Security Advisory: CVE-2025-66478 Next.js 高危漏洞，建议大家马上升级到最新版，影响 15～ 16 所有版本

[avenger]

Affected Next.js Versions

npm install next@15.0.5   # for 15.0.x
npm install next@15.1.9   # for 15.1.x
npm install next@15.2.6   # for 15.2.x
npm install next@15.3.6   # for 15.3.x
npm install next@15.4.8   # for 15.4.x
npm install next@15.5.7   # for 15.5.x
npm install next@16.0.7   # for 16.0.x
 
npm install next@15.6.0-canary.58   # for 15.x canary releases
npm install next@16.1.0-canary.12   # for 16.x canary releases

官方 blog

https://nextjs.org/blog/CVE-2025-66478

会影响所有用了 React Server Components (RSC) 的框架，允许远程执行任意代码，官方定级为 10 分，需要马上修复。