CVE-2025-55182
Published Dec 3, 2025
Last updated 5 months ago
- Description
- A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.
- Source
- cve-assign@fb.com
- NVD status
- Analyzed
- Products
- react, next.js
CVSS 3.1
- Type
- Secondary
- Base score
- 10
- Impact score
- 6
- Exploitability score
- 3.9
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
- Severity
- CRITICAL
Data from CISA
- Vulnerability name
- Meta React Server Components Remote Code Execution Vulnerability
- Exploit added on
- Dec 5, 2025
- Exploit action due
- Dec 26, 2025
- Required action
- Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- nvd@nist.gov
- CWE-502
Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.
- Hype score
29
900+ companies hacked. One vulnerability. One automated pipeline. Hackers are using AI + Telegram bots to exploit React2Shell (CVE-2025-55182) at scale stealing credentials, cloud access, and financial data in minutes. This isn’t random hacking. It’s organized, automated, a
@MarcelVelica
28 Apr 2026
36363 Impressions
2 Retweets
141 Likes
2 Bookmarks
2 Replies
0 Quotes
NEW THREAT INTEL: Bissa Scanner -- AI-orchestrated mass exploitation of CVE-2025-55182 (Next.js RCE) and CVE-2025-9501 (W3 Total Cache). 9 detections, 29 IOCs. https://t.co/bVuLbIIj1p #ThreatIntel #CyberSecurity #CVE #Nextjs #WordPress https://t.co/w9wVc3LQZj
@threadlinqs
27 Apr 2026
233 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
Intel Report [CRITICAL] - A newly exposed threat actor infrastructure has revealed a large-scale automated exploitation campaign leveraging a critical vulnerability in Next.js, tracked as CVE-2025-55182 and referred to as "React2Shell," to compromise... https://t.co/DIJWLbVY4k
@EnigmaGlobalSW
26 Apr 2026
175 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
🚨 React2Shell (CVE-2025-55182) ile Büyük Çaplı Saldırı: 900+ Şirket Tehlikeye Girdi https://t.co/dwbVjtRAwP @LinkedIn aracılığıyla
@AturcDestek
25 Apr 2026
134 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
🚨 Critical Next.js CVE-2025-55182 is being exploited live. Allows app takeover & credential theft. If you deployed via v0/Lovable, verify your version. AI won't auto-patch this. We flag this in VibeShield scans. Update Next.js now! 🔐 #NextJS
@vibeshield
24 Apr 2026
134 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
🚨 One hacker. One Telegram bot. 900+ companies breached. Bissa Scanner exploited CVE-2025-55182 (React2Shell) at internet scale AWS, OpenAI, Stripe keys all stolen. Full breakdown 👇 https://t.co/sfIX76Be0b #CyberSecurity #ThreatIntel #InfoSec https://t.co/tz1puWxGgd
@Xploitzone_01
24 Apr 2026
139 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
Dr. Tube’s AI-assisted Bissa scanner exploited 900+ companies using React2Shell (CVE-2025-55182) to steal 30,000 .env files. See the AI-led attack workflow. #AICyberAttack #BissaScanner #React2Shell #InfoSec #CyberSecurity #CloudSecurity #DrTube https://t.co/3HmFuBFogI https:/
@the_yellow_fall
24 Apr 2026
434 Impressions
0 Retweets
6 Likes
2 Bookmarks
0 Replies
1 Quote
An exposed server reveals AI-driven mass exploitation using Bissa Scanner and React2Shell (CVE-2025-55182), confirming 900+ breaches and harvesting thousands of credentials with Claude Code and Telegram bots. #BissaScanner #AIExploitation https://t.co/2dxCJ3CgRt
@TweetThreatNews
23 Apr 2026
269 Impressions
0 Retweets
1 Like
0 Bookmarks
0 Replies
0 Quotes
