[SECURITY] CVE-2025-66478: Critical RCE in Next.js - Immediate Patch Required

[vasconceloscezar]

Vulnerability Details

CVE ID: CVE-2025-66478
CVSS Score: 10.0 (Critical)
Type: Remote Code Execution (RCE)

Impact

Attackers can execute arbitrary code on servers running Next.js with App Router via malicious RSC protocol requests.

Required Action

Upgrade Next.js from 16.0.7 → 16.0.8

npm install next@16.0.8

Priority

CRITICAL - No workaround available. Upgrade immediately.

[vasconceloscezar]

Investigation Results

Current Status: ✅ Repository is already patched

Findings

• Current Next.js version: 16.0.7
• NPM registry check: 16.0.8 does not exist
• Official patched version: 16.0.7 (per Next.js Security Advisory)

Evidence

According to the official Next.js security advisory, the patched versions for CVE-2025-66478 are:

• Next.js 15.x: 15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7
• Next.js 16.x: 16.0.7 ← Current version in this repo

NPM Registry Verification

$ npm view next versions | grep 16.0
16.0.3, 16.0.4, 16.0.5, 16.0.6, 16.0.7

$ npm view next@latest version
16.0.7

There is no 16.0.8 release available.

Conclusion

No action required. This repository is already running the patched version (16.0.7) and is protected against CVE-2025-66478.

The issue description appears to contain incorrect information about the target version. The correct patched version for the 16.0.x branch is 16.0.7, not 16.0.8.

Recommendation

This issue can be closed as the vulnerability is already mitigated.