Next.js Released a Scanner to Detect and Update Apps Impacted by React2Shell Vulnerability
A command-line tool, fix-react2shell-next , has been released to assist developers in promptly detecting and resolving the critical "React2Shell" vulnerability ( CVE-2025-66478 ).
A command-line tool, fix-react2shell-next , has been released to assist developers in promptly detecting and resolving the critical "React2Shell" vulnerability ( CVE-2025-66478 ).
This tool provides a straightforward solution to identify vulnerable versions of Next.js and React Server Components (RSC) and automatically apply necessary security updates from the latest Next.js release.
The tool enhances the remediation process by scanning all package.json files within a project recursively.
This design ensures compatibility across both standard repositories and complex monorepos managed by npm, yarn, pnpm, or bun.
The scanner systematically verifies the installed versions of next , react-server-dom-webpack , react-server-dom-parcel , and react-server-dom-turbopack , reducing the risk of human error associated with manual checks.
Once vulnerable packages are identified, the tool patches them to the secure versions as specified by the official GitHub advisory .
It then updates the lockfile using the detected package manager to ensure the fix is properly locked in, upgrading, for example, a vulnerable Next.js 15.1.0 installation directly to the fixed 15.1.9 release.
The vulnerability affects multiple release lines of Next.js and React RSC packages as reported by GitHub.
Developers using any version within the "Affected" ranges below should upgrade immediately.
The tool enhances the remediation process by scanning all package.json files within a project recursively.
Package Affected Version Range Patched Version
Next.js 15.0.0 – 15.0.4 15.0.5
15.1.0 – 15.1.8 15.1.9
15.2.0 – 15.2.5 15.2.6
15.3.0 – 15.3.5 15.3.6
15.4.0 – 15.4.7 15.4.8
16.0.0 – 16.0.6 16.0.7
React RSC 19.0.0 19.0.1
19.1.0 – 19.1.1 19.1.2
Developers can execute the tool directly using npx . For an interactive experience that requires confirmation before implementing changes, users can run the standard command.
In continuous integration (CI) environments or automated workflows where prompts are not feasible, the fix flag enables the tool to apply patches automatically.
Teams wishing to audit their project without making immediate changes can use the dry-run flag to generate a report of the updates.
A json flag is also available for scripting purposes, allowing security teams to integrate the output with other monitoring tools. To execute the interactive fix, use the following command in your terminal: npx fix-react2shell-next .
Based on reporting by Cyber Security News.