Next.js Security Vulnerability: What Is CVE-2025-55182, Which Versions Are Affected, and How Do You Fix It?

What Is CVE-2025-55182?

CVE-2025-55182 is a critical security vulnerability related to the Flight protocol used in the React Server Components (RSC) infrastructure.
This vulnerability exposes applications that use Next.js’s App Router architecture to the risk of Remote Code Execution (RCE).

To put it simply:
A malicious user can send specially crafted HTTP requests and execute unauthorized code on the server side.

This is considered one of the most critical security scenarios for modern Next.js applications.

Which Next.js Versions Are Affected?

The following versions are directly at risk:

• Next.js 15.x (all minor versions)

• Next.js 16.x

• Next.js 14.3.0-canary.77 and later canary versions

• Projects using the App Router (/app)

What Can This Vulnerability Do? (Attack Scenario)

With this vulnerability, attackers can:

• Run arbitrary JavaScript code on the server

• Access environment variables (API keys, secrets, tokens)

• Gain shell access to the server

• Run crypto miners or malicious scripts

• Steal credentials for cloud services (AWS, GCP, etc.)

That’s why it has been given a CVSS score of 10.0 (Critical).

How Does the Vulnerability Work Technically?

• React Server Components use the Flight protocol to carry data between the client and the server.

• Incoming data in this protocol gets deserialized.

• CVE-2025-55182 stems from insufficient validation during this deserialization process.

• The attacker sends malicious data to the server using a specially crafted payload.

• The server processes this data unsafely, and code execution happens.

In short:

Unsafe deserialization = RCE

How Do You Fix It? (Permanent Solution)

✅ The only definitive fix: upgrade your Next.js version

The Next.js team patched the vulnerability in the following versions:

Safe Versions

• Next.js 15.x → 15.0.5 and above

• Next.js 16.x → 16.0.7

• For canary:

  • 15.x → 15.6.0-canary.58

  • 16.x → 16.1.0-canary.12

Upgrade Command

or a specific version:

What to Do After Upgrading

Just upgrading is not enough. The following steps are critical:

1. Rotate all environment variables

   • API keys

   • Secret tokens

   • DB passwords

2. Redeploy the server

3. Check your logs (for suspicious requests)

4. If you’re on a canary version, switch to a stable version if possible

Are Temporary Measures Enough?

❌ No.

• WAF

• Firewall

• Request filtering

Solutions like these provide temporary protection but don’t close the vulnerability.
The permanent solution is always a version upgrade.