CNVD-2025-29923

Vulnerability from cnvd - Published: 2025-12-04
VLAI
Title
ZEIT Next.js远程代码执行漏洞
Description
Next.js是一个用于构建全栈Web应用程序的React框架。 ZEIT Next.js存在远程代码执行漏洞，该漏洞源于Next.js 15.x和16.x版本在使用App Router时，依赖了存在缺陷的React服务端DOM包，攻击者可利用该漏洞注入恶意代码远程执行命令。
Severity
高
Patch Name
ZEIT Next.js远程代码执行漏洞的补丁
Patch Description
Next.js是一个用于构建全栈Web应用程序的React框架。 ZEIT Next.js存在远程代码执行漏洞，该漏洞源于Next.js 15.x和16.x版本在使用App Router时，依赖了存在缺陷的React服务端DOM包，攻击者可利用该漏洞注入恶意代码远程执行命令。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。
Formal description

目前厂商已发布升级程序修复该安全问题，详情见厂商官网: https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components

Reference
https://nvd.nist.gov/vuln/detail/CVE-2025-66478
Impacted products
Name
['ZEIT Next.js >=15.0.0，<=15.0.4', 'ZEIT Next.js >=15.1.0，<=15.1.8', 'ZEIT Next.js >=15.2.*，<=15.5.6', 'ZEIT Next.js >=16.0.0，<=16.0.6', 'ZEIT Next.js >=14.3.0，<=canary.77及以上Canary版本']
Show details on source website
To clipboard 

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2025-66478"
    }
  },
  "description": "Next.js\u662f\u4e00\u4e2a\u7528\u4e8e\u6784\u5efa\u5168\u6808Web\u5e94\u7528\u7a0b\u5e8f\u7684React\u6846\u67b6\u3002\n\nZEIT Next.js\u5b58\u5728\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8eNext.js 15.x\u548c16.x\u7248\u672c\u5728\u4f7f\u7528App Router\u65f6\uff0c\u4f9d\u8d56\u4e86\u5b58\u5728\u7f3a\u9677\u7684React\u670d\u52a1\u7aefDOM\u5305\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u6ce8\u5165\u6076\u610f\u4ee3\u7801\u8fdc\u7a0b\u6267\u884c\u547d\u4ee4\u3002",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u7a0b\u5e8f\u4fee\u590d\u8be5\u5b89\u5168\u95ee\u9898\uff0c\u8be6\u60c5\u89c1\u5382\u5546\u5b98\u7f51:\r\nhttps://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2025-29923",
  "openTime": "2025-12-04",
  "patchDescription": "Next.js\u662f\u4e00\u4e2a\u7528\u4e8e\u6784\u5efa\u5168\u6808Web\u5e94\u7528\u7a0b\u5e8f\u7684React\u6846\u67b6\u3002\r\n\r\nZEIT Next.js\u5b58\u5728\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8eNext.js 15.x\u548c16.x\u7248\u672c\u5728\u4f7f\u7528App Router\u65f6\uff0c\u4f9d\u8d56\u4e86\u5b58\u5728\u7f3a\u9677\u7684React\u670d\u52a1\u7aefDOM\u5305\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u6ce8\u5165\u6076\u610f\u4ee3\u7801\u8fdc\u7a0b\u6267\u884c\u547d\u4ee4\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "ZEIT Next.js\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "ZEIT Next.js \u003e=15.0.0\uff0c\u003c=15.0.4",
      "ZEIT Next.js \u003e=15.1.0\uff0c\u003c=15.1.8",
      "ZEIT Next.js \u003e=15.2.*\uff0c\u003c=15.5.6",
      "ZEIT Next.js \u003e=16.0.0\uff0c\u003c=16.0.6",
      "ZEIT Next.js \u003e=14.3.0\uff0c\u003c=canary.77\u53ca\u4ee5\u4e0aCanary\u7248\u672c"
    ]
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2025-66478",
  "serverity": "\u9ad8",
  "submitTime": "2025-12-04",
  "title": "ZEIT Next.js\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.