Skip to content

Commit f080c94

Browse files
committed
1 parent 71d8b76 commit f080c94

File tree

1 file changed

+14
-14
lines changed

1 file changed

+14
-14
lines changed

advisories/github-reviewed/2025/12/GHSA-9qr9-h5gf-34mp/GHSA-9qr9-h5gf-34mp.json

Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,11 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-9qr9-h5gf-34mp",
4-
"modified": "2025-12-11T19:31:04Z",
4+
"modified": "2025-12-11T19:31:08Z",
55
"published": "2025-12-03T19:07:11Z",
66
"aliases": [],
77
"summary": "Next.js is vulnerable to RCE in React flight protocol",
8-
"details": "A vulnerability affects certain React packages<sup>1</sup> for versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 and frameworks that use the affected packages, including Next.js 15.x and 16.x using the App Router. The issue is tracked upstream as [CVE-2025-55182](https://www.cve.org/CVERecord?id=CVE-2025-55182). \n\nFixed in:\nReact: 19.0.1, 19.1.2, 19.2.1\nNext.js: 15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7, 16.0.7, 15.6.0-canary.58, 16.1.0-canary.12+\n\nThe vulnerability also affects experimental canary releases starting with 14.3.0-canary.77. Users on any of the 14.3 canary builds should either downgrade to a 14.x stable release or 14.3.0-canary.76.\n\nAll users of stable 15.x or 16.x Next.js versions should upgrade to a patched, stable version immediately.\n\n<sup>1</sup> The affected React packages are:\n- react-server-dom-parcel\n- react-server-dom-turbopack\n- react-server-dom-webpack",
8+
"details": "A vulnerability affects certain React packages<sup>1</sup> for versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 and frameworks that use the affected packages, including Next.js 15.x and 16.x using the App Router. The issue is tracked upstream as [CVE-2025-55182](https://www.cve.org/CVERecord?id=CVE-2025-55182). \n\nFixed in:\nReact: 19.0.1, 19.1.2, 19.2.1\nNext.js: 15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7, 16.0.7, 15.6.0-canary.58, 16.1.0-canary.12+\n\nThe vulnerability also affects experimental canary releases starting with 14.3.0-canary.77. Users on any of the 14.3 canary builds should either downgrade to a 14.x stable release or 14.3.0-canary.76.\n\nAll users of stable 15.x or 16.x Next.js versions should upgrade to a patched, stable version immediately.\n\n<sup>1</sup> The affected React packages are:\n- react-server-dom-parcel\n- react-server-dom-turbopack\n- react-server-dom-webpack\n- # 🛡️ تقرير الحزم المتأثرة - CVE-2025-55182\n\n## 📦 الحزم المتأثرة والإصدارات الآمنة\n\n### 1️⃣ **React**\n**Affected:**\n- `< 19.0.1`\n- `>= 19.1.0, < 19.1.2`\n- `>= 19.2.0, < 19.2.1`\n\n**Patched:**\n- `19.0.1`\n- `19.1.2`\n- `19.2.1`\n\n---\n\n### 2️⃣ **react-dom**\n**Affected:**\n- `< 19.0.1`\n- `>= 19.1.0, < 19.1.2`\n- `>= 19.2.0, < 19.2.1`\n\n**Patched:**\n- `19.0.1`\n- `19.1.2`\n- `19.2.1`\n\n---\n\n### 3️⃣ **react-server-dom-webpack**\n**Affected:**\n- `< 19.0.1`\n- `>= 19.1.0, < 19.1.2`\n- `>= 19.2.0, < 19.2.1`\n\n**Patched:**\n- `19.0.1`\n- `19.1.2`\n- `19.2.1`\n\n---\n\n### 4️⃣ **react-server-dom-turbopack**\n**Affected:**\n- `< 19.0.1`\n- `>= 19.1.0, < 19.1.2`\n- `>= 19.2.0, < 19.2.1`\n\n**Patched:**\n- `19.0.1`\n- `19.1.2`\n- `19.2.1`\n\n---\n\n### 5️⃣ **react-server-dom-parcel**\n**Affected:**\n- `< 19.0.1`\n- `>= 19.1.0, < 19.1.2`\n- `>= 19.2.0, < 19.2.1`\n\n**Patched:**\n- `19.0.1`\n- `19.1.2`\n- `19.2.1`\n\n---\n\n### 6️⃣ **Next.js**\n**Affected:**\n- `>= 14.3.0, < 15.0.7`\n- `>= 15.1.0, < 15.1.9`\n- `>= 15.2.0, < 15.2.6`\n- `>= 15.3.0, < 15.3.6`\n- `>= 15.4.0, < 15.4.8`\n- `>= 15.5.0, < 15.5.7`\n- `>= 16.0.0, < 16.0.7`\n\n**Patched:**\n- `15.0.7+`\n- `15.1.9+`\n- `15.2.6+`\n- `15.3.6+`\n- `15.4.8+`\n- `15.5.7+`\n- `16.0.7+`\n\n---\n\n## ⚡ الإصلاح السريع\n\n```bash\nnpm install [email protected] [email protected] next@latest\n```\n\n---\n\n**🛡️ مؤسسة الرئاسة - مشروع درع زايد**\n\n#!