 14.3.0-canary, 15.x, and 16.x utilizing the App Router face risk.

Additionally, any third-party framework bundling the react-server implementation is potentially affected, including Vite RSC plugin, Parcel RSC plugin, React Router RSC preview, RedwoodSDK, and Waku.

Security teams must prioritize upgrading React and all dependencies to hardened versions immediately. This represents the only definitive mitigation strategy.

Organizations using alternative RSC-enabled frameworks should check official channels for updates regarding the bundled react-server version and apply patches urgently.

The vulnerability’s combination of ease of exploitation, high success rate, default vulnerable configuration, and widespread deployment creates an exceptionally critical risk landscape.

Organizations should treat this as a priority-one security incident requiring immediate action across all affected infrastructure.

Find this Story Interesting! Follow us on Google News, LinkedIn and X to Get More Instant Updates