🔴 CVE-2025-55182 (React2Shell) RCE in React Server Components. no auth. deterministic. Flight checks "has .then?" to detect Promises Object.prototype.then = () => { /* full control */ } write-up: https://t.co/51g0s2jcWJ repo: https://t.co/R6joVAWJTL @reactjs https:/
@devianntsec
23 Apr 2026
2 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
🔴 CVE-2025-55182 (React2Shell) RCE en React Server Components. sin auth. determinista. probabilidad 1. Flight pregunta "¿tiene .then?" para detectar Promises. Object.prototype.then = () => { /* control total */ } https://t.co/a9k5Hx4fka https://t.co/R6joVAWJTL
@devianntsec
23 Apr 2026
4 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
Claude Code + OpenClaw used with the React2Shell (CVE-2025-55182) bug to exploit 900+ targets extracting "tens of thousands of .env files yielding credentials across AI, cloud, payments, messaging, and databases." Threat actor used Telegram for alerting. https://t.co/lFNXznNMzv
@Jeremy_Kirk
22 Apr 2026
387 Impressions
1 Retweet
3 Likes
2 Bookmarks
0 Replies
0 Quotes
Bissa scanner: open server exposes AI-assisted credential harvesting chaining Claude Code + OpenClaw with React2Shell (CVE-2025-55182). Full operator pipeline caught live. https://t.co/QWVsaNVwQO #infosec #AI #CVE
@CyberDaily_News
22 Apr 2026
185 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
React2Shell（CVE-2025-55182）を悪用し.envファイルを中心に狙った大規模な認証情報窃取（最大のターゲットはAnthropic・Google・OpenAI・Mistral等の生成AIのAPIキー）オペレーションに関する新たなレポートが公開されて
@MalwareBibleJP
22 Apr 2026
985 Impressions
2 Retweets
11 Likes
5 Bookmarks
0 Replies
0 Quotes
Unit 42 reports a 282% increase in Kubernetes attacks. Stolen tokens and CVE-2025-55182 led to millions in thefts from crypto exchanges. https://t.co/2TiznewFv5 #Security #CloudSecurity #Kubernetes #NorthKorea - Follow for more
@techzine
20 Apr 2026
123 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
Unit 42 ziet Kubernetes-aanvallen met 282% stijgen. Gestolen tokens en CVE-2025-55182 leidden tot miljoenendiefstallen bij cryptobeurzen. https://t.co/FIt7qbDGom #Security #CloudSecurity #Kubernetes #NoordKorea #PaloAltoNetworks
@Techzinenlbe
20 Apr 2026
154 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
A critical remote code execution vulnerability (CVE-2025-55182) affects React Server Components 19.0.0–19.2.0. https://t.co/xRdmnRxePU #CyberSecurity #ReactJS #RCE #CVE202555182 #ReactSecurity #WebSecurity #InfoSec #PatchNow #DevSecOps https://t.co/68BQw1kuvk
@redsecuretech
18 Apr 2026
171 Impressions
1 Retweet
1 Like
0 Bookmarks
0 Replies
0 Quotes
【フロカン名古屋は5/9🦘】 フロントエンドカンファレンス名古屋のトークをご紹介！ 「CVE-2025-55182の徹底解析と実践的防御設計」 坂津 潤平さん （@saka2jp） https://t.co/IVwzX3VUdK #fec_nagoya
@fec_nagoya
18 Apr 2026
440 Impressions
0 Retweets
2 Likes
0 Bookmarks
0 Replies
1 Quote
حملة ضخمة تستغل ثـ ـغرة CVE-2025-55182 لاخـ ـتـ راق تطبيقات Next.js وسـ ـرقة بيانات حسـ ـاسة التفاصيل... https://t.co/5hMouXybNi #مركز_الأمن_السيبراني_للابحاث_والدراسات https://t.co/
@ccforrs
16 Apr 2026
74 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
A insight into CVE-2025-55182 that was exploited in a 🇳🇬Bank ● CVSS 10, that's *Critical* risk. ● It has a EPSS of 66.27%, which is the probability of being exploited in the next 30 days. ● CVE-2025-55182 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H Explan
@WaleMicaiah
16 Apr 2026
144 Impressions
0 Retweets
0 Likes
0 Bookmarks
1 Reply
0 Quotes
35 AI-generated CVEs disclosed in March. 6 in January. A 5x jump in 60 days. CVE-2025-55182 alone breached 766 production hosts. If your coding agent runs in someone else's cloud, their sandbox bug is your incident. Managed OpenClaw keeps Claude Code behind your firewall.
