UpHeron
All vulnerabilities

npm

GHSA-9qr9-h5gf-34mp

Next.js is vulnerable to RCE in React flight protocol

Severity
Critical 10.0
Published
3 Dec 2025
Last changed
10 Sept 2026
Added to UpHeron
14 Oct 2026
Fixed in
15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7, 16.0.7
Sources
OSV.dev and GitHub

Affected software

SoftwareAffected versions
Next.jsnpm · osv:npm:next
  • From 16.0.0-canary.0 before 16.0.7
  • From 15.5.0-canary.0 before 15.5.7
  • From 15.4.0-canary.0 before 15.4.8
  • From 15.3.0-canary.0 before 15.3.6
All 7 release lines
  • From 14.3.0-canary.77 before 15.0.5
  • From 15.1.0-canary.0 before 15.1.9
  • From 15.2.0-canary.0 before 15.2.6
  • From 15.3.0-canary.0 before 15.3.6
  • From 15.4.0-canary.0 before 15.4.8
  • From 15.5.0-canary.0 before 15.5.7
  • From 16.0.0-canary.0 before 16.0.7

References