nextjs - 💡(How to fix) Fix Security Advisory: CVE-2025-66478 [1 participants]

TL;DR

• Review and apply the necessary patches or updates to address the critical vulnerability in React Server Components (RSC) protocol as described in the advisory CVE-2025-66478.

Guidance

• Check the Next.js application for usage of the App Router and React Server Components to determine the potential impact of the vulnerability.
• Refer to the advisory CVE-2025-66478 for specific guidance on patches or updates for Next.js applications.
• Visit the blog post https://nextjs.org/blog/CVE-2025-66478 for detailed information on the vulnerability and its mitigation.
• Verify that all dependencies are up-to-date, especially those related to React and Next.js, to ensure the latest security patches are applied.

Notes

• The fix involves updating or patching the affected components, which may require reviewing and updating dependencies in the project.
• It's crucial to follow the advisory and blog post guidelines for specific actions tailored to the application's configuration and version.

Recommendation

• Apply workaround: Given the critical nature of the vulnerability (CVSS 10.0), applying the workaround or patch as described in the advisory is recommended to prevent remote code execution attacks.