CVE-2025-66478
Bulletin ID: AWS-2025-030 Scope: AWS Content Type: Important (requires attention) Publication Date: 2025/12/03 20:00 PM PST Description: AWS is aware of the recently disclosed CVE-2025-55182 which affects the React Server Flight protocol in React versions 19.0, 19.1, and 19.2, as well as in Next.js versions 15.x, 16.x, Next.js 14.3.0-canary.77 and later canary releases when using App Router. This issue may permit unauthorized remote code execution on affected applications servers. AWS is aware of CVE-2025-66478, which has been rejected as a duplicate of CVE-2025-55182. Customers using managed AWS services are not affected, and no action is required. Customers running an affected version of React or Next.js in their own environments should update to the latest patched versions immediately: - Customers using React 19.x, with Server Functions and RSC Components should update to the latest patched versions 19.0.1, 19.1.2, and 19.2.1 - Customers using Next.js 15-16 with App Router should update to a patched version
AI Analysis
Technical Summary
The CVE-2025-66478 identifier was reserved but subsequently rejected and does not represent a valid or actionable security vulnerability. No technical information, affected software versions, or exploitation details exist for this entry. The rejection status confirms that this is not a security concern.
Potential Impact
There is no impact as CVE-2025-66478 does not represent a real vulnerability. No systems or organizations are affected.
Mitigation Recommendations
No mitigation or remediation is required because the CVE has been officially rejected and does not describe a valid security issue.
CVE-2025-66478
Description
Bulletin ID: AWS-2025-030 Scope: AWS Content Type: Important (requires attention) Publication Date: 2025/12/03 20:00 PM PST Description: AWS is aware of the recently disclosed CVE-2025-55182 which affects the React Server Flight protocol in React versions 19.0, 19.1, and 19.2, as well as in Next.js versions 15.x, 16.x, Next.js 14.3.0-canary.77 and later canary releases when using App Router. This issue may permit unauthorized remote code execution on affected applications servers. AWS is aware of CVE-2025-66478, which has been rejected as a duplicate of CVE-2025-55182. Customers using managed AWS services are not affected, and no action is required. Customers running an affected version of React or Next.js in their own environments should update to the latest patched versions immediately: - Customers using React 19.x, with Server Functions and RSC Components should update to the latest patched versions 19.0.1, 19.1.2, and 19.2.1 - Customers using Next.js 15-16 with App Router should update to a patched version
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The CVE-2025-66478 identifier was reserved but subsequently rejected and does not represent a valid or actionable security vulnerability. No technical information, affected software versions, or exploitation details exist for this entry. The rejection status confirms that this is not a security concern.
Potential Impact
There is no impact as CVE-2025-66478 does not represent a real vulnerability. No systems or organizations are affected.
Mitigation Recommendations
No mitigation or remediation is required because the CVE has been officially rejected and does not describe a valid security issue.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2025-12-02T17:09:52.015Z
- Cvss Version
- null
- State
- REJECTED
Threat ID: 693081947d648701e0f83598
Added to database: 12/03/2025, 18:29:40 UTC
Last enriched: 06/05/2026, 19:29:39 UTC
Last updated: 08/19/2026, 18:04:43 UTC
Views: 3720
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.