@musiol_martin
15 Apr 2026
147 Impressions
0 Retweets
1 Like
0 Bookmarks
0 Replies
0 Quotes
PoC-CVE-2025-55182 #exploit Proof-of-concept exploit for CVE-2025-55182 (React2Shell) https://t.co/zrUupnstCv https://t.co/oMuXh1odV5
@Sadishyt
15 Apr 2026
166 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
“Mhamaya ki Maaya” 6th bounty 🎯 6th in a row for Unauthenticated RCE (CVE-2025-55182). Big thanks to Bhagirath Saxena for guidance 🙌 Open for collab with serious full-time bug hunters. Let’s build 🔥 #BugBounty #Infosec #RCE #EthicalHacking #SecurityResearch htt
@n00bhack3rr
15 Apr 2026
151 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
🔒 #CyberSecurity How to Defend Against React2Shell (CVE-2025-55182) Attacks on Next.js "A recent wave of attacks has targeted the web development ecosystem, specifically…" 🔗 https://t.co/CqrNNaXpHf #CyberSecurity #ThreatIntel #incidentresponse #ransomware #forensics
@SecurityAr58409
15 Apr 2026
47 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
CVE-2025-55182 is actively burning Next.js infrastructure. 766 confirmed hosts hit, attackers walking out with .env files: DB creds, SSH keys, AWS secrets. Check your middleware auth config. This isn't theoretical — it's happening right now. #webappsec #pentest
@RedTeamGuides
14 Apr 2026
2 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
React2Shell (CVE-2025-55182) is already being actively exploited against Next.js systems worldwide. Don’t just hear about it, understand it: https://t.co/nkv1selTvQ @three_cube @DI0256 @IamSmouk @co11ateral https://t.co/cnEKn1Fb1c
@_aircorridor
14 Apr 2026
1519 Impressions
8 Retweets
21 Likes
14 Bookmarks
0 Replies
0 Quotes
Stripe keys, SSH credentials, cloud tokens, and database strings were harvested from hundreds of web servers through one unpatched vulnerability. We analysed how UAT-10608 exploits React2Shell (CVE-2025-55182) and how to address this. Read more: https://t.co/cZIDSeq23A
@PurpleIrisHQ
14 Apr 2026
177 Impressions
7 Retweets
7 Likes
1 Bookmark
0 Replies
0 Quotes
#Hackers #Exploit CVE-2025-55182 to Breach 766 #Nextjs Hosts, #StealCredentials https://t.co/jZwPTWCaAq
@miguelcarvajalm
12 Apr 2026
162 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
🚨 React2Shell (CVE-2025-55182) is being actively exploited RIGHT NOW — critical RCE hitting Next.js & React Server Components!I just built a free online checker — scan your site in seconds:📷https://t.co/1y5KXWsBtR
@geteasykit
11 Apr 2026
8 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
🚨 Released: Rust CVE-2025-55182 Scanner High-performance scanner for detecting React Server Components RCE (React2Shell). Built in Rust for speed, concurrency, and large-scale scanning. GitHub: https://t.co/Sj8Okv7xfh #cybersecurity #hacking_tool https://t.co/RpeGjL1On5
@kaxm231
11 Apr 2026
192 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
This vulnerability allows RCE in React Server Functions, e.g. as offered by Next.js through insecure prototype references. CVE-2025-55182 https://t.co/bnw2BQIcMA
@NullSecurityX
11 Apr 2026
5455 Impressions
9 Retweets
105 Likes
47 Bookmarks
1 Reply
1 Quote
React2Shell (CVE-2025-55182) was exploited within 2 days of public disclosure. Attackers executed commands in Kubernetes workloads, installing backdoors and stealing data. Application exploits lead to cluster compromise. Read our analysis: https://t.co/x50iTPTcl0 https://t.co/g9y
@Unit42_Intel
10 Apr 2026
4057 Impressions
14 Retweets
41 Likes
18 Bookmarks
0 Replies
1 Quote
脆弱性 React2Shell の悪用を検出：自動化された大規模クレデンシャル窃取キャンペーン https://t.co/ioFiYIO4Ka このキャンペーンの背景にあるのは、Next.js アプリケーションに存在する React2Shell (CVE-2025-55182) という脆
