HoneyWarden
criticalnextGHSA-9qr9-h5gf-34mp

Next.js is vulnerable to RCE in React flight protocol

Affected versions

  • >= 14.3.0-canary.77, < 15.0.5, fixed in 15.0.5
  • >= 15.2.0-canary.0, < 15.2.6, fixed in 15.2.6
  • >= 15.3.0-canary.0, < 15.3.6, fixed in 15.3.6
  • >= 15.4.0-canary.0, < 15.4.8, fixed in 15.4.8
  • >= 16.0.0-canary.0, < 16.0.7, fixed in 16.0.7
  • >= 15.1.0-canary.0, < 15.1.9, fixed in 15.1.9
  • >= 15.5.0-canary.0, < 15.5.7, fixed in 15.5.7

Published 2025-12-03. Last checked 2026-11-01. Read the source advisory

Scan your site for free