eine hochkritische Schwachstelle in React Server Components (CVE-2025-55182) betrifft auch Next.js (CVE-2025-66478) und andere weit verbreitete Frameworks, die häufig bei Webanwendungen zum Einsatz kommen. Die Schwachstelle ermöglicht entfernten Angreifenden ohne Authentifizierung beliebigen Programmcode auszuführen.
And on the related cloud server i only run pangolin, so i think this should be fixed as fast as possible
<!-- gh-comment-id:3637014244 -->
@c4sti3l commented on GitHub (Dec 10, 2025):
Yes I also got an email from my provider Hetzner:
` eine hochkritische Schwachstelle in React Server Components (CVE-2025-55182)
betrifft auch Next.js (CVE-2025-66478) und andere weit verbreitete Frameworks,
die häufig bei Webanwendungen zum Einsatz kommen.
Die Schwachstelle ermöglicht entfernten Angreifenden ohne Authentifizierung
beliebigen Programmcode auszuführen.`
And on the related cloud server i only run pangolin, so i think this should be fixed as fast as possible
Isn't CVE-2025-66478 already fixed then too? According to the BSI the CVE-2025-66478 was the Next.js vulnerability.
CVE-2025-55182 is the React vulnerability. As Next.js is building on top of React Server Components. Basically the same vulnerability but different CVEs for each of them.
According to this information, the latest update 1.12.3 already addressed "both" issues. Just update.
<!-- gh-comment-id:3637027637 -->
@Kh3nsu commented on GitHub (Dec 10, 2025):
Can confirm, I also just got the message from BSI. As far as I can see 1.12.3 is already addressing the CVE-2025-55182.
"Update Next to 15.5.7 ref: https://github.com/advisories/GHSA-fv66-9v8q-g76r"
Isn't CVE-2025-66478 already fixed then too? According to the BSI the CVE-2025-66478 was the Next.js vulnerability.
CVE-2025-55182 is the React vulnerability. As Next.js is building on top of React Server Components. Basically the same vulnerability but different CVEs for each of them.
According to this information, the latest update 1.12.3 already addressed "both" issues. Just update.
I just updated my installation to latest and got version 1.12.3 installed and the release notes include, that the next.js version was updated.
After that, I was using this scanner to check the vulnerability got closed and this was successful.
So maybe you would need to check if you are really pulling the latest tag?
I hope this helps to mitigate this CVE for you asap.
<!-- gh-comment-id:3637225167 -->
@nlsrchtr commented on GitHub (Dec 10, 2025):
Hi @dzatoah,
I just updated my installation to `latest` and got version `1.12.3` installed and the [release notes](https://github.com/fosrl/pangolin/releases/tag/1.12.3) include, that the next.js version was updated.
After that, I was using [this scanner](https://github.com/assetnote/react2shell-scanner) to check the vulnerability got closed and this was successful.
So maybe you would need to check if you are really pulling the latest tag?
I hope this helps to mitigate this CVE for you asap.
@oschwartz10612 commented on GitHub (Dec 10, 2025):
Yes please check if you are pulling the latest tag! We updated next in 1.12.3. If not please reopen.
<!-- gh-comment-id:3637551695 -->
@oschwartz10612 commented on GitHub (Dec 10, 2025):
Yes please check if you are pulling the latest tag! We updated next in 1.12.3. If not please reopen.
EDIT: Ah I saw you already update to 19.2.1 in latest master, but the release has yet to be made ;)
Thank you in advance!
<!-- gh-comment-id:3638868119 -->
@dzatoah commented on GitHub (Dec 10, 2025):
docker image with latest tag:
```
$ docker exec fc4f17af28cc npm list | grep react@19
+-- @types/react@19.2.2
+-- react@19.2.0
```
Please update package.json ASAP with fixed version 19.2.1:
https://github.com/fosrl/pangolin/blob/6e6fa77625a458c217466bf7521df0ef81a004a2/package.json#L110
EDIT: Ah I saw you already update to `19.2.1` in latest master, but the release has yet to be made ;)
Thank you in advance!
