‼️ Next.js Security Update: December 11, 2025

Two new React Server Components bugs affect Next.js App Router apps: a DoS infinite-loop hang (CVE-2025-55183, CVE-2025-55184 / fixed fully as CVE-2025-67779) and Server Function source-code exposure (CVE-2025-55183).

No RCE, no workaround—upgrade to a patched Next.js version (e.g., 14.2.35, 15.0.7+, 16.0.10+; canary patched too). Pages Router isn’t affected.

https://nextjs.org/blog/security-update-2025-12-11