Juntai Park @arkjun@hackers.pub
Public

https://nextjs.org/blog/security-update-2025-12-11

Next.js의 추가 보안 업데이트가 있습니다.

지난주에 CVE-2025-66478 보안취약점때문에 부랴부랴 패키지 업데이트한 기억이 있는데, 이번에도 몇개 패치되었네요.

Next.js를 App Router 방식으로 쓰는 개발자분들은 잊지 말고 업데이트하셔요.

fix-react2shell-next 패키지로 검사 및 업데이트 가능합니다.

❯ npx fix-react2shell-next

fix-react2shell-next - Next.js vulnerability scanner

Checking for 4 known vulnerabilities:

  - CVE-2025-66478 (critical): Remote code execution via crafted RSC payload
  - CVE-2025-55184 (high): DoS via malicious HTTP request causing server to hang and consume CPU
  - CVE-2025-55183 (medium): Compiled Server Action source code can be exposed via malicious request
  - CVE-2025-67779 (high): Incomplete fix for CVE-2025-55184 DoS via malicious RSC payload causing infinite loop

...

Next.js Security Update: December 11, 2025

Two additional vulnerabilities have been identified in React Server Components. Users should upgrade to patched versions immediately.

nextjs.org

2
0
0

😲

2 people reacted.

洪 民憙 (Hong Minhee)

洪 民憙 (Hong Minhee)

@hongminhee@hackers.pub

Hi, I'm who's behind Fedify, Hollo, BotKit, and this website, Hackers' Pub! My main account is at @hongminhee洪 民憙 (Hong Minhee) :nonbinary:.

Fedify, Hollo, BotKit, 그리고 보고 계신 이 사이트 Hackers' Pub을 만들고 있습니다. 제 메인 계정은: @hongminhee洪 民憙 (Hong Minhee) :nonbinary:.

Fedify、Hollo、BotKit、そしてこのサイト、Hackers' Pubを作っています。私のメインアカウントは「@hongminhee洪 民憙 (Hong Minhee) :nonbinary:」に。

조내일

조내일

@tomorrowcho@hackers.pub