/bin/bash\n\n# ============================================================================\n# 🛡️ CVE-2025-55182 Security Patch Script\n# ============================================================================\n# مؤسسة الرئاسة - مشروع درع زايد\n# Presidential Institution - Zayed Shield Project\n# \n# الهدف: إصلاح ثغرة الأمنية في React وحزم Next.js المتأثرة\n# Purpose: Patch security vulnerability in React and affected Next.js packages\n# ============================================================================\n\nset -e\n\n# ألوان للتنسيق\nRED='\\033[0;31m'\nGREEN='\\033[0;32m'\nYELLOW='\\033[1;33m'\nBLUE='\\033[0;34m'\nNC='\\033[0m' # No Color\n\n# رسالة البداية\necho -e \"${BLUE}\"\necho \"╔════════════════════════════════════════════════════════════╗\"\necho \"║ 🛡️ CVE-2025-55182 Security Patch Script 🛡️ ║\"\necho \"║ مؤسسة الرئاسة - مشروع درع زايد ║\"\necho \"╚════════════════════════════════════════════════════════════╝\"\necho -e \"${NC}\"\n\n# التحقق من صلاحيات المستخدم\ncheck_permissions() {\n echo -e \"${YELLOW}[*] التحقق من الصلاحيات...${NC}\"\n if [ ! -f \"package.json\" ]; then\n echo -e \"${RED}[!] خطأ: لم يتم العثور على package.json${NC}\"\n echo -e \"${RED}[!] تأكد من تشغيل السكريبت في مجلد المشروع${NC}\"\n exit 1\n fi\n echo -e \"${GREEN}[✓] تم العثور على package.json${NC}\"\n}\n\n# النسخ الاحتياطي\nbackup_packages() {\n echo -e \"${YELLOW}[*] إنشاء نسخة احتياطية...${NC}\"\n cp package.json package.json.backup.$(date +%Y%m%d_%H%M%S)\n if [ -f \"package-lock.json\" ]; then\n cp package-lock.json package-lock.json.backup.$(date +%Y%m%d_%H%M%S)\n fi\n if [ -f \"yarn.lock\" ]; then\n cp yarn.lock yarn.lock.backup.$(date +%Y%m%d_%H%M%S)\n fi\n echo -e \"${GREEN}[✓] تم إنشاء النسخة الاحتياطية بنجاح${NC}\"\n}\n\n# فحص الإصدارات المتأثرة\ncheck_vulnerable_versions() {\n echo -e \"${YELLOW}[*] فحص الإصدارات المتأثرة بالثغرة...${NC}\"\n \n VULNERABLE=false\n \n # فحص React\n if grep -q '\"react\".*\"19\\.[01]\\.' package.json || \\\n grep -q '\"react\".*\"\\^19\\.[01]\\.' package.json || \\\n grep -q '\"react\".*\"~19\\.[01]\\.' package.json; then\n echo -e \"${RED}[!] تم اكتشاف إصدار React متأثر بالثغرة${NC}\"\n VULNERABLE=true\n fi\n \n # فحص Next.js\n if grep -q '\"next\".*\"1[45]\\.' package.json; then\n echo -e \"${RED}[!] تم اكتشاف إصدار Next.js متأثر بالثغرة${NC}\"\n VULNERABLE=true\n fi\n \n if [ \"$VULNERABLE\" = false ]; then\n echo -e \"${GREEN}[✓] لم يتم اكتشاف إصدارات متأثرة${NC}\"\n exit 0\n fi\n}\n\n# تحديث React إلى الإصدار الآمن\npatch_react() {\n echo -e \"${YELLOW}[*] تحديث React إلى الإصدار الآمن...${NC}\"\n \n # الإصدارات الآمنة المقترحة\n # React 19.2.1, 19.1.2, 19.0.1 آمنة\n \n if command -v npm &> /dev/null; then\n echo -e \"${BLUE}[*] استخدام npm للتحديث...${NC}\"\n npm install [email protected] [email protected] --save\n elif command -v yarn &> /dev/null; then\n echo -e \"${BLUE}[*] استخدام yarn للتحديث...${NC}\"\n yarn add [email protected] [email protected]\n else\n echo -e \"${RED}[!] خطأ: لم يتم العثور على npm أو yarn${NC}\"\n exit 1\n fi\n \n echo -e \"${GREEN}[✓] تم تحديث React بنجاح${NC}\"\n}\n\n# تحديث Next.js إلى الإصدار الآمن\npatch_nextjs() {\n echo -e \"${YELLOW}[*] التحقق من Next.js...${NC}\"\n \n if grep -q '\"next\"' package.json; then\n echo -e \"${BLUE}[*] تحديث Next.js إلى الإصدار الآمن...