I have my old personal site deployed on a VM and was running Next.js 16.0.1 I think? Anyway, I did see people trying to exploit it in my logs, and I've seen some PoCs on GitHub as well. This is certainly very serious!

I found this vercel bulletin very helpful - https://vercel.com/kb/bulletin/react2shell

vercel.com

React2Shell Security Bulletin | Vercel Knowledge Base

CVE-2025-55182 is a critical vulnerability in React, Next.js, and other frameworks that requires immediate action

https://x.com/vercel_dev/status/1998049804119843048

https://x.com/vercel_dev/status/1998240590379860222?s=20

https://x.com/vercel_dev/status/1998449348867404055?s=20

After the recent Critical Security Vulnerability, I have fixed it in my client’s project using React2Shell bulletin by vercel. The vercel dashboard is still showing the same Vulnerability.

As per the official doc, React2Shell bulletin by vercel, CVE-2025-66478 by nextjs and react.dev blog I have upgraded Next.js from 16.0.0 to 16.0.7

but, dashboard still showing Vulnerability(as shown below). Even npx fix-react2shell-next is returning No Vulnerability Found.

Not sure what I’m missing. Please help me fix this issue.

Hi @techchintan, are all the projects in this list have been fixed manually by you? Are there any open PR's on them?

The warning is about "preview" deployments, which ideally your customers won't access.

To fix this message, ensure you have Vercel Authentication enabled in your project settings:

I’m having the same problem as @techchintan.

I confirmed that one of my projects has been patched for all active deployments (I am in the middle of handling for all projects). However, that project is still showing up under the “Vulnerable Projects” list.

Why do we need to enable Vercel Authentication in order for this warning to clear? I have already patched all deployments with the latest version of Next.

Hi @dm-greenlight, thanks for elaborating.

I think the reason is that some old preview deployments are still using the vulnerable versions. This is why enabling Vercel Authentication will prevent "public users" from accessing vulnerable versions.

I hope this answers your question.

Thanks for your reply, Anshuman.

1. No, I used the command npx fix-react2shell-next, and there is no open PR.
2. Yes, it seems you are correct. After enabling “Vercel Authentication”, errors are resolved.

Thanks again, @anshumanb, for the heads up.

No, this is not correct. For these projects, I have no active vulnerable deployments. Both my preview and production deployments include the patched versions.

Hi @dm-greenlight ,

Are your projects enabled with Vercel Authentication?

Recently, Vercel improved the vulnerability fix listing view on the dashboard, making it much clearer and more specific.

If you could share the fix list for your project, it would help us understand the problem better.

Looking forward to your response.

Best, Chintan

No, Vercel authentication is not enabled. That is the whole point I’m trying to make. I have patched all of the deployments. I do not want to have to enable Vercel authentication. It should not be necessary if all the deployments are patched, correct?

I agree with your point that it’s not essential to enable it.

However, as @anshumanb mentioned, some older preview deployments are still using vulnerable versions. If you enable Vercel Authentication for a few hours and then disable it again, the warning will be resolved on the Vercel dashboard. I tried this for both of my projects, and it worked.

Sounds like a Vercel bug then.

Hi @dm-greenlight, if you are sure that all deployments are using the patched versions, feel free to ignore the warning.

I'll share with the team and maybe there's a case/reason I'm missing.

Thanks for bringing it up.

I think I figured it out now.

Apparently, there has been an update. Any versions prior to 16.0.9 are now considered vulnerable.

I updated to 16.0.8 as originally advised. But now even that version is considered vulnerable.

Once I updated to 16.0.9, the warning has cleared for me.

Enabling the “Vercel Authentication” option seems to mess with NextAuth, which breaks both production and preview deployments of one of my apps. It would be nice if there was an easy way to delete all old deployments with the vulnerability instead (using the API seems annoying as there are some rate limits to how many deployments can be deleted at once).

16.0.8 contains the patch for React2Shell but there were two other vulnerabilities announced today, which is why the second update was needed. This pattern is typical as one security incident attracts a lot of attention from security researchers who then find new exploits.

You can read more about the newer CVEs here

https://community.vercel.com/t/react-server-components-security-update-dos-and-source-code-exposure/29708

Vercel Community

React Server Components security update: DoS and Source Code Exposure

Two additional vulnerabilities in React Server Components have been identified: a high-severity Denial of Service ( CVE-2025-55184 ) and a medium-severity...

My project has been upgraded to the latest versions of React and Next.js, but Vercel still shows a security warning about React2Shell. I have also enabled Vercel Authentication. So why is it still affected? There is an Upgrade button, but when I click it, it throws an error, so now I can’t check where exactly the project is having issues.

Here's the latest:

https://vercel.com/changelog/summaries-of-cve-2025-59471-and-cve-2025-59472

Vercel

Summaries of CVE-2025-59471 and CVE-2025-59472 - Vercel

Two denial-of-service vulnerabilities were discovered in self-hosted Next.js applications that can cause server crashes through memory exhaustion under specific configurations.