nextjs - 💡(How to fix) Fix Version confusion in Next.js 16.0.7+ bundled React packages causes CVE-2025-55182 false alarm [1 comments, 2 participants]

Description

After upgrading to Next.js 16.0.8 to address CVE-2025-55182 (React2Shell), users may incorrectly believe they are still vulnerable due to version string inconsistencies in the bundled React packages.

The security fix for CVE-2025-55182 is present in Next.js 16.0.7+, but the version strings reported by React DevTools and various bundled files create significant confusion about whether the fix is actually in place.

Version Discrepancy Details

In Next.js 16.0.8:

The CVE fix (hasOwnProperty.call(moduleExports, metadata[2])) IS present in the react-server-dom-* server files, but the bundled react and react-dom packages were not updated to the same canary version.

Impact

When users run this command in React DevTools to verify their React version:

__REACT_DEVTOOLS_GLOBAL_HOOK__.renderers.values().next()["value"]["version"]
// Returns: '19.3.0-canary-52684925-20251110'

This returns the older canary version (52684925-20251110), causing users to believe they may be running a vulnerable version.

Similarly, searching for version strings in node_modules/next:

grep -r "exports.version" node_modules/next/dist/compiled/react-dom/cjs/*.js
# All files show: 19.3.0-canary-52684925-20251110

Reproduction Steps

1. Create a new Next.js 16.0.8 project

2. Run npm install or pnpm install

3. Check version strings:

   # RSC packages (fixed version):
   cat node_modules/next/dist/compiled/react-server-dom-turbopack/package.json | grep -A2 peerDependencies
   
   # react-dom (old version string):
   grep "exports.version" node_modules/next/dist/compiled/react-dom/cjs/react-dom.development.js

4. Start the dev server and check React DevTools - it reports the older version

Evidence the Fix IS Present

Comparing Next.js 16.0.6 (vulnerable) vs 16.0.7+ (fixed):

16.0.6 (vulnerable):

// react-server-dom-turbopack-server.node.production.js
return "*" === metadata[2]
    ? moduleExports
    : "" === metadata[2]
      ? moduleExports.__esModule
        ? moduleExports.default
        : moduleExports
      : moduleExports[metadata[2]]; // Direct property access - VULNERABLE

16.0.7+ (fixed):

// react-server-dom-turbopack-server.node.production.js
if ("*" === metadata[2]) return moduleExports;
if ("" === metadata[2])
  return moduleExports.__esModule ? moduleExports.default : moduleExports;
if (hasOwnProperty.call(moduleExports, metadata[2])) // Safe check - FIXED
  return moduleExports[metadata[2]];

Suggested Resolution

1. Update the bundled react and react-dom packages to match the same canary version (709fe18f-20251202) as the RSC packages for consistency
2. Or add documentation explaining why version strings may differ and how users can verify the fix is present
3. Consider adding a security verification utility or changelog note that explicitly states the CVE fix status

Environment

• Next.js: 16.0.8
• OS: macOS
• Package manager: pnpm

Related

• CVE-2025-55182 (React2Shell)
• Vercel changelog: https://vercel.com/changelog/cve-2025-55182
• React security advisory: https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components