December 4, 2025
Canary in the code mine
NextJS Security Vulnerability
10/10 meltdown: Next.js rushes fixes as users argue who broke it—React or Next
TLDR: A max‑severity flaw let attackers run code on Next.js servers using the App Router, now patched across 15.x and 16.x with canary users told to downgrade. Comments erupted into a blame war—React vs Next—plus memes, shade at canary builds, and urgent pleas to update immediately.
A scary bug hit Next.js sites using the App Router: a flaw in React Server Components (a feature that renders parts of your app on the server) could let attackers run their own code on your server—aka remote code execution. Severity? CVSS 10.0: the max‑level red alert. The fix is out across Next.js 15.x and 16.x (and you should upgrade now), while anyone on experimental 14.3.0 “canary” is told to downgrade to stable. There’s no switch to turn this off, and the team is keeping details light to protect those who haven’t patched. Credit goes to researcher Lachlan Davidson for the responsible heads‑up.
But the real show is the comments. One camp is yelling “it’s a React bug,” another is convinced Next.js messed up, and everyone’s stress‑posting memes. Over on HN, users dropped spicy lines like “same as the React RCE,” while others dunked on teams shipping canary builds to production: “Canary means bird, not business.” Some devs flexed they’re safe because they use the older Pages Router or Edge Runtime, while App Router users scrambled for patches. The mood? A mix of blame game, gallows humor (“RCE = Really Cooked Ecommerce”), and urgent upgrade guides—plus debates about whether holding back technical details is smart caution or corporate spin. Drama level: full stack.
Key Points
- •Critical RSC protocol vulnerability enables remote code execution (CVSS 10.0) in unpatched environments.
- •Issue originates in upstream React (CVE-2025-55182); Next.js advisory tracks downstream impact as CVE-2025-66478.
- •Affected: Next.js 15.x, 16.x, and 14.3.0-canary.77+ with App Router and RSC; not affected: 13.x, 14.x stable, Pages Router, Edge Runtime.
- •Patched Next.js versions: 15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7, and 16.0.7 with hardened RSC implementation.
- •No configuration-based mitigation; users must upgrade (or downgrade canary to latest stable 14.x) to resolve.