Issue Station
Sign In
Tools hereToolbox

nextjs - 💡(How to fix) Fix [Security] CVE-2025-66478 Backport Contribution Guide & Tools [1 comments, 2 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
vercel/next.js#86790•Fetched 2026-04-08 02:09:11
View on GitHub
Comments
1
Participants
2
Timeline
5
Reactions
0
Author
AryanVBWAryanVBW
Participants
AryanVBWAryanVBWgithub-actions[bot]github-actions[bot]
Timeline (top)
closed ×1commented ×1labeled ×1locked ×1

This issue provides comprehensive resources for contributors who want to help backport the critical CVE-2025-66478 security fix to older Next.js release lines.

Root Cause

This issue provides comprehensive resources for contributors who want to help backport the critical CVE-2025-66478 security fix to older Next.js release lines.

Fix Action

Fix / Workaround

Patched Versions

Release LinePatched Version
15.0.x15.0.5
15.1.x15.1.9
15.2.x15.2.6
15.3.x15.3.6
15.4.x15.4.8
15.5.x15.5.7
16.0.x16.0.7

For 14.3.0-canary.77+, downgrade to stable:

npm install next@14

Code Example

# Dry run (preview changes)
node scripts/backport-cve-2025-66478.js --target-version 15.4.7 --dry-run

# Execute backport
node scripts/backport-cve-2025-66478.js --target-version 15.4.7

---

# Scan single project
node scripts/scan-cve-2025-66478.js package.json

# Scan multiple projects
node scripts/scan-cve-2025-66478.js --scan-dir ./my-projects

---

npm install next@15.0.5   # for 15.0.x
npm install next@15.1.9   # for 15.1.x
npm install next@15.2.6   # for 15.2.x
npm install next@15.3.6   # for 15.3.x
npm install next@15.4.8   # for 15.4.x
npm install next@15.5.7   # for 15.5.x
npm install next@16.0.7   # for 16.0.x

# For 14.3.0-canary.77+, downgrade to stable:
npm install next@14
RAW_BUFFERClick to expand / collapse

Summary

This issue provides comprehensive resources for contributors who want to help backport the critical CVE-2025-66478 security fix to older Next.js release lines.

Vulnerability Overview

FieldValue
CVE IDCVE-2025-66478 (Next.js), CVE-2025-55182 (React)
Severity🔴 CRITICAL (CVSS 10.0)
ImpactRemote Code Execution (RCE)
ComponentReact Server Components (FlightReplyServer)
AffectedNext.js 15.x, 16.x with App Router

Affected Versions

Version RangeStatus
Next.js 13.x✅ NOT Affected
Next.js 14.x stable✅ NOT Affected
Next.js 14.3.0-canary.77+❌ Affected
Next.js 15.0.0 - 15.0.4❌ Affected
Next.js 15.1.0 - 15.1.8❌ Affected
Next.js 15.2.0 - 15.2.5❌ Affected
Next.js 15.3.0 - 15.3.5❌ Affected
Next.js 15.4.0 - 15.4.7❌ Affected
Next.js 15.5.0 - 15.5.6❌ Affected
Next.js 16.0.0 - 16.0.6❌ Affected

Patched Versions

Release LinePatched Version
15.0.x15.0.5
15.1.x15.1.9
15.2.x15.2.6
15.3.x15.3.6
15.4.x15.4.8
15.5.x15.5.7
16.0.x16.0.7

Contribution Resources

1. Backport Script

Automates the backporting process:

# Dry run (preview changes)
node scripts/backport-cve-2025-66478.js --target-version 15.4.7 --dry-run

# Execute backport
node scripts/backport-cve-2025-66478.js --target-version 15.4.7

2. Vulnerability Scanner

Scan projects for vulnerable versions:

# Scan single project
node scripts/scan-cve-2025-66478.js package.json

# Scan multiple projects
node scripts/scan-cve-2025-66478.js --scan-dir ./my-projects

3. Documentation

Full backport guide: contributing/docs/CVE-2025-66478-backport-guide.md

How to Contribute

  1. Fork the repository
  2. Run the backport script for your target version
  3. Test the changes thoroughly
  4. Submit a PR to the appropriate release branch

Quick Upgrade Commands

npm install [email protected]   # for 15.0.x
npm install [email protected]   # for 15.1.x
npm install [email protected]   # for 15.2.x
npm install [email protected]   # for 15.3.x
npm install [email protected]   # for 15.4.x
npm install [email protected]   # for 15.5.x
npm install [email protected]   # for 16.0.x

# For 14.3.0-canary.77+, downgrade to stable:
npm install next@14

References

Related Files

  • scripts/backport-cve-2025-66478.js - Automated backport script
  • scripts/scan-cve-2025-66478.js - Vulnerability scanner
  • contributing/docs/CVE-2025-66478-backport-guide.md - Full documentation

⚠️ IMPORTANT: All users running affected versions should upgrade immediately. There is no configuration option to disable the vulnerable code path.

extent analysis

TL;DR

Upgrade to the patched version of Next.js corresponding to your release line to fix the critical CVE-2025-66478 security vulnerability.

Guidance

  • Identify your current Next.js version and check if it's affected by referring to the "Affected Versions" table.
  • Use the provided Quick Upgrade Commands to upgrade to the patched version for your release line.
  • Consider using the backport script to automate the backporting process for your specific version if you cannot upgrade immediately.
  • Utilize the vulnerability scanner script to scan your projects for vulnerable versions and ensure all dependencies are updated.

Example

To upgrade to the patched version for release line 15.4.x, run:

npm install [email protected]

Notes

The provided backport script and vulnerability scanner are useful tools for managing and identifying vulnerable versions, but upgrading to the patched version is the most straightforward and recommended solution.

Recommendation

Apply the workaround by upgrading to the fixed version, as there is no configuration option to disable the vulnerable code path and the vulnerability is classified as critical (CVSS 10.0) with a potential for Remote Code Execution (RCE).

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…
#response parsing#generation error#database connection#vector store#embedding generation

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING