vercel Next.js React Flight Protocol deserialization 🚫 [False Positive]

Noticeinfo

⚠️ Further investigation has shown that this issues is a false-positive. Please review the sources mentioned and consider not using this entry at all.

Productinfo

Type

• JavaScript Library

Vendor

• vercel

Name

• Next.js

Timelineinfo

12/02/2025 CVE reserved
12/03/2025 +1 days Advisory disclosed
12/03/2025 +0 days VulDB entry created
12/09/2025 +5 days VulDB entry last update

Sourcesinfo

Advisory: github.com
False Positive: Yes

CVE: CVE-2025-66478 (🔒)
GCVE (CVE): GCVE-0-2025-66478
GCVE (VulDB): GCVE-100-334240
EUVD: 🔒
CERT Bund: WID-SEC-2025-2738 - Vercel Next.js und React Server Components (React2Shell): Schwachstelle ermöglicht Codeausführung

Entryinfo

Created: 12/03/2025 23:53
Updated: 12/09/2025 00:22
Changes: 12/03/2025 23:53 (52), 12/04/2025 05:32 (2), 12/04/2025 12:29 (3), 12/05/2025 22:13 (6), 12/09/2025 00:22 (1)
Complete: 🔍
Cache ID: 216::103

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion

Do you know our Splunk app?

Download it now for free!