@iototsecnews
10 Apr 2026
239 Impressions
0 Retweets
0 Likes
1 Bookmark
0 Replies
1 Quote
تحدي ثغرة CVE-2025-55182 كان اختبار للصبر عدلت السكريبت يدوياً بعد فشل الأدوات واجهت تعليق في الـ Shell وحليته بتغيير الـ Ports صححت الـ Payload ليناسب بيئة Alpine الختا
@0xsb3lr
9 Apr 2026
161 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
Next.jsの脆弱性、React2Shell(CVE-2025-55182)を悪用するサイバー攻撃 キャンペーン https://t.co/R8qIUHrdeN #セキュリティ対策Lab #セキュリティ #Security #CybersecurityNews #DataBreach
@securityLab_jp
9 Apr 2026
236 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
Kinsing has resurfaced on fresh infrastructure, targeting ActiveMQ, Metabase, and React2Shell. First observed using CVE-2025-55182 in VulnCheck data. Old malware, new opportunities. Check out the analysis and IOCs: https://t.co/LL7Q3kU2Fv
@VulnCheckAI
8 Apr 2026
279 Impressions
1 Retweet
3 Likes
1 Bookmark
0 Replies
0 Quotes
Kubernetes attacks are exploding 🚨 CVE-2025-55182, a critical React vulnerability (CVSS 10.0), is under active exploitation. Attackers can execute remote code via HTTP requests, targeting cloud and Kubernetes workloads to gain container access and deploy malware. https://t.c
@AIElementrix
8 Apr 2026
471 Impressions
0 Retweets
3 Likes
0 Bookmarks
1 Reply
0 Quotes
Got hit by React2Shell (CVE-2025-55182) on Azure App, Next.js 15.1.7 + React 19. Here's what happened and how I fixed it. https://t.co/Jop2CtTkqD #NextJS #React #WebSecurity #CVE202555182 #React2Shell #Azure
@moelboudali
8 Apr 2026
150 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
⚠️ Threat Update: Next.js React2Shell Credential Theft Campaign 📝 Key Updates Summary: UPDATE: Consolidated record retains Cisco Talos technical detail (UAT-10608, CVE-2025-55182) and confirms rapid exploitation with at least 766 hosts compromised in a 24‑hour window an
@syedaquib77
7 Apr 2026
117 Impressions
0 Retweets
0 Likes
1 Bookmark
0 Replies
0 Quotes
🚨 React2Shell Exploitation at Scale: 700+ Systems Breached in Global Campaign https://t.co/OddOMVLOpk A large-scale campaign is exploiting React2Shell (CVE-2025-55182) to compromise exposed Next.js apps and harvest credentials at scale. At least 766 systems across industrie
@Huntio
7 Apr 2026
1684 Impressions
6 Retweets
27 Likes
9 Bookmarks
0 Replies
0 Quotes
【Hackers Exploit Next.js React2Shell Vulnerability, Breach 766 Hosts in 24 Hours】 Next.js/React Server Componentsの脆弱性 React2Shell（CVE-2025-55182）が実際に悪用され、Cisco Talosによると24時間で少なくとも766ホストが侵害されたと報じら
@01ra66it
7 Apr 2026
65 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
React2Shell (CVE-2025-55182): RCE sin autenticación en apps React/Next.js. Impacto real: Robo de tokens y API keys Credenciales cloud expuestas Explotación activa en campañas reales Si usas Next.js: parchea, audita secretos y monitoriza accesos. #CyberSecurity #NextJS #Rea
@MMarcoSeguridad
7 Apr 2026
73 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
Kubernetes token theft surged 282% YoY, enabling lateral moves in cloud backends. Slow Pisces exploited crypto exchange pods; React2Shell (CVE-2025-55182) used for remote command execution inside workloads. #CloudSecurity #KubernetesRisks #Crypto https://t.co/AwfYM4DJYO
@TweetThreatNews
7 Apr 2026
281 Impressions
0 Retweets
2 Likes
0 Bookmarks
0 Replies
0 Quotes
NEW THREAT INTEL: React2Shell CVE-2025-55182 - CVSS 10.0 Kubernetes RCE driving 282% surge in token-theft ops. 9 detections, 22 IOCs. https://t.co/5InLuCDKmt #ThreatIntel #CyberSecurity #Kubernetes #CVE https://t.co/1X49ikXNTY
@threadlinqs
