🚨 Critical React + Next.js RCE Alert 🚨
New flaws in the React Server Components “Flight” protocol (CVE-2025-55182 & CVE-2025-66478) allow unauthenticated remote code execution on default installations.

Attackers only need one malicious HTTP request to take over a server.

Wiz reports 39% of cloud environments are vulnerable.

If you're running:
• React 19.0–19.2
• Next.js 14.3.0-canary, 15.x, 16.x (App Router)
• Any framework bundling react-server (Redwood, Waku, Vite/Parcel RSC plugins, etc.)

👉 You are likely exposed. Patch immediately.

Updates now available:
React 19.0.1 / 19.1.2 / 19.2.1
Next.js 14.3.0-canary.88 / 15.0.5+ / 16.0.7

Full RCE. Remote. Unauthenticated. Near-100% exploit reliability.

Patch today. Do not wait.