I checked out the latest release tag (1.12.3), ran npm install, and immediately received a concerning warning:
npm warn deprecated next@15.5.2: This version has a security vulnerability. Please upgrade to a patched version. See https://nextjs.org/blog/CVE-2025-66478 for more details.
At first, this was confusing because the main Next.js dependency was correctly updated to "next": "15.5.7" in commit 10a00ff. This suggested that a transitive dependency must be pulling in the vulnerable version.
As shown above, @react-email/preview-server@4.3.2 (a dev dependency) depends on next@15.5.2, which is vulnerable to the react2shell CVE.
While this is only a dev dependency and doesn't affect production builds, it's still worth addressing for contributor security. I noticed that the current main branch has this resolved in commit 74dd3fd. Would it make sense to cut a new release or update the dev dependencies?
<!-- gh-comment-id:3639078620 -->
@auqust commented on GitHub (Dec 10, 2025):
I checked out the latest release tag (1.12.3), ran `npm install`, and immediately received a concerning warning:
```
npm warn deprecated next@15.5.2: This version has a security vulnerability. Please upgrade to a patched version. See https://nextjs.org/blog/CVE-2025-66478 for more details.
```
At first, this was confusing because the main Next.js dependency was correctly updated to `"next": "15.5.7"` in commit 10a00ff. This suggested that a transitive dependency must be pulling in the vulnerable version.
Running `npm list next` confirmed the issue:
```
@fosrl/pangolin@0.0.0
├─┬ @react-email/preview-server@4.3.2
│ └── next@15.5.2
├─┬ next-intl@4.5.8
│ └── next@15.5.7 deduped
├── next@15.5.7
└─┬ nextjs-toploader@3.9.17
└── next@15.5.7 deduped
```
As shown above, `@react-email/preview-server@4.3.2` (a dev dependency) depends on `next@15.5.2`, which is vulnerable to the react2shell CVE.
While this is only a dev dependency and doesn't affect production builds, it's still worth addressing for contributor security. I noticed that the current `main` branch has this resolved in commit 74dd3fd. Would it make sense to cut a new release or update the dev dependencies?
@oschwartz10612 commented on GitHub (Dec 11, 2025):
The @react-email/preview-server package provides a live development
server for instantly previewing your email templates built with the
React Email library directly in the browser. This is used for
development only and is installed in devDependencies and should not
effect 1.12.3.
That said it was removed in the latest package json and react is updated
to 19.2.1 for the 1.13.0 release which will go out today.
<!-- gh-comment-id:3642625491 -->
@oschwartz10612 commented on GitHub (Dec 11, 2025):
The @react-email/preview-server package provides a live development
server for instantly previewing your email templates built with the
React Email library directly in the browser. This is used for
development only and is installed in devDependencies and should not
effect 1.12.3.
That said it was removed in the latest package json and react is updated
to 19.2.1 for the 1.13.0 release which will go out today.
@tuuuni0scouts commented on GitHub (Dec 17, 2025):
The @react-email/preview-server package provides a live development
server for instantly previewing your email templates built with the
React Email library directly in the browser. This is used for
development only and is installed in devDependencies and should not
effect 1.12.3.
That said it was removed in the latest package json and react is updated
to 19.2.1 for the 1.13.0 release which will go out today.
wen i have patched is there anithing i shoud check that i did not get compromised
<!-- gh-comment-id:3664386234 -->
@tuuuni0scouts commented on GitHub (Dec 17, 2025):
> The @react-email/preview-server package provides a live development
> server for instantly previewing your email templates built with the
> React Email library directly in the browser. This is used for
> development only and is installed in devDependencies and should not
> effect 1.12.3.
>
> That said it was removed in the latest package json and react is updated
> to 19.2.1 for the 1.13.0 release which will go out today.
wen i have patched is there anithing i shoud check that i did not get compromised
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Originally created by @dzatoah on GitHub (Dec 10, 2025).
