Fix React Server Components RCE vulnerability #82
Conversation
Addressed React Flight / Next.js RCE Advisory (CVE-2025-21630) ## Analysis Scanned the monorepo for vulnerable packages: - Root package.json: No Next.js or React Flight packages - docs/website/package.json: **AFFECTED** - Contains next@^16.0.6 - docs/storybook/package.json: No Next.js or React Flight packages (Vite-based Storybook) - ecosystem/baseframe/package.json: No vulnerable dependencies (CLI tool) - packages/baseframe/package.json: No vulnerable dependencies - packages/css/package.json: No vulnerable dependencies - packages/react/package.json: No vulnerable dependencies (library only) - packages/react-icons/package.json: No vulnerable dependencies (library only) **Key Finding:** Only the docs/website project uses Next.js and was affected. ## Changes Made ### Modified Files: 1. **docs/website/package.json** - Updated: `next@^16.0.6` → `next@^16.0.7` - Reason: Patched version that addresses the React Flight / Next.js RCE vulnerability (CVE-2025-21630) - React/React-DOM versions: Not modified (Next.js 16.0.7 provides correct patched versions automatically) 2. **pnpm-lock.yaml** - Updated: Lockfile now resolves to [email protected] - Verified that all dependencies resolve correctly with patched version ## Verification ✓ Dependencies installed successfully using `pnpm install` ✓ Lockfile updated to [email protected] (verified in pnpm-lock.yaml) ✓ Full project build successful: `pnpm run build` completed without errors ✓ Next.js website built successfully with new patched version ✓ No React Flight / RSC packages present (not a non-Next React app scenario) ## Notes - This is a pnpm monorepo with workspace dependencies - Only docs/website was affected; other packages don't use Next.js - No manual React/React-DOM version changes needed for Next.js projects - Build process verified successfully with all workspace packages Co-authored-by: Vercel <vercel[bot]@users.noreply.github.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
|
Important Review skippedBot user detected. To trigger a single review, invoke the You can disable this status message by setting the Comment |
Important
This is an automatic PR generated by Vercel to help you with patching efforts. We can't guarantee it's comprehensive, and it may contain mistakes. Please review our guidance before merging these changes.
A critical remote code execution (RCE) vulnerability in React Server Components, impacting frameworks such as Next.js, was identified in the project cocso-ui. The vulnerability enables unauthenticated RCE on the server via insecure deserialization in the React Flight protocol.
This issue is tracked under:
GitHub Security Advisory: GHSA-9qr9-h5gf-34mp
React Advisory: CVE-2025-55182
Next.js Advisory: CVE-2025-66478
This automated pull request upgrades the affected React and Next.js packages to patched versions that fully remediate the issue.
More Info | [email protected]