criticalnextGHSA-9qr9-h5gf-34mp
Next.js is vulnerable to RCE in React flight protocol
Affected versions
>= 14.3.0-canary.77, < 15.0.5, fixed in 15.0.5>= 15.2.0-canary.0, < 15.2.6, fixed in 15.2.6>= 15.3.0-canary.0, < 15.3.6, fixed in 15.3.6>= 15.4.0-canary.0, < 15.4.8, fixed in 15.4.8>= 16.0.0-canary.0, < 16.0.7, fixed in 16.0.7>= 15.1.0-canary.0, < 15.1.9, fixed in 15.1.9>= 15.5.0-canary.0, < 15.5.7, fixed in 15.5.7
Published 2025-12-03. Last checked 2026-11-01. Read the source advisory