-CVE-2025-55182

🔍 GitHub CVE Scanner - Usage Guide Script to scan GitHub repositories for known vulnerabilities in React and Next.js projects. 📋 Detected Vulnerabilities The scanner checks the following CVEs: CVE-2025-55182 : Vulnerability in React Server Components Affects: React 19.0.0, 19.1.0, 19.1.1, 19.2.0...

CVE-2025-55182-analysis

I. Vulnerability Overview In the past couple of days, there has been widespread discussion about a deserialization RCE vulnerability in React. The official CVSS score is a full 10.0, on par with Log4j. Rumors quickly spread claiming it is the "Log4j of modern frontend," causing panic among...

CLSA-2026-1793295328 TuxCare security update for react-server-dom-turbopack (2 CVEs)

TuxCare rebuilt react-server-dom-turbopack to address 2 CVEs. Fixed in 19.0.0-tuxcare.2...

CLSA-2026-1792161643 TuxCare security update for react-server-dom-turbopack (4 CVEs)

TuxCare rebuilt react-server-dom-turbopack to address 4 CVEs. Fixed in 19.2.0-tuxcare.7...

CLSA-2026-1792161642 TuxCare security update for react-server-dom-turbopack (1 CVE)

TuxCare rebuilt react-server-dom-turbopack to address 1 CVE. Fixed in 19.2.0-tuxcare.6...

PT-2026-124198

TuxCare rebuilt react-server-dom-turbopack to address 4 CVEs. Fixed in 19.2.0-tuxcare.7...

PT-2026-124197

TuxCare rebuilt react-server-dom-turbopack to address 1 CVE. Fixed in 19.2.0-tuxcare.6...

WS-2026-0170

react-server-dom-webpack/-turbopack 19.0.0-19.0.8 and 19.0.0 beta/rc builds, react-server-dom-webpack/-turbopack/-parcel 19.1.0-19.1.9, 19.2.0-19.2.8, 19.3.0 and 19.x canary builds before the fix: the React Server Components response writer emits typed arrays as views over their whole underlying...

WS-2026-0151

react-server-dom-webpack/-turbopack 19.0.0-19.0.8 and 19.0.0 beta/rc builds, react-server-dom-webpack/-turbopack/-parcel 19.1.0-19.1.9, 19.2.0-19.2.8, 19.3.0 and 19.x canary builds before the fix: the Server Functions reply decoder rescans the whole submitted FormData for referenced form data and...

react2shell-scanner

react2shell-scanner Triage scanner for CVE-2025-55182 R...

Exploit for Improper Authorization in Vercel Next.Js

React2Shell Scanner CVE-2025-29927 — Next.js Server Ac...

next.js: Next.js: Information disclosure via security fix bypass in middleware with Turbopack

A flaw was found in Next.js. A remote unauthenticated attacker could exploit a bypass in a security fix when using middleware.ts with Turbopack. This vulnerability could lead to the disclosure of sensitive information...

Linux Distros Unpatched Vulnerability : CVE-2026-64642

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Next.js is a React framework for building full-stack web applications. In versions 16.0.0 through 16.2.10, crafted requests targeting Next.js applications using...

CVE-2026-64642

A flaw was found in Next.js, a React framework. A remote attacker can bypass authentication in Next.js applications using App Router built with Turbopack and a single entry in config.i18n.locales by sending crafted requests. This vulnerability allows for unauthorized access, leading to a high...

CVE-2026-64642

Next.js is a React framework for building full-stack web applications. In versions 16.0.0 through 16.2.10, crafted requests targeting Next.js applications using App Router built with Turbopack and a single entry in config.i18n.locales can bypass middleware/proxy based authentication. This issue h...

CVE-2026-64642 Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale

Next.js is a React framework for building full-stack web applications. In versions 16.0.0 through 16.2.10, crafted requests targeting Next.js applications using App Router built with Turbopack and a single entry in config.i18n.locales can bypass middleware/proxy based authentication. This issue h...

CVE-2026-64642

Next.js is a React framework for building full-stack web applications. In versions 16.0.0 through 16.2.10, crafted requests targeting Next.js applications using App Router built with Turbopack and a single entry in config.i18n.locales can bypass middleware/proxy based authentication. This issue h...

CVE-2026-64642 Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale

Next.js is a React framework for building full-stack web applications. In versions 16.0.0 through 16.2.10, crafted requests targeting Next.js applications using App Router built with Turbopack and a single entry in config.i18n.locales can bypass middleware/proxy based authentication. This issue h...

EUVD-2026-49382

Next.js is a React framework for building full-stack web applications. In versions 16.0.0 through 16.2.10, crafted requests targeting Next.js applications using App Router built with Turbopack and a single entry in config.i18n.locales can bypass middleware/proxy based authentication. This issue h...

CVE-2026-64642

CVE-2026-64642 affects Next.js (16.0.0–16.2.10) where crafted requests to App Router apps built with Turbopack and a single locale entry in config.i18n.locales can bypass middleware or proxy authentication. Root cause: improper handling of authentication flow under specific App Router configurati...