[GHSA-9qr9-h5gf-34mp] Next.js is vulnerable to RCE in React flight protocol

[mswilson]

Updates

• References

Comments
Correcting CVE reference to CVE-2025-55182, as CVE-2025-66478 is rejected as a duplicate

[github]

Hi there @aaronbrown-vercel! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository.

This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory

[mswilson]

Noted on the OpenSSF slack channel for the vulnerability disclosure working group:

I think that because CVE-2025-66478 was rejected, some vulnerability databases aren't bringing in GHSA-9qr9-h5gf-34mp because it's still listed as CVE-2025-66478. e.g. I just checked in trivydb and it wasn't there, but other recent ones were. Not 100% sure that's the reason but just thought I'd mention!

[advisory-database]

Hi @mswilson! Thank you so much for contributing to the GitHub Advisory Database. This database is free, open, and accessible to all, and it's people like you who make it great. Thanks for choosing to help others. We hope you send in more contributions in the future!