openaienmodel: gpt-5-mini-2025-08-07
Next.js Security Update: December 11, 2025
Key Points
- DoS via App Router deserialization (CVE-2025-55184)
- Server Functions may leak compiled source (CVE-2025-55183)
- Upgrade to listed patched Next.js versions immediately
Summary
Two React Server Components (RSC) protocol vulnerabilities in upstream React affect Next.js App Router apps: CVE-2025-55184 (Denial of Service, high) and CVE-2025-55183 (Source Code Exposure, medium). The initial fix for CVE-2025-55184 was incomplete; a complete fix is published as CVE-2025-67779. Neither issue allows remote code execution. Pages Router applications are not affected.
Key Points
- Impact
- Denial of Service (CVE-2025-55184): a crafted HTTP request can deserialize into an infinite loop and hang the server process. Initial fix incomplete; upgrade to the complete fix (CVE-2025-67779).
- Source Code Exposure (CVE-2025-55183): a crafted HTTP request can cause a Server Function to return compiled source of other Server Functions; secrets embedded directly in code may be exposed.
- Affected: Any application using the App Router with React Server Components. Pages Router is not affected but upgrade is still recommended.
- Fixed releases (upgrade to the listed patched version for your release line):
-
=13.3, 14.0.x, 14.1.x -> upgrade to 14.2.35
- 15.0.x -> 15.0.7
- 15.1.x -> 15.1.11
- 15.2.x -> 15.2.8
- 15.3.x -> 15.3.8
- 15.4.x -> 15.4.10
- 15.5.x -> 15.5.9
- 15.x canary -> 15.6.0-canary.60
- 16.0.x -> 16.0.10
- 16.x canary -> 16.1.0-canary.19
-
- Required action: upgrade to the latest patched version in your release line and re-deploy. There is no workaround.
Upgrade commands (examples)
- For 14.x:
npm install next@14.2.35 - For 15.0.x:
npm install next@15.0.7 - For 15.1.x:
npm install next@15.1.11 - For 15.2.x:
npm install next@15.2.8 - For 15.3.x:
npm install next@15.3.8 - For 15.4.x:
npm install next@15.4.10 - For 15.5.x:
npm install next@15.5.9 - For 16.0.x:
npm install next@16.0.10 - Canary lines:
npm install next@15.6.0-canary.60ornpm install next@16.1.0-canary.19
Also run npx fix-react2shell-next to check versions and perform deterministic version bumps per recommendations.
Notes
- If you upgraded to an earlier recommended release for CVE-2025-55184, upgrade again to the versions above (CVE-2025-67779 addresses the incomplete initial fix).
- The React2Shell patch remains effective; these are additional upstream RSC issues. For full technical details see the React blog and referenced CVE advisories.