Original GitHub issue: https://github.com/fosrl/pangolin/issues/2031
Describe the Bug
If I'm right, then
pangolin:latestdocker image is affected by the React2Shell vulnerability, rated with 10/10.Please upgrade Next.js and React ASAP!
https://github.com/facebook/react/security/advisories/GHSA-fv66-9v8q-g76r
https://github.com/vercel/next.js/security/advisories/GHSA-9qr9-h5gf-34mp
https://react2shell.com/
How to test if your instance is affected:
cve.yaml:
targets.txt:
nuclei -l targets.txt -t cve.yaml -debugEnvironment
Output of Nuclei of affected machine:
@c4sti3l commented on GitHub (Dec 10, 2025):
Yes I also got an email from my provider Hetzner:
eine hochkritische Schwachstelle in React Server Components (CVE-2025-55182) betrifft auch Next.js (CVE-2025-66478) und andere weit verbreitete Frameworks, die häufig bei Webanwendungen zum Einsatz kommen. Die Schwachstelle ermöglicht entfernten Angreifenden ohne Authentifizierung beliebigen Programmcode auszuführen.And on the related cloud server i only run pangolin, so i think this should be fixed as fast as possible
@Kh3nsu commented on GitHub (Dec 10, 2025):
Can confirm, I also just got the message from BSI. As far as I can see 1.12.3 is already addressing the CVE-2025-55182.
"Update Next to 15.5.7 ref: https://github.com/advisories/GHSA-fv66-9v8q-g76r"
Isn't CVE-2025-66478 already fixed then too? According to the BSI the CVE-2025-66478 was the Next.js vulnerability.
CVE-2025-55182 is the React vulnerability. As Next.js is building on top of React Server Components. Basically the same vulnerability but different CVEs for each of them.
According to this information, the latest update 1.12.3 already addressed "both" issues. Just update.
@nlsrchtr commented on GitHub (Dec 10, 2025):
Hi @dzatoah,
I just updated my installation to
latestand got version1.12.3installed and the release notes include, that the next.js version was updated.After that, I was using this scanner to check the vulnerability got closed and this was successful.
So maybe you would need to check if you are really pulling the latest tag?
I hope this helps to mitigate this CVE for you asap.
@oschwartz10612 commented on GitHub (Dec 10, 2025):
Yes please check if you are pulling the latest tag! We updated next in 1.12.3. If not please reopen.
@dzatoah commented on GitHub (Dec 10, 2025):
The scanner does show a false negative to me, at least.
I triple checked the version number in Pangolin is v1.12.3 (latest docker tag as said above).
Is there another dependency involved, maybe?
Please check for your own instance, if the same response is printed.
What makes it even weirder:
docker exec fc4f17af28cc npm list nextI do not have sufficient permissions to reopen the issue.
@dzatoah commented on GitHub (Dec 10, 2025):
docker image with latest tag:
Please update package.json ASAP with fixed version 19.2.1:
https://github.com/fosrl/pangolin/blob/6e6fa77625a458c217466bf7521df0ef81a004a2/package.json#L110
EDIT: Ah I saw you already update to
19.2.1in latest master, but the release has yet to be made ;)Thank you in advance!
@auqust commented on GitHub (Dec 10, 2025):
I checked out the latest release tag (1.12.3), ran
npm install, and immediately received a concerning warning:At first, this was confusing because the main Next.js dependency was correctly updated to
"next": "15.5.7"in commit10a00ff. This suggested that a transitive dependency must be pulling in the vulnerable version.Running
npm list nextconfirmed the issue:As shown above,
@react-email/preview-server@4.3.2(a dev dependency) depends onnext@15.5.2, which is vulnerable to the react2shell CVE.While this is only a dev dependency and doesn't affect production builds, it's still worth addressing for contributor security. I noticed that the current
mainbranch has this resolved in commit74dd3fd. Would it make sense to cut a new release or update the dev dependencies?@oschwartz10612 commented on GitHub (Dec 11, 2025):
The @react-email/preview-server package provides a live development
server for instantly previewing your email templates built with the
React Email library directly in the browser. This is used for
development only and is installed in devDependencies and should not
effect 1.12.3.
That said it was removed in the latest package json and react is updated
to 19.2.1 for the 1.13.0 release which will go out today.
@tuuuni0scouts commented on GitHub (Dec 17, 2025):
wen i have patched is there anithing i shoud check that i did not get compromised