7 Apr 2026
143 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
NEW THREAT INTEL: React2Shell CVE-2025-55182 -- K8s token-theft surge with Slow Pisces and cloud-native actors. 9 detections, 22 IOCs. https://t.co/5InLuCDKmt #ThreatIntel #CyberSecurity #Kubernetes #CVE https://t.co/4zq34Qlpo4
@threadlinqs
7 Apr 2026
121 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
🚨Una vulnerabilidad crítica (React2Shell – CVE-2025-55182) en Next.js está siendo explotada para ejecutar código remoto y robar credenciales de servidores sin parches. El ataque ya comprometió cientos de sistemas en horas. El parche existe desde hace meses: aplicar de in
@nodoware_news
6 Apr 2026
105 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
766 systems breached through React2Shell vulnerability in hours. 10,000+ AWS keys, SSH credentials, and API tokens harvested automatically. CVE-2025-55182 has perfect 10.0 C https://t.co/ab9MBIfVaX
@PTGLondon
6 Apr 2026
129 Impressions
0 Retweets
1 Like
0 Bookmarks
1 Reply
0 Quotes
After deleting my X and GitHub accounts multiple times, here’s a reupload of an old CVE automation script I built some time ago (#CVE-2025-55182) This is just a reupload, more substantial work is coming. Peace. @hexsh1dow https://t.co/hq8m5fMQnk
@hexsh1dow
6 Apr 2026
869 Impressions
4 Retweets
14 Likes
3 Bookmarks
0 Replies
0 Quotes
UAT-10608 exploited React2Shell (CVE-2025-55182) to deploy NEXUS Listener across 766+ compromised hosts. Attackers automated credential harvesting then used stolen cloud tokens for lateral movement across environments. Runtime segmentation helps limit blast radius when
@aviatrixtrc
6 Apr 2026
132 Impressions
0 Retweets
1 Like
0 Bookmarks
1 Reply
0 Quotes
⚠️ Threat Update: Automated Credential Harvesting Exploiting React2Shell (UAT-10608) — React2Shell (CVE-2025-55182) 📝 Key Updates Summary: UPDATE: Cisco Talos confirmed at least **766 compromised hosts** as of 2026-04-06 and added explicit evidence of large-scale automa
@syedaquib77
6 Apr 2026
101 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
Hackers exploited React2Shell (CVE-2025-55182) in Next.js apps, compromising 766+ hosts to steal environment secrets, SSH keys, API keys, and cloud tokens. Cisco Talos links this to UAT-10608 cluster. #React2Shell #Nextjs #UAT https://t.co/ZdhTguYkrI
@TweetThreatNews
6 Apr 2026
214 Impressions
0 Retweets
1 Like
0 Bookmarks
0 Replies
0 Quotes
[
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:facebook:react:19.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C66E1B0F-8C3F-4D27-9F46-B6EC78D8C60B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:facebook:react:19.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C6C1C3E2-542D-4001-BFA9-6CF5A038971D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:facebook:react:19.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "A0907E1C-E2D2-44A4-AA46-CE80BCA4E015",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:facebook:react:19.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "0030B5E1-E79E-4C48-B500-91747FE2751D",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*",
"matchCriteriaId": "FC2BCD83-CC87-4CDC-AD9B-2055912A8463",
"versionEndExcluding": "15.0.5",
"versionStartIncluding": "15.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*",
"matchCriteriaId": "C5E767D4-E46F-4CA6-A22F-4D0671B9B102",
"versionEndExcluding": "15.1.9",
"versionStartIncluding": "15.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*",
"matchCriteriaId": "5EFB6CB7-4A4F-464A-A1D8-62B50DF0B4BA",
"versionEndExcluding": "15.2.6",
