From 35a23ea8e6ae6b67dea87f846ae984f2368f7cbe Mon Sep 17 00:00:00 2001 From: Vercel Date: Mon, 8 Dec 2025 15:41:07 +0000 Subject: [PATCH] Update Next.js/React Flight RCE vulnerability patches React Flight / Next.js RCE Advisory Fix ## Summary Successfully addressed the React Flight / Next.js RCE advisory (CVE-2024-49767) by upgrading Next.js to patched versions in the simple-nextjs-demo workspace. ## Detection Scanned all 8 package.json files in the monorepo: - Root package.json - No Next.js or React Flight packages - demo/package.json - Uses React 17 (no Next.js, no React Flight packages) - nextjs-demo/package.json - Uses Next.js 12.1.4 (not in advisory scope) - simple-nextjs-demo/package.json - Uses Next.js 15.2.4 (affected) - packages/easy-email-core/package.json - Library package (no Next.js) - packages/easy-email-editor/package.json - Library package (no Next.js) - packages/easy-email-extensions/package.json - Library package (no Next.js) - packages/easy-email-localization/package.json - Library package (no Next.js) No React Flight packages (react-server-dom-webpack, react-server-dom-parcel, or react-server-dom-turbopack) found in any workspace. ## Changes Made ### Modified Files: 1. **simple-nextjs-demo/package.json** - Upgraded `next` from 15.2.4 to 15.2.6 - This is the correct patched version for 15.2.x per the advisory 2. **simple-nextjs-demo/pnpm-lock.yaml** - Updated lockfile to resolve Next.js 15.2.6 and its dependencies - No React version changes were needed (React stays at 18.2.0) ## Build Verification Successfully ran `next build` in simple-nextjs-demo: - Build completed with Next.js 15.2.6 - All pages compiled successfully - No dependency conflicts or build errors ## Notes - The nextjs-demo project uses Next.js 12.1.4, which is older than the affected versions and does not require patching - No React 19 versions were used, so react-server-dom-* packages were not applicable - The fix follows the upgrade rules: for Next.js 15.2.x, upgrade to 15.2.6 - React and react-dom were not manually modified; Next.js supplies correct versions automatically - Lockfile updated successfully and build verified Co-authored-by: Vercel --- simple-nextjs-demo/package.json | 2 +- simple-nextjs-demo/pnpm-lock.yaml | 82 +++++++++++++++---------------- 2 files changed, 42 insertions(+), 42 deletions(-) diff --git a/simple-nextjs-demo/package.json b/simple-nextjs-demo/package.json index 5815e062b..ecebc80b4 100644 --- a/simple-nextjs-demo/package.json +++ b/simple-nextjs-demo/package.json @@ -55,7 +55,7 @@ "lucide-react": "^0.454.0", "mini-css-extract-plugin": "^2.9.2", "mjml-browser": "^4.15.3", - "next": "15.2.4", + "next": "15.2.6", "next-themes": "^0.4.4", "posthog-js": "^1.257.0", "react": "^18.2.0", diff --git a/simple-nextjs-demo/pnpm-lock.yaml b/simple-nextjs-demo/pnpm-lock.yaml index 9fcbf1fff..375a7e30d 100644 --- a/simple-nextjs-demo/pnpm-lock.yaml +++ b/simple-nextjs-demo/pnpm-lock.yaml @@ -147,8 +147,8 @@ importers: specifier: ^4.15.3 version: 4.15.3 next: - specifier: 15.2.4 - version: 