Cve-2025-55182

Next.js warns of a critical, RSC-related vulnerability (CVE-2025-66478) with CVSS 10 that enables remote code execution in unpatched apps, with explicit fixed versions and upgrade steps across 15.x, 16.x (and certain 14.3.0-canary canaries); no disable switch is available.

Security researcher discloses React2Shell RCE in React/Flight (CVE-2025-55182); Meta patched within ~17 hours; millions of sites potentially affected.

A critical remote code execution vulnerability in React Server Components (CVE-2025-55182) can be exploited with a single HTTP request; affects multiple frameworks and is widely used, prompting urgent patching of React and dependencies.