[RCE Vulnerability] React Server Functions/Next.js Exploited – Deno Deploy Safe
A researcher cracks open React's Server Functions, unleashing remote code execution on Next.js apps. Deno Deploy dodged the bullet with instant mitigations – but Vercel users? Patch fast.
Dev DigestApr 14, 20264 min read
⚡ Key Takeaways
Critical RCE (CVE-2025-55182) and DoS (CVE-2025-55184) hit React Server Functions and Next.js App Router.𝕏
Deno Deploy auto-mitigated at runtime; other hosts must patch libraries urgently.𝕏
Vulnerability stems from lax RSC serialization; upgrade to fixed versions now.𝕏
The 60-Second TL;DR
Critical RCE (CVE-2025-55182) and DoS (CVE-2025-55184) hit React Server Functions and Next.js App Router.
Deno Deploy auto-mitigated at runtime; other hosts must patch libraries urgently.
Vulnerability stems from lax RSC serialization; upgrade to fixed versions now.
