nextjs - 💡(How to fix) Fix Inconsistent React version strings in Next.js 16.0.7+ cause CVE-2025-55182 verification confusion [4 comments, 4 participants]

Link to the code that reproduces this issue

https://github.com/sponte/nextjs-cve-version-confusion

To Reproduce

1. Clone the reproduction repo: git clone https://github.com/sponte/nextjs-cve-version-confusion
2. Install dependencies: npm install
3. Run the version check script: npm run check-versions
4. Observe that RSC packages report 709fe18f-20251202 but react/react-dom report 52684925-20251110

Alternatively:

1. Start dev server: npm run dev
2. Open browser DevTools console
3. Run: __REACT_DEVTOOLS_GLOBAL_HOOK__.renderers.values().next()["value"]["version"]
4. Observe it returns 19.3.0-canary-52684925-20251110 (the old version string)

Current vs. Expected behavior

Current behavior:

• react-server-dom-turbopack peerDeps: 19.3.0-canary-709fe18f-20251202 ✅
• react-server-dom-webpack peerDeps: 19.3.0-canary-709fe18f-20251202 ✅
• react exports.version: 19.3.0-canary-52684925-20251110 ⚠️
• react-dom exports.version: 19.3.0-canary-52684925-20251110 ⚠️
• React DevTools reports: 19.3.0-canary-52684925-20251110 ⚠️

Expected behavior: All bundled React packages should report consistent version strings. Since the CVE-2025-55182 fix was introduced in 709fe18f-20251202, the bundled react and react-dom packages should also be updated to this version for consistency.

Why this matters:**

Security teams verifying CVE-2025-55182 remediation see the old version string and incorrectly conclude their systems are still vulnerable. The actual fix (hasOwnProperty.call(moduleExports, metadata[2])) IS present in the RSC packages, but the inconsistent version strings create unnecessary confusion and false alarms during security audits.

Provide environment information

Operating System:
  Platform: darwin
  Arch: arm64
  Version: Darwin Kernel Version 25.1.0
  Available memory (MB): 36864
  Available CPU cores: 12
Binaries:
  Node: 22.12.0
  npm: 10.9.0
  Yarn: N/A
  pnpm: 9.15.1
Relevant Packages:
  next: 16.0.8
  eslint-config-next: N/A
  react: 19.0.0
  react-dom: 19.0.0
  typescript: 5.9.3
Next.js Config:
  output: N/A

Which area(s) are affected? (Select all that apply)

Not sure

Which stage(s) are affected? (Select all that apply)

next dev (local)

Additional context

Evidence the CVE fix IS present:

Comparing Next.js 16.0.6 (vulnerable) vs 16.0.7+ (fixed):

16.0.6 (vulnerable):

// react-server-dom-turbopack-server.node.production.js
return "*" === metadata[2]
    ? moduleExports
    : "" === metadata[2]
      ? moduleExports.__esModule
        ? moduleExports.default
        : moduleExports
      : moduleExports[metadata[2]]; // Direct property access - VULNERABLE

16.0.7+ (fixed):

// react-server-dom-turbopack-server.node.production.js
if ("*" === metadata[2]) return moduleExports;
if ("" === metadata[2])
  return moduleExports.__esModule ? moduleExports.default : moduleExports;
if (hasOwnProperty.call(moduleExports, metadata[2])) // Safe check - FIXED
  return moduleExports[metadata[2]];

Related:

• CVE-2025-55182 (React2Shell)
• Vercel changelog: https://vercel.com/changelog/cve-2025-55182
• React security advisory: https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components
• Previous issue closed by bot: #87028