"versionStartIncluding": "15.2.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*",
"matchCriteriaId": "83AF54D7-410D-42B4-853A-8A1973636542",
"versionEndExcluding": "15.3.6",
"versionStartIncluding": "15.3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*",
"matchCriteriaId": "3D666EA7-BDAE-4E67-A331-B7403C3AA482",
"versionEndExcluding": "15.4.8",
"versionStartIncluding": "15.4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*",
"matchCriteriaId": "E666ECDA-7A29-4D3D-AC40-357F044AD595",
"versionEndExcluding": "15.5.7",
"versionStartIncluding": "15.5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*",
"matchCriteriaId": "CF65554E-4BF0-4344-AE7F-9E09E34E084F",
"versionEndExcluding": "16.0.7",
"versionStartIncluding": "16.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:vercel:next.js:14.3.0:canary77:*:*:*:node.js:*:*",
"matchCriteriaId": "B209A306-CE1A-448D-8653-7627302399B7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:vercel:next.js:14.3.0:canary78:*:*:*:node.js:*:*",
"matchCriteriaId": "D1DCAC23-7ED0-456B-8AE2-57689199F708",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:vercel:next.js:14.3.0:canary79:*:*:*:node.js:*:*",
"matchCriteriaId": "8B35D612-AC2A-4697-934F-372E4D5EE3F4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:vercel:next.js:14.3.0:canary80:*:*:*:node.js:*:*",
"matchCriteriaId": "A06D2291-5D89-4B76-99E0-52505634A63B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:vercel:next.js:14.3.0:canary81:*:*:*:node.js:*:*",
"matchCriteriaId": "8F01F07A-79F7-4F4B-8E3A-9C7D93C83A63",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:vercel:next.js:14.3.0:canary82:*:*:*:node.js:*:*",
"matchCriteriaId": "9EDA2864-F94B-48EB-98F3-FDBFCECCC4A8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:vercel:next.js:14.3.0:canary83:*:*:*:node.js:*:*",
"matchCriteriaId": "4828BEE0-E891-491B-903D-A50B0E37273C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:vercel:next.js:14.3.0:canary84:*:*:*:node.js:*:*",
"matchCriteriaId": "55723BB4-E62B-4034-A434-485FE0E6BAF5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:vercel:next.js:14.3.0:canary85:*:*:*:node.js:*:*",
"matchCriteriaId": "19F55784-CC11-4024-9A42-EFEEF7B2366F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:vercel:next.js:14.3.0:canary86:*:*:*:node.js:*:*",
"matchCriteriaId": "1D694B0A-9BCF-49C8-A787-B0AFE51C7DC5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:vercel:next.js:14.3.0:canary87:*:*:*:node.js:*:*",
"matchCriteriaId": "C91F9508-E18D-4928-9DF5-DE2DDBEC56D3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:-:*:*:*:node.js:*:*",
"matchCriteriaId": "3ED7F693-8012-4F88-BC71-CF108E20664A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary0:*:*:*:node.js:*:*",
"matchCriteriaId": "40EE98AC-754A-4FD9-B51A-9E2674584FD9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary1:*:*:*:node.js:*:*",
"matchCriteriaId": "13B41C54-AF21-4637-A852-F997635B4E83",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary10:*:*:*:node.js:*:*",
"matchCriteriaId": "91B41697-2D70-488D-A5C3-CB9D435560CA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary11:*:*:*:node.js:*:*",
"matchCriteriaId": "7D43DB84-7BCF-429B-849A-7189EC1922D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary12:*:*:*:node.js:*:*",
"matchCriteriaId": "CEC2346B-8DBD-4D53-9866-CFBDD3AACEF2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary13:*:*:*:node.js:*:*",
"matchCriteriaId": "2BC95097-8CA6-42FE-98D7-F968E37C11B7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary14:*:*:*:node.js:*:*",
