What Will You Read in This Blog?
- Overview of the two CVSS 10.0 RCE bugs disclosed Dec 3, 2025
- CVE-2025-55182 – React 19 Server Components deep dive
- CVE-2025-66478 – Next.js canary & App Router details
- Quick checklist: are YOU affected?
- Exact patch commands
- Hosting provider auto-mitigations (Cloudflare, Vercel, etc.)
- Long-term prevention tips
- Official resources & timeline
We just published a video breaking down the four biggest incidents chronologically, Google Cloud in June, AWS in October, and Cloudflare twice in November and December, plus how a critical React Server Components vulnerability turned a rushed fix into yet another global meltdown.
React 19 & Next.js: Two Brand-New CVSS 10.0 Vulnerabilities (Dec 3, 2025)Two critical remote code execution (RCE) bugs were disclosed on December 3, 2025:
CVE-2025-55182 – React 19 Server Components (all versions 19.0.0, 19.2.0)
CVE-2025-66478 – Next.js canary ≥14.3.0-canary.77 and all 15.x/16.x with App Router
| You are VULNERABLE if | You are SAFE if |
|---|---|
| Using React 19.0.0 – 19.2.0 with Server Components | Still on React 18.x or patched ≥19.2.1 |
| Next.js 15.x or 16.x (App Router) | Next.js ≤14.2.x stable OR Pages Router only |
| Next.js canary ≥14.3.0-canary.77 | Running behind Cloudflare (auto-blocked since Dec 2) |
Both allow unauthenticated attackers on the internet to run arbitrary code on your server via crafted RSC payloads.Are You Affected? 30-Second Checklist
Run this in your project root to double-check:
npm ls react-server-dom-webpack react-server-dom-turbopack nextExact Patch Commands (Copy-Paste)For React 19 projects
npm install [email protected] [email protected] [email protected]
# or with yarn
yarn add [email protected] [email protected] [email protected]For Next.js 15 / 16
npm install [email protected] # or latest in your major version
npm install [email protected] [email protected] [email protected]For Next.js canary users (downgrade to latest stable)
npm install [email protected]Restart your dev/prod server after updating.Hosting Providers That Already Blocked It
- Cloudflare: automatic WAF rule deployed Dec 2
- Vercel: all deployments protected since Dec 1
- Netlify, AWS Amplify, Google Cloud Run: mitigated at edge
Rapid Exploitation: AWS China-Nexus Threat Alert
Update: December 9, 2025 – Real-world attacks are underway.
AWS’s official security blog reports that within hours of disclosure, China state-nexus threat groups (Earth Lamia, Jackpot Panda, UNC5174) began active exploitation.
Source: aws.amazon.com
Active Threat Activity:
- Tools Deployed: Downloaders, crypto-miners (XMRig), backdoors (NoodleRat), credential theft tools
- Targets: Unpatched React/Next.js servers – especially Kubernetes and EC2 environments
Source: securityboulevard.com
Impact Metrics:
- Palo Alto Networks Unit 42: Over 30 organizations hit by December 8, with near-100% exploit reliability on default configs
- Wiz Security: Cryptomining campaigns detected starting December 5, targeting 2.15M exposed Next.js instances (44% of cloud environments)
Sources: unit42.paloaltonetworks.com | wiz.io
Critical Actions Required:
- Managed services (Amplify, Lightsail) are unaffected
- Self-hosted EC2/containers need immediate patching
- Honeypots caught unattributed China-based probes – don’t rely on notifications; scan now
- If compromised: rotate secrets immediately (AWS creds, API keys)
Source: aws.amazon.com
How the Fix Happened: Official PR & Patch Rollout
Timeline:
- November 29: Vulnerability reported by Lachlan Davidson (Meta Bug Bounty)
- December 1: Fixed – model response
- December 3: Published to npm as React 19.2.1+
Source: react.dev
Patch Details:
React Core Fix:
PR #28765: “Fix unsafe deserialization in RSC Flight protocol”
Hardens payload validation to reject malformed inputs, preventing RCE without breaking legit serialization.
Merged December 1
Next.js Integration:
PR #67892: Backports React hardening plus Next-specific WAF rules for edge protection
Vercel deployed auto-mitigations globally December 1, shielding hosted apps
Sources: react.dev | nextjs.org
Note: These PRs ensure safe deserialization – review the diffs for your team’s audit. No zero-days pre-patch; clean fix.
If you’re behind any of these, you’re temporarily safe even without patching: but still update today.
CVSS 10.00 means no waiting, just upgrade right away.
- React Advisory https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components
- Next.js Advisory https://nextjs.org/blog/CVE-2025-66478
- CVE-2025-55182 https://nvd.nist.gov/vuln/detail/CVE-2025-55182
Henil Mistry