Security Advisory: CVE-2025-66478 Next.js 高危漏洞，建议大家马上升级到最新版，影响 15～ 16 所有版本

Affected Next.js Versions

npm install [email protected]   # for 15.0.x
npm install [email protected]   # for 15.1.x
npm install [email protected]   # for 15.2.x
npm install [email protected]   # for 15.3.x
npm install [email protected]   # for 15.4.x
npm install [email protected]   # for 15.5.x
npm install [email protected]   # for 16.0.x
 
npm install [email protected]   # for 15.x canary releases
npm install [email protected]   # for 16.x canary releases

官方 blog

https://nextjs.org/blog/CVE-2025-66478

会影响所有用了 React Server Components (RSC) 的框架，允许远程执行任意代码，官方定级为 10 分，需要马上修复。