# Next.js remote code execution in React Server Components

Source: https://junglewise.ai/threats/next-js-remote-code-execution-in-react-server-components-29cc5f6b  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-12-03. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

Severity: low · CVSS 3.1 · Published 2025-12-03

Next.js is a widely-used web framework that renders components on the server side. A critical flaw in the React Server Components deserialization mechanism allows attackers to execute arbitrary code on affected servers without authentication. This could lead to complete compromise of web applications, exposing customer data, taking services offline, and enabling attackers to use the compromised server as a pivot point into corporate networks.

Technologies: [Vercel Next.js](https://junglewise.ai/threats/technologies/next-js). Vendors: [Vercel](https://junglewise.ai/threats/vendors/vercel).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Low severity, with a CVSS score of 3.1, published 3 December 2025.

**Which products and versions are affected?** Vercel Next.js 14.3.0-canary.77 through 16.x (before patched versions: 15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7, 16.0.7).

**Is there a fix for This vulnerability?** A patch was published on 2025-12-03: Patches released: React 19.0.1, 19.1.2, 19.2.1; Next.js 15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7, 16.0.7 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network.

**Am I affected?** Check whether you run Vercel Next.js at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a deserialization-of-untrusted-data flaw (CWE-502) in React Server Components' flight protocol implementation. The affected React packages (react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack) in versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 fail to properly validate serialized component data before deserializing it, allowing an unauthenticated network attacker to craft malicious payloads that execute arbitrary code on the server. Next.js versions 14.3.0-canary.77 through 16.x using the App Router inherit this vulnerability from the upstream React packages. The attack requires only network connectivity; no authentication or user interaction is needed. Patches are available in React 19.0.1, 19.1.2, 19.2.1 and corresponding Next.js versions (15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7, 16.0.7).

## Affected products

- Vercel Next.js 14.3.0-canary.77 through 16.x (before patched versions: 15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7, 16.0.7)
- Meta React 19.0.0, 19.1.0, 19.1.1, 19.2.0 (fixed in 19.0.1, 19.1.2, 19.2.1)
- Meta react-server-dom-webpack 19.0.0, 19.1.0, 19.1.1, 19.2.0 (fixed in 19.0.1, 19.1.2, 19.2.1)
- Meta react-server-dom-parcel 19.0.0, 19.1.0, 19.1.1, 19.2.0 (fixed in 19.0.1, 19.1.2, 19.2.1)
- Meta react-server-dom-turbopack 19.0.0, 19.1.0, 19.1.1, 19.2.0 (fixed in 19.0.1, 19.1.2, 19.2.1)

## Timeline

- 2025-12-03: disclosed: Security advisory published
- 2025-12-03: patched: Patches released: React 19.0.1, 19.1.2, 19.2.1; Next.js 15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7, 16.0.7

## References

- [https://github.com/facebook/react/security/advisories/GHSA-fv66-9v8q-g76r](https://github.com/facebook/react/security/advisories/GHSA-fv66-9v8q-g76r)
- [https://github.com/vercel/next.js/security/advisories/GHSA-9qr9-h5gf-34mp](https://github.com/vercel/next.js/security/advisories/GHSA-9qr9-h5gf-34mp)

## Related threats

- [Vercel Next.js remote code execution in use cache functions](https://junglewise.ai/threats/next-js-unauthenticated-remote-code-execution-in-use-cache-functions-ac3e73d3)
- [Next.js denial of service in App Router with Server Actions](https://junglewise.ai/threats/cve-2026-94482-next-js-denial-of-service-in-app-router-using-server-actions)
- [Next.js unauthenticated remote code execution in Image Optimization API](https://junglewise.ai/threats/next-js-unauthenticated-remote-code-execution-in-image-optimization-api-f1b22a87)
- [Next.js information disclosure in Draft Mode via use cache](https://junglewise.ai/threats/cve-2026-94544-next-js-is-a-react-framework-for-building-full-stack-web)
- [Next.js Pages Router response cache key bypass](https://junglewise.ai/threats/cve-2026-94543-next-js-is-a-react-framework-for-building-full-stack-web)