Netlify's response to the critical React security vulnerability

A critical vulnerability (CVE-2025-55182) was recently disclosed in React's Server Functions protocol, a feature of React Server Components (RSC). React 19.0, 19.1, and 19.2 are affected. Working closely with the React and Next.js teams, we received early notice and immediately took action to protect our customers. The vulnerability can be exploited using all RSC implementations, including:

• Next.js versions up to and including 15.5.6 and 16.0.6 (CVE-2025-66478 )
• React Router RSC Preview
• Vite RSC plugin

In affected configurations, an attacker could craft a request that allows them to execute arbitrary code within the context of the victim's app. On December 3, at 14:00 UTC, the Netlify team rolled out a patch that prevents this vulnerability from being exploited on our customers' sites. Since that time, all Netlify customers are not vulnerable to the exploit. We have found no evidence of exploitation on any Netlify sites. As a general security precaution, we recommend upgrading to the latest versions of your framework and, in the case of Next.js, allowing automatic updates of the OpenNext Netlify Next.js adapter. We are working continually with the React and Next.js teams and are committed to keeping your sites secure on Netlify. This post was last updated on 2025-12-03 at 15:47 UTC

Continue reading...