Security: CVE-2025-66478 (React2Shell) RCE in Dependencies

[link1eok]

Hello,

This repository contains a critical remote code execution (RCE) vulnerability (https://nextjs.org/blog/CVE-2025-66478, CVSS 10.0) affecting React Server Components.

Required Actions
Immediate Remediation
Update to patched versions:

For Next packages:

json
{
"next": "15.3.6",
}

Sharing this for awareness. Thank you.

[mvanhorn]

Implemented in #520 - bumps next from 15.3.1 to 15.3.9. Used 15.3.9 instead of the suggested 15.3.6 because yarn audit flagged the latter as also vulnerable to a separate issue (security-update-2025-12-11).