Critical Vulnerabilities in React and Next.js: everything you need to know

Two critical remote code execution vulnerabilities have been discovered in React and Next.js frameworks. CVE-2025-55182 and CVE-2025-66478 pose significant security risks to applications using these popular JavaScript frameworks. Organizations are strongly advised to apply patches urgently due to the critical nature of these RCE vulnerabilities. The vulnerabilities could allow attackers to execute arbitrary code on affected systems. Wiz recommends immediate detection and mitigation efforts for these high-severity security flaws.