Fix React Server Components CVE vulnerabilities#109
Conversation
Updated dependencies to fix Next.js and React CVE vulnerabilities. The fix-react2shell-next tool automatically updated the following packages to their secure versions: - next - react-server-dom-webpack - react-server-dom-parcel - react-server-dom-turbopack All package.json files have been scanned and vulnerable versions have been patched to the correct fixed versions based on the official React advisory. Co-authored-by: Vercel <vercel[bot]@users.noreply.github.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Test Results85 tests 85 ✅ 32s ⏱️ Results for commit 4d119bb. |
🧪 Test Results & Coverage Report✅ All Tests Passed! (85/85)🎉 Great work! All your tests are passing. 📋 Test Suites Summary
🔍 Detailed Test Results✅ jest tests (85/85 passed, 18808ms)✅ KoreanMission 초기 렌더링이 정상적으로 되는지 확인 📋 View detailed workflow results 📊 Code Coverage Report
🔴 Low Coverage: 8.4%Your code coverage is below recommended levels. Please add more tests. 📂 Coverage by File (144 files tested)Click to expand file-by-file coverage
📈 RecommendationsConsider improving test coverage for:
🤖 Automated report | ⏱️ Generated: 2025. 12. 20. 오후 10:28:00 KST | 🔄 Workflow: Run Tests on main PR |
Important
This is an automatic PR generated by Vercel to help you with patching efforts. We can't guarantee it's comprehensive, and it may contain mistakes. Please review our guidance before merging these changes.
A critical remote code execution (RCE) vulnerability in React Server Components, impacting frameworks such as Next.js, was identified in the project kkuko-utils. The vulnerability enables unauthenticated RCE on the server via insecure deserialization in the React Flight protocol.
This issue is tracked under:
This automated pull request upgrades the affected React and Next.js packages to patched versions that fully remediate the issue.
More Info | security@vercel.com