Next.js Releases Scanner to Detect and Fix Apps Affected by React2Shell Vulnerability
Next.js developers now have access to a new tool to address the critical "React2Shell" vulnerability. This scanner provides a one-line solution for development teams to identify vulnerable versions of Next.js and React Server Components (RSC) and apply…
Next.js developers now have access to a new tool to address the critical "React2Shell" vulnerability. This scanner provides a one-line solution for development teams to identify vulnerable versions of Next.js and React Server Components (RSC) and apply necessary security updates promptly.
Vercel Labs has released a dedicated command-line tool, fix-react2shell-next , designed to automatically detect and patch applications impacted by the Remote Code Execution (RCE) flaw, tracked as CVE-2025-66478.
The fix-react2shell-next tool is capable of handling complex project structures, including monorepos. It works by recursively scanning all package.json files within a project directory to identify dependencies that match known vulnerable versions.
The tool ensures deterministic version updates, mitigating human error that can occur with manual updates, especially in large projects with multiple packages. It identifies the current version in use and updates it to the safe patch level recommended by official security advisories.
Upon identifying vulnerable packages, the tool automatically updates the package.json files and refreshes the project's lockfile using the detected package manager (npm, yarn, pnpm, or bun). This automation significantly reduces the time required to secure applications against the React2Shell RCE.
The vulnerability affects multiple versions of Next.js and React Server Components. The tool checks for specific versions and applies the corresponding patches:
Current Version Range Required Patched Version
Next.js developers now have access to a new tool to address the critical "React2Shell" vulnerability.
15.0.0 – 15.0.4 Update to 15.0.5
15.1.0 – 15.1.8 Update to 15.1.9
15.2.0 – 15.2.5 Update to 15.2.6
15.3.0 – 15.3.5 Update to 15.3.6
15.4.0 – 15.4.7 Update to 15.4.8
16.0.0 – 16.0.6 Update to 16.0.7
For users on canary builds, version 15.6.0-canary.58 and 16.1.0-canary.12 are the safe targets. Older versions (Next.js 14.x) should downgrade to 14.3.0-canary.76 or upgrade to the stable 15.0.5. The tool also updates react-server-dom-webpack , react-server-dom-parcel , and react-server-dom-turbopack .
19.0.0 → Update to 19.0.1 19.1.0, 19.1.1 → Update to 19.1.2
Developers can run the tool immediately without installing it globally using npx .
Interactive Mode: To check your project and choose whether to apply fixes: npx fix-react2shell-next Auto-Fix Mode: For Continuous Integration (CI) pipelines or non-interactive environments: npx fix-react2shell-next --fix Dry Run: To see a report of what would be changed without modifying any files: npx fix-react2shell-next --dry-run
With active exploitation attempts likely, organizations running affected versions of Next.js or React Server Components are urged to run this scanner immediately to ensure their applications are not exposed to remote attacks.
Based on reporting by GBHackers.