Security Digest: December 3, 2025 - 4 Critical Vulnerabilities

Today's security landscape presents four critical vulnerabilities demanding immediate action, particularly for React and Next.js applications.

· 4 min read

Executive Summary

Today's security landscape presents four critical vulnerabilities demanding immediate action, particularly for React and Next.js applications. Developers must upgrade affected packages to protect against potential remote code execution and data exposure threats.

Critical Vulnerabilities

  • CVE-2025-55182: Remote Code Execution in React Server Components
    • Impact: Unauthenticated attackers can execute arbitrary code.
    • Affected Systems: React versions 19.0, 19.1.0, 19.1.1, 19.2.0 using react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack.
    • Immediate Action: Upgrade to React 19.0.1, 19.1.2, or 19.2.1.
    • Mitigation: Ensure your app does not use server components if not necessary.
  • CVE-2025-66478: Critical Vulnerability in Next.js
    • Impact: Remote code execution similar to CVE-2025-55182.
    • Affected Systems: Next.js 15.x and 16.x, and experimental canary releases starting with 14.3.0-canary.77.
    • Immediate Action: Upgrade to patched versions: 15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7, or 16.0.7.
    • Mitigation: Downgrade to a stable release if using 14.3 canary builds.
  • CVE-2025-66411: Sensitive Data Exposure in Coder Workspace Agent
    • Impact: Unauthorized access to environment variables logged in plaintext.
    • Affected Systems: Coder versions prior to 2.28.4.
    • Immediate Action: Upgrade to Coder 2.28.4, 2.27.7, or 2.26.5.
    • Mitigation: Set CODER_AGENT_LOGGING_HUMAN=/dev/null to disable logging temporarily.
  • CVE-2025-66468: Stored XSS in Aimeos ai-cms-grapesjs
    • Impact: Stored XSS via JavaScript injection by malicious editors.
    • Affected Systems: Systems using ai-cms-grapesjs with disabled CSP.
    • Immediate Action: Ensure CSP is enabled and strictly configured in production.
    • Mitigation: Always maintain CSP active to prevent such exploits.

Previously Alerted

What to Do Now

  1. Immediately upgrade affected React and Next.js packages as per above guidelines.
  2. Verify environments for any unauthorized access or data exposure.
  3. Monitor logs for suspicious activity and adjust CSP as needed.

Related Resources

  • Check the React blog post for more upgrade instructions.
  • Consult official vendor advisories for further guidance.

Keep reading