{"action":"Upgrade next to 15.0.5 or later.","affected":[{"fixed":"15.0.5","introduced":"14.3.0-canary.77"},{"fixed":"15.1.9","introduced":"15.1.0-canary.0"},{"fixed":"15.2.6","introduced":"15.2.0-canary.0"},{"fixed":"15.3.6","introduced":"15.3.0-canary.0"},{"fixed":"15.4.8","introduced":"15.4.0-canary.0"},{"fixed":"15.5.7","introduced":"15.5.0-canary.0"},{"fixed":"16.0.7","introduced":"16.0.0-canary.0"}],"component":"next","cve_ids":[],"ecosystem":"npm","exploited":false,"fixed_versions":["15.0.5","15.1.9","15.2.6","15.3.6","15.4.8","15.5.7","16.0.7"],"ghsa_id":"GHSA-9qr9-h5gf-34mp","id":"tcs_01M5KFGQRBDP01431MK2TZFMEX","modified_at":"2026-09-10T03:50:31.796397588Z","published_at":"2025-12-03T19:07:11Z","references":["https://osv.dev/vulnerability/GHSA-9qr9-h5gf-34mp","https://github.com/facebook/react/security/advisories/GHSA-fv66-9v8q-g76r","https://github.com/vercel/next.js/security/advisories/GHSA-9qr9-h5gf-34mp","https://github.com/vitejs/vite-plugin-react/security/advisories/GHSA-fmh4-wr37-44fp","https://nvd.nist.gov/vuln/detail/CVE-2025-55182","https://github.com/vercel/next.js"],"severity":{"label":"critical","score":10},"sources":[{"source":"osv","source_id":"GHSA-9qr9-h5gf-34mp","url":"https://osv.dev/vulnerability/GHSA-9qr9-h5gf-34mp"}],"summary":"Next.js is vulnerable to RCE in React flight protocol"}