Upgrading Next alone is ok to make you safe from the React2Shell exploit

Next.js bundles React internally on the server-side, and that contains the portion of React that had the vulnerability, so upgrading Next is all that's needed.

It's possible to have a Next.js app that has no react dependency in its package.json at all, which is why two separate CVEs were issued: one for react, and one for the bundled version of React inside Next.js.

Modern developer tooling requires the package.json to specify all dependencies that are referenced in code, so having react in your package.json is normal, but the version that actually gets used on the server is controlled by Next.

Thanks, that makes sense.

I have one more doubt — what if I manually update react and react-dom to the patched versions anyway? Would that cause any issues or is it completely optional since Next already bundles the secure version internally?

Also, I’m using several other React-based npm packages in my project, such as:

1
react-beautiful-dnd: 13.1.0
2
react-datepicker: 6.1.0
3
react-dropzone: 14.2.3
4
react-fast-marquee: 1.6.2
5
react-google-recaptcha-v3: 1.10.1
6
react-multi-carousel: 2.8.4
7
react-xls: 0.1.1
8

…and many more.

Is there a recommended way to confirm whether all these third-party packages are safe from the current React2Shell vulnerability, or if any of them require updates as well?