# CVE-2025-71389: Cal.com remote code execution via Next.js RSC deserialization

Source: https://junglewise.ai/threats/cve-2025-71389-cal-com-remote-code-execution-via-next-js-rsc-deserialization  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-23. Updated: 2026-07-23  
License: CC BY 4.0 with a link back

CVE-2025-71389 · Severity: critical · CVSS 10 · Published 2026-07-23

Cal.com is an open-source scheduling platform used by businesses to manage appointments and meetings. A critical security flaw allows an unauthenticated attacker to remotely execute malicious code on the server hosting the application. This could lead to a complete system takeover, theft of sensitive customer data, or disruption of scheduling services.

Technologies: [Cal.Com](https://junglewise.ai/threats/technologies/cal-com). Vendors: [Cal.com](https://junglewise.ai/threats/vendors/cal-com).

## Quick answers

**Is CVE-2025-71389 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-71389 being exploited in the wild.

**How severe is CVE-2025-71389?** Critical severity, with a CVSS score of 10, published 23 July 2026.

**Which products and versions are affected?** Cal.Com < 5.9.9.

**Is there a fix for CVE-2025-71389?** A patch was published on 2025-12-04: Cal.com merged PR to bump Next.js version Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-71389 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2025-71389?** Check whether you run Cal.Com at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Cal.com (cal.diy) versions prior to 5.9.9 are vulnerable to remote code execution (RCE) due to an upstream vulnerability in Next.js (CVE-2025-55182). The flaw exists in the React Server Components (RSC) request handling, where the server deserializes attacker-controlled input from the React flight protocol. A remote, unauthenticated attacker can send a specially crafted RSC request to trigger the execution of arbitrary code during server-side processing. The vulnerability is rooted in the 'react-server-dom-webpack' (and related) packages used by Next.js App Router. The issue is resolved in Cal.com 5.9.9 by updating the Next.js dependency to a patched version (e.g., 15.5.7 or 15.4.8).

## Affected products

- Cal.com cal.diy < 5.9.9

## Timeline

- 2025-12-03: advisory: Upstream Next.js vulnerability disclosed (GHSA-9qr9-h5gf-34mp)
- 2025-12-04: patched: Cal.com merged PR to bump Next.js version
- 2025-12-07: advisory: Cal.com published security advisory GHSA-qjx2-5xqp-cpf4
- 2026-07-23: disclosed: CVE-2025-71389 published to NVD

## References

- [https://github.com/calcom/cal.diy/pull/25592](https://github.com/calcom/cal.diy/pull/25592)
- [https://github.com/calcom/cal.diy/security/advisories/GHSA-qjx2-5xqp-cpf4](https://github.com/calcom/cal.diy/security/advisories/GHSA-qjx2-5xqp-cpf4)
- [https://www.vulncheck.com/advisories/cal-com-before-remote-code-execution-via-rsc](https://www.vulncheck.com/advisories/cal-com-before-remote-code-execution-via-rsc)

## Related threats

- [Cal.com authorization bypass in webhook handler](https://junglewise.ai/threats/cve-2026-112043-a-weakness-has-been-identified-in-calcom-cal-com-and-cal-diy-up)
- [Cal.com credentials delete cross-team privilege escalation](https://junglewise.ai/threats/cve-2026-109143-a-vulnerability-was-determined-in-calcom-cal-com-and-cal-diy-up)
- [Cal.com stored XSS in booking question labels](https://junglewise.ai/threats/cve-2024-58355-cal-com-stored-xss-in-booking-question-labels)
- [Calcom cal.diy repository takeover via GitHub Actions pull_request_target](https://junglewise.ai/threats/cve-2024-58354-calcom-cal-diy-repository-takeover-via-github-actions-pull)
- [Cal.com cal.diy stored XSS in booking question labels](https://junglewise.ai/threats/cve-2024-58353-cal-com-cal-diy-stored-xss-in-booking-question-labels)