Hahn-Solo Product Management
  • Dashboard
  • Technologies
  • Competitors
  • Tasks
Theme
Basic Information
Status
Open
Priority
Now
Category
Security
Repo
SCB PM
Effort
Trivial
Task ID
T-26199E72
Details
Verify Next.js 15.5.10 RCE Patch Coverage
Confirm that Next.js 15.5.10 includes the full fix for CVE-2025-55182 (CVSS 10.0, RCE via RSC). Check the Next.js 15.5.x changelog and GitHub security advisories. If 15.5.10 is not fully patched, bump the Next.js floor to the first fully-patched 15.5.x version or accelerate the Next.js 16 upgrade.
Why
CVE-2025-55182 is actively exploited in the wild (766+ hosts breached as of April 2026). The React side is patched at 19.2.4 (which the starters use), but the Next.js side was initially fixed in 16.0.7 with backports to various 15.x lines. The exact 15.5.x patch version needs confirmation.
Evidence
Next.js research report § Security; The Hacker News exploitation report April 2026
Details
Context: CVE-2025-55182 (React2Shell) is a CVSS 10.0 RCE affecting React Server Components in Next.js 15.x-16.x App Router. The initial fix shipped in Next.js 16.0.7 with backports across the 15.x lines. The starters use `next@^15.5.10`. We need to confirm that 15.5.10 specifically includes the complete RCE fix (the initial patches in some 15.x lines were incomplete and required subsequent updates). React 19.2.4 (used by the starters) includes the React-side fix.

Steps:
1. Check the Next.js GitHub releases page for 15.5.10 release notes — look for references to CVE-2025-55182 or CVE-2025-66478.
2. Cross-reference with the Vercel security advisory and the Next.js blog post on CVE-2025-66478.
3. If 15.5.10 is fully patched: document the finding and close this task.
4. If 15.5.10 is NOT fully patched: immediately bump the `next` dependency to the first fully-patched 15.5.x version in all starters, or escalate the Next.js 16 upgrade.

Acceptance criteria:
Written confirmation that Next.js 15.5.10 includes the complete CVE-2025-55182 fix, OR
All starters bumped to a version that does include the complete fix
Finding documented in a PR description or issue comment

Risks: If 15.5.10 is not fully patched, the starters are currently exposing new adopters to an actively-exploited critical RCE. This would escalate the Next.js 16 upgrade from "Now" to "Emergency."
Source Report
reports/product-management/scb/2026-04-05-scb-pm.md
Report date: Apr 5, 2026