tag
Nextjs
React Server Components Flight-Protocol Prototype Pollution RCE — "React2Shell" (CVE-2025-55182)
CVE-2025-55182, dubbed "React2Shell", is a critical unauthenticated remote code execution vulnerability in React Server Components' Flight protocol deserialization. The Flight protocol serializes/deserializes component data exchanged between client and…
Next.js Vendored picomatch Vulnerable Dependency — CVE-2026-33671
Next.js 16.2.4 vendors a copy of the picomatch glob-matching library inside its own compiled output at nodemodules/next/dist/compiled/picomatch/, pinned to version 4.0.3, which is affected by CVE-2026-33671. Because the vendored copy has its package.json…
Next.js unstable_cache Object-Argument Cache-Key Collision
Next.js's unstablecache() API derives its cache key by running JSON.stringify() over the arguments passed to the cached function. When a route handler passes a stock request-wrapper object — a Request, URLSearchParams, or FormData instance — directly into…