"matchCriteriaId": "4F8FA85C-1200-4FD2-B5D7-906300748BD4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary15:*:*:*:node.js:*:*",
"matchCriteriaId": "5D0B177B-2A31-48E9-81C7-1024E2452486",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary16:*:*:*:node.js:*:*",
"matchCriteriaId": "7CCA01F3-3A14-4450-8A68-B1DA22C685B7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary17:*:*:*:node.js:*:*",
"matchCriteriaId": "1AB351AE-8C29-4E67-8699-0AAC6B3383E2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary18:*:*:*:node.js:*:*",
"matchCriteriaId": "14A34D9D-5FA2-434B-836E-3CE63D716CCB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary19:*:*:*:node.js:*:*",
"matchCriteriaId": "E8440F05-F32B-4D40-90B7-04BF22107D86",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary2:*:*:*:node.js:*:*",
"matchCriteriaId": "FB6C6F6D-1EC0-4BD9-97A4-CFDE70DF0C43",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary20:*:*:*:node.js:*:*",
"matchCriteriaId": "6189BD4C-A3E2-451B-96B2-FF01250E946D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary21:*:*:*:node.js:*:*",
"matchCriteriaId": "389EE453-8B07-45DD-BE9C-277C9C5CB156",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary22:*:*:*:node.js:*:*",
"matchCriteriaId": "BA4D4638-4734-4B16-87AA-EF4B5D2DDD7A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary23:*:*:*:node.js:*:*",
"matchCriteriaId": "D54A2E63-6E0C-4E17-86A8-459B0A7EE00B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary24:*:*:*:node.js:*:*",
"matchCriteriaId": "E6136F0A-3010-4BAD-811B-D047CF5E6F64",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary25:*:*:*:node.js:*:*",
"matchCriteriaId": "525EFA40-B14B-47E9-8FBD-45721A802DB6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary26:*:*:*:node.js:*:*",
"matchCriteriaId": "69142944-1EC0-4F94-862E-FA7F2E101101",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary27:*:*:*:node.js:*:*",
"matchCriteriaId": "30016C06-372D-4F98-84A8-0732CA054970",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary28:*:*:*:node.js:*:*",
"matchCriteriaId": "E1536E2B-84EC-46A3-9B6F-026364A9D927",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary29:*:*:*:node.js:*:*",
"matchCriteriaId": "5E6F1F60-30E2-407C-8152-EEEB7EFE24CB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary3:*:*:*:node.js:*:*",
"matchCriteriaId": "3C907301-2C8F-465B-8134-94130E29F5DB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary30:*:*:*:node.js:*:*",
"matchCriteriaId": "E81C89FD-40CB-471E-9967-90ACDCF79373",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary31:*:*:*:node.js:*:*",
"matchCriteriaId": "55E8AEEC-A686-49D6-B298-AEE4E838E769",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary32:*:*:*:node.js:*:*",
"matchCriteriaId": "CB0618EC-6A0B-4AC3-BF6D-E51AC84C4E15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary33:*:*:*:node.js:*:*",
"matchCriteriaId": "7B27F133-8EB4-4761-A706-DF42D4EB55F6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary34:*:*:*:node.js:*:*",
"matchCriteriaId": "BF975472-B7E7-4AC8-B834-DA19897A4894",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary35:*:*:*:node.js:*:*",
"matchCriteriaId": "48A82613-F3FD-4E89-8E4A-F3F05A616171",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary36:*:*:*:node.js:*:*",
"matchCriteriaId": "0D42CA1F-7C21-47C1-8A9C-1015286FCBE2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary37:*:*:*:node.js:*:*",
"matchCriteriaId": "7C83A4EF-B96F-40EC-BA1F-FE1370AF78AC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary38:*:*:*:node.js:*:*",
"matchCriteriaId": "C151FDAB-DE34-4A7E-9762-6E99386798BF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary39:*:*:*:node.js:*:*",
