Executive brief
Next.js is a widely-used web framework that renders components on the server side. A critical flaw in the React Server Components deserialization mechanism allows attackers to execute arbitrary code on affected servers without authentication. This could lead to complete compromise of web applications, exposing customer data, taking services offline, and enabling attackers to use the compromised server as a pivot point into corporate networks.
Technical details
The vulnerability is a deserialization-of-untrusted-data flaw (CWE-502) in React Server Components' flight protocol implementation. The affected React packages (react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack) in versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 fail to properly validate serialized component data before deserializing it, allowing an unauthenticated network attacker to craft malicious payloads that execute arbitrary code on the server. Next.js versions 14.3.0-canary.77 through 16.x using the App Router inherit this vulnerability from the upstream React packages. The attack requires only network connectivity; no authentication or user interaction is needed. Patches are available in React 19.0.1, 19.1.2, 19.2.1 and corresponding Next.js versions (15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7, 16.0.7).
Affected products
- Vercel Next.js 14.3.0-canary.77 through 16.x (before patched versions: 15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7, 16.0.7)
- Meta React 19.0.0, 19.1.0, 19.1.1, 19.2.0 (fixed in 19.0.1, 19.1.2, 19.2.1)
- Meta react-server-dom-webpack 19.0.0, 19.1.0, 19.1.1, 19.2.0 (fixed in 19.0.1, 19.1.2, 19.2.1)
- Meta react-server-dom-parcel 19.0.0, 19.1.0, 19.1.1, 19.2.0 (fixed in 19.0.1, 19.1.2, 19.2.1)
- Meta react-server-dom-turbopack 19.0.0, 19.1.0, 19.1.1, 19.2.0 (fixed in 19.0.1, 19.1.2, 19.2.1)
Timeline
- 2025-12-03: disclosed: Security advisory published
- 2025-12-03: patched: Patches released: React 19.0.1, 19.1.2, 19.2.1; Next.js 15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7, 16.0.7