Cloudanix VulnDB

GHSA-9qr9-h5gf-34mp

Critical · 10.0

CVSS

10.0

EPSS

—

Published

Dec 3, 2025

CISA due date

—

The record

Next.js is vulnerable to RCE in React flight protocol

Affected packages

Ecosystem Package Introduced Fixed
npm next 14.3.0-canary.77 15.0.5
npm next 15.1.0-canary.0 15.1.9
npm next 15.2.0-canary.0 15.2.6
npm next 15.3.0-canary.0 15.3.6
npm next 15.4.0-canary.0 15.4.8
npm next 15.5.0-canary.0 15.5.7
npm next 16.0.0-canary.0 16.0.7
npm react-server-dom-parcel 19.0.0 No fix
npm react-server-dom-parcel 19.0.0 19.0.1
npm react-server-dom-parcel 19.1.0 19.1.2
npm react-server-dom-parcel 19.2.0 No fix
npm react-server-dom-parcel 19.2.0 19.2.1
npm react-server-dom-turbopack 19.0.0 No fix
npm react-server-dom-turbopack 19.0.0 19.0.1
npm react-server-dom-turbopack 19.1.0 19.1.2
npm react-server-dom-turbopack 19.2.0 No fix
npm react-server-dom-turbopack 19.2.0 19.2.1
npm react-server-dom-webpack 19.0 19.0.1
npm react-server-dom-webpack 19.0.0 No fix
npm react-server-dom-webpack 19.0.0 19.0.1
npm react-server-dom-webpack 19.1.0 19.1.2
npm react-server-dom-webpack 19.2.0 No fix
npm react-server-dom-webpack 19.2.0 19.2.1
Chainguard jitsucom-jitsu 0 2.11.0-r9
Chainguard jitsucom-jitsu-console 0 2.11.0-r9
Chainguard jitsucom-jitsu-rotor 0 2.11.0-r9
Chainguard langfuse-3 0 3.137.0-r0
Chainguard langfuse-fips-3 0 3.138.0-r0
Chainguard langfuse-fips-3-compat 0 3.138.0-r0
Chainguard langfuse-fips-3-worker 0 3.138.0-r0
Wolfi jitsucom-jitsu 0 2.11.0-r9
Wolfi jitsucom-jitsu-console 0 2.11.0-r9
Wolfi jitsucom-jitsu-rotor 0 2.11.0-r9
Wolfi langfuse-3 0 3.137.0-r0

Related vulnerabilities