"matchCriteriaId": "53025212-05F0-41FE-81F8-023B1784BB8C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary4:*:*:*:node.js:*:*",
"matchCriteriaId": "68EAC2B9-32A5-4721-BB35-16D519CD1BBC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary40:*:*:*:node.js:*:*",
"matchCriteriaId": "7411EF71-CBEB-4127-935F-3C732A1E22AC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary41:*:*:*:node.js:*:*",
"matchCriteriaId": "0C4B8930-1B65-4894-AFA8-C323AA7A8292",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary42:*:*:*:node.js:*:*",
"matchCriteriaId": "B4977345-BD8C-41C7-9DD7-1E41D6CC6438",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary43:*:*:*:node.js:*:*",
"matchCriteriaId": "EFE030A4-5B14-4C2D-B953-E80C98FB26EE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary44:*:*:*:node.js:*:*",
"matchCriteriaId": "9F616FD4-83BF-4A9A-AFFD-0D3E2544DC7E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary45:*:*:*:node.js:*:*",
"matchCriteriaId": "00512630-8B88-43B0-9ED3-2B33C64CC9A9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary46:*:*:*:node.js:*:*",
"matchCriteriaId": "A88EEF11-C7DA-4E2D-A030-FC177E696557",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary47:*:*:*:node.js:*:*",
"matchCriteriaId": "BE8453D9-7275-4A5F-8732-F05662FFF2E8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary48:*:*:*:node.js:*:*",
"matchCriteriaId": "E306B896-9BBB-424B-8D99-7A1A79AEFE9D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary49:*:*:*:node.js:*:*",
"matchCriteriaId": "ACA87B86-33D5-4BEA-A13D-EEB4922D511E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary5:*:*:*:node.js:*:*",
"matchCriteriaId": "77AA0D23-B101-445C-A260-ED3152A93D17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary50:*:*:*:node.js:*:*",
"matchCriteriaId": "7D7DCCF7-FC83-4767-A0C2-C84A8B14F93B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary51:*:*:*:node.js:*:*",
"matchCriteriaId": "FD397568-7F1F-4153-AF08-B22D4D3B45F9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary52:*:*:*:node.js:*:*",
"matchCriteriaId": "984416EF-B121-40CE-B3AD-E22A06BB5844",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary53:*:*:*:node.js:*:*",
"matchCriteriaId": "C4B58652-EE24-43CF-8ABE-4A01B2C9938C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary54:*:*:*:node.js:*:*",
"matchCriteriaId": "8090CF73-AEA7-43FC-A960-321BED3B1682",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary55:*:*:*:node.js:*:*",
"matchCriteriaId": "823164E5-609D-4F24-86A5-E25618FE86A7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary56:*:*:*:node.js:*:*",
"matchCriteriaId": "E13CD688-63C3-4FFA-9D13-696005F0C155",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary57:*:*:*:node.js:*:*",
"matchCriteriaId": "B397B18C-8A7A-4766-9A68-98B26E190A4A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary6:*:*:*:node.js:*:*",
"matchCriteriaId": "2DB345E3-BAD0-497E-93AE-5E4DC669C192",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary7:*:*:*:node.js:*:*",
"matchCriteriaId": "840FEB19-2C66-4004-A488-B90219F8AC05",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary8:*:*:*:node.js:*:*",
"matchCriteriaId": "C260F966-73D7-43F3-A329-8C558A695821",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:vercel:next.js:15.6.0:canary9:*:*:*:node.js:*:*",
"matchCriteriaId": "28130A79-39B5-43E8-A690-C8E9C62483F8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:vercel:next.js:16.0.0:-:*:*:*:node.js:*:*",
"matchCriteriaId": "5E8548AB-D9E8-4E65-AF24-9F9021F99834",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
]