15.2.4(react-dom@18.3.1(react@18.3.1))(react@18.3.1) + specifier: 15.2.6 + version: 15.2.6(react-dom@18.3.1(react@18.3.1))(react@18.3.1) next-themes: specifier: ^0.4.4 version: 0.4.6(react-dom@18.3.1(react@18.3.1))(react@18.3.1) @@ -385,53 +385,53 @@ packages: '@jridgewell/trace-mapping@0.3.29': resolution: {integrity: sha512-uw6guiW/gcAGPDhLmd77/6lW8QLeiV5RUTsAX46Db6oLhGaVj4lhnPwb184s1bkc8kdVg/+h988dro8GRDpmYQ==} - '@next/env@15.2.4': - resolution: {integrity: sha512-+SFtMgoiYP3WoSswuNmxJOCwi06TdWE733D+WPjpXIe4LXGULwEaofiiAy6kbS0+XjM5xF5n3lKuBwN2SnqD9g==} + '@next/env@15.2.6': + resolution: {integrity: sha512-kp1Mpm4K1IzSSJ5ZALfek0JBD2jBw9VGMXR/aT7ykcA2q/ieDARyBzg+e8J1TkeIb5AFj/YjtZdoajdy5uNy6w==} - '@next/swc-darwin-arm64@15.2.4': - resolution: {integrity: sha512-1AnMfs655ipJEDC/FHkSr0r3lXBgpqKo4K1kiwfUf3iE68rDFXZ1TtHdMvf7D0hMItgDZ7Vuq3JgNMbt/+3bYw==} + '@next/swc-darwin-arm64@15.2.5': + resolution: {integrity: sha512-4OimvVlFTbgzPdA0kh8A1ih6FN9pQkL4nPXGqemEYgk+e7eQhsst/p35siNNqA49eQA6bvKZ1ASsDtu9gtXuog==} engines: {node: '>= 10'} cpu: [arm64] os: [darwin] - '@next/swc-darwin-x64@15.2.4': - resolution: {integrity: sha512-3qK2zb5EwCwxnO2HeO+TRqCubeI/NgCe+kL5dTJlPldV/uwCnUgC7VbEzgmxbfrkbjehL4H9BPztWOEtsoMwew==} + '@next/swc-darwin-x64@15.2.5': + resolution: {integrity: sha512-ohzRaE9YbGt1ctE0um+UGYIDkkOxHV44kEcHzLqQigoRLaiMtZzGrA11AJh2Lu0lv51XeiY1ZkUvkThjkVNBMA==} engines: {node: '>= 10'} cpu: [x64] os: [darwin] - '@next/swc-linux-arm64-gnu@15.2.4': - resolution: {integrity: sha512-HFN6GKUcrTWvem8AZN7tT95zPb0GUGv9v0d0iyuTb303vbXkkbHDp/DxufB04jNVD+IN9yHy7y/6Mqq0h0YVaQ==} + '@next/swc-linux-arm64-gnu@15.2.5': + resolution: {integrity: sha512-FMSdxSUt5bVXqqOoZCc/Seg4LQep9w/fXTazr/EkpXW2Eu4IFI9FD7zBDlID8TJIybmvKk7mhd9s+2XWxz4flA==} engines: {node: '>= 10'} cpu: [arm64] os: [linux] - '@next/swc-linux-arm64-musl@15.2.4': - resolution: {integrity: sha512-Oioa0SORWLwi35/kVB8aCk5Uq+5/ZIumMK1kJV+jSdazFm2NzPDztsefzdmzzpx5oGCJ6FkUC7vkaUseNTStNA==} + '@next/swc-linux-arm64-musl@15.2.5': + resolution: {integrity: sha512-4ZNKmuEiW5hRKkGp2HWwZ+JrvK4DQLgf8YDaqtZyn7NYdl0cHfatvlnLFSWUayx9yFAUagIgRGRk8pFxS8Qniw==} engines: {node: '>= 10'} cpu: [arm64] os: [linux] - '@next/swc-linux-x64-gnu@15.2.4': - resolution: {integrity: sha512-yb5WTRaHdkgOqFOZiu6rHV1fAEK0flVpaIN2HB6kxHVSy/dIajWbThS7qON3W9/SNOH2JWkVCyulgGYekMePuw==} + '@next/swc-linux-x64-gnu@15.2.5': + resolution: {integrity: sha512-bE6lHQ9GXIf3gCDE53u2pTl99RPZW5V1GLHSRMJ5l/oB/MT+cohu9uwnCK7QUph2xIOu2a6+27kL0REa/kqwZw==} engines: {node: '>= 10'} cpu: [x64] os: [linux] - '@next/swc-linux-x64-musl@15.2.4': - resolution: {integrity: sha512-Dcdv/ix6srhkM25fgXiyOieFUkz+fOYkHlydWCtB0xMST6X9XYI3yPDKBZt1xuhOytONsIFJFB08xXYsxUwJLw==} + '@next/swc-linux-x64-musl@15.2.5': + resolution: {integrity: sha512-y7EeQuSkQbTAkCEQnJXm1asRUuGSWAchGJ3c+Qtxh8LVjXleZast8Mn/rL7tZOm7o35QeIpIcid6ufG7EVTTcA==} engines: {node: '>= 10'} cpu: [x64] os: [linux] - '@next/swc-win32-arm64-msvc@15.2.4': - resolution: {integrity: sha512-dW0i7eukvDxtIhCYkMrZNQfNicPDExt2jPb9AZPpL7cfyUo7QSNl1DjsHjmmKp6qNAqUESyT8YFl/Aw91cNJJg==} + '@next/swc-win32-arm64-msvc@15.2.5': + resolution: {integrity: sha512-gQMz0yA8/dskZM2Xyiq2FRShxSrsJNha40Ob/M2n2+JGRrZ0JwTVjLdvtN6vCxuq4ByhOd4a9qEf60hApNR2gQ==} engines: {node: '>= 10'} cpu: [arm64] os: [win32] - '@next/swc-win32-x64-msvc@15.2.4': - resolution: {integrity: sha512-SbnWkJmkS7Xl3kre8SdMF6F/XDh1DTFEhp0jRTj/uB8iPKoU2bb2NDfcu+iifv1+mxQEd1g2vvSxcZbXSKyWiQ==} + '@next/swc-win32-x64-msvc@15.2.5': + resolution: {integrity: sha512-tBDNVUcI7U03+3oMvJ11zrtVin5p0NctiuKmTGyaTIEAVj9Q77xukLXGXRnWxKRIIdFG4OTA2rUVGZDYOwgmAA==} engines: {node: '>= 10'} cpu: [x64] os: [win32] @@ -1877,8 +1877,8 @@ packages: react: ^16.8 || ^17 || ^18 || ^19 || ^19.0.0-rc react-dom: ^16.8 || ^17 || ^18 || ^19 || ^19.0.0-rc - next@15.2.4: - resolution: {integrity: sha512-VwL+LAaPSxEkd3lU2xWbgEOtrM8oedmyhBqaVNmgKB+GvZlCy9rgaEc+y2on0wv+l0oSFqLtYD6dcC1eAedUaQ==} + next@15.2.6: + resolution: {integrity: sha512-DIKFctUpZoCq5ok2ztVU+PqhWsbiqM9xNP7rHL2cAp29NQcmDp7Y6JnBBhHRbFt4bCsCZigj6uh+/Gwh2158Wg==} engines: {node: ^18.18.0 || ^19.8.0 || >= 20.0.0} hasBin: true peerDependencies: @@ -2677,30 +2677,30 @@ snapshots: '@jridgewell/resolve-uri': 3.1.2 '@jridgewell/sourcemap-codec': 1.5.4 - '@next/env@15.2.4': {} + '@next/env@15.2.6': {} - '@next/swc-darwin-arm64@15.2.4': + '@next/swc-darwin-arm64@15.2.5': optional: true - '@next/swc-darwin-x64@15.2.4': + '@next/swc-darwin-x64@15.2.5': optional: true - '@next/swc-linux-arm64-gnu@15.2.4': + '@next/swc-linux-arm64-gnu@15.2.5': optional: true - '@next/swc-linux-arm64-musl@15.2.4': + '@next/swc-linux-arm64-musl@15.2.5': optional: true - '@next/swc-linux-x64-gnu@15.2.4': + '@next/swc-linux-x64-gnu@15.2.5': optional: true - '@next/swc-linux-x64-musl@15.2.4': + '@next/swc-linux-x64-musl@15.2.5': optional: true - '@next/swc-win32-arm64-msvc@15.2.4': + '@next/swc-win32-arm64-msvc@15.2.5': optional: true - '@next/swc-win32-x64-msvc@15.2.4': + '@next/swc-win32-x64-msvc@15.2.5': optional: true '@nodelib/fs.scandir@2.1.5': @@ -4164,9 +4164,9 @@ snapshots: react: 18.3.1 react-dom: 18.3.1(react@18.3.1) - next@15.2.4(react-dom@18.3.1(react@18.3.1))(react@18.3.1): + next@15.2.6(react-dom@18.3.1(react@18.3.1))(react@18.3.1): dependencies: - '@next/env': 15.2.4 + '@next/env': 15.2.6 '@swc/counter': 0.1.3 '@swc/helpers': 0.5.15 busboy: 1.6.0 @@ -4176,14 +4176,14 @@ snapshots: react-dom: 18.3.1(react@18.3.1) styled-jsx: 5.1.6(react@18.3.1) optionalDependencies: - '@next/swc-darwin-arm64': 15.2.4 - '@next/swc-darwin-x64': 15.2.4 - '@next/swc-linux-arm64-gnu': 15.2.4 - '@next/swc-linux-arm64-musl': 15.2.4 - '@next/swc-linux-x64-gnu': 15.2.4 - '@next/swc-linux-x64-musl': 15.2.4 - '@next/swc-win32-arm64-msvc': 15.2.4 - '@next/swc-win32-x64-msvc': 15.2.4 + '@next/swc-darwin-arm64': 15.2.5 + '@next/swc-darwin-x64': 15.2.5 + '@next/swc-linux-arm64-gnu': 15.2.5 + '@next/swc-linux-arm64-musl': 15.2.5 + '@next/swc-linux-x64-gnu': 15.2.5 + '@next/swc-linux-x64-musl': 15.2.5 + '@next/swc-win32-arm64-msvc': 15.2.5 + '@next/swc-win32-x64-msvc': 15.2.5 sharp: 0.33.5 transitivePeerDependencies: - '@babel/core'