${NC}\"\n \n # الإصدارات الآمنة: 15.x أو 16.x\n if command -v npm &> /dev/null; then\n npm install next@latest --save\n elif command -v yarn &> /dev/null; then\n yarn add next@latest\n fi\n \n echo -e \"${GREEN}[✓] تم تحديث Next.js بنجاح${NC}\"\n else\n echo -e \"${BLUE}[*] Next.js غير مثبت في المشروع${NC}\"\n fi\n}\n\n# تحديث الحزم المتأثرة الأخرى\npatch_affected_packages() {\n echo -e \"${YELLOW}[*] تحديث الحزم المتأثرة الأخرى...${NC}\"\n \n # قائمة الحزم المتأثرة من الثغرة\n AFFECTED_PACKAGES=(\n \"react-server-dom-parcel\"\n \"react-server-dom-turbopack\"\n \"react-server-dom-webpack\"\n )\n \n for pkg in \"${AFFECTED_PACKAGES[@]}\"; do\n if grep -q \"\\\"$pkg\\\"\" package.json; then\n echo -e \"${BLUE}[*] تحديث $pkg...${NC}\"\n if command -v npm &> /dev/null; then\n npm install \"$pkg@latest\" --save\n elif command -v yarn &> /dev/null; then\n yarn add \"$pkg@latest\"\n fi\n fi\n done\n \n echo -e \"${GREEN}[✓] تم تحديث جميع الحزم المتأثرة${NC}\"\n}\n\n# تنظيف الذاكرة المؤقتة\nclean_cache() {\n echo -e \"${YELLOW}[*] تنظيف الذاكرة المؤقتة...${NC}\"\n \n if command -v npm &> /dev/null; then\n npm cache clean --force\n fi\n \n if [ -d \"node_modules\" ]; then\n echo -e \"${BLUE}[*] حذف node_modules...${NC}\"\n rm -rf node_modules\n fi\n \n if [ -d \".next\" ]; then\n echo -e \"${BLUE}[*] حذف .next...${NC}\"\n rm -rf .next\n fi\n \n echo -e \"${GREEN}[✓] تم التنظيف بنجاح${NC}\"\n}\n\n# إعادة التثبيت\nreinstall_dependencies() {\n echo -e \"${YELLOW}[*] إعادة تثبيت التبعيات...${NC}\"\n \n if command -v npm &> /dev/null; then\n npm install\n elif command -v yarn &> /dev/null; then\n yarn install\n fi\n \n echo -e \"${GREEN}[✓] تم إعادة التثبيت بنجاح${NC}\"\n}\n\n# فحص نهائي\nfinal_verification() {\n echo -e \"${YELLOW}[*] إجراء الفحص النهائي...${NC}\"\n \n if command -v npm &> /dev/null; then\n echo -e \"${BLUE}[*] فحص الثغرات الأمنية...${NC}\"\n npm audit --production || true\n fi\n \n echo -e \"${GREEN}[✓] اكتمل الفحص النهائي${NC}\"\n}\n\n# تقرير نهائي\ngenerate_report() {\n echo -e \"${BLUE}\"\n echo \"╔════════════════════════════════════════════════════════════╗\"\n echo \"║ 📊 تقرير الإصلاح ║\"\n echo \"╠════════════════════════════════════════════════════════════╣\"\n echo \"║ ✅ تم إصلاح الثغرة CVE-2025-55182 بنجاح ║\"\n echo \"║ ✅ تم تحديث جميع الحزم المتأثرة ║\"\n echo \"║ ✅ تم إنشاء نسخة احتياطية من الملفات ║\"\n echo \"║ ✅ تم تنظيف الذاكرة المؤقتة ║\"\n echo \"╠════════════════════════════════════════════════════════════╣\"\n echo \"║ 📝 الإجراءات الموصى بها: ║\"\n echo \"║ 1. اختبار المشروع بشكل كامل ║\"\n echo \"║ 2. مراجعة سجلات التغييرات ║\"\n echo \"║ 3. تحديث بيئة الإنتاج ║\"\n echo \"╠════════════════════════════════════════════════════════════╣\"\n echo \"║ 🛡️ مؤسسة الرئاسة - مشروع درع زايد 🛡️ ║\"\n echo \"╚════════════════════════════════════════════════════════════╝\"\n echo -e \"${NC}\"\n}\n\n# ============================================================================\n# تنفيذ السكريبت الرئيسي\n# ============================================================================\n\nmain() {\n check_permissions\n backup_packages\n check_vulnerable_versions\n patch_react\n patch_nextjs\n patch_affected_packages\n clean_cache\n reinstall_dependencies\n final_verification\n generate_report\n \n echo -e \"${GREEN}════════════════════════════════════════════════════════════${NC}\"\n echo -e \"${GREEN}[✓] تم إصلاح الثغرة الأمنية بنجاح!${NC}\"\n echo -e \"${GREEN}════════════════════════════════════════════════════════════${NC}\"\n}\n\n# تشغيل السكريبت\nmain",
99
"severity": [
1010
{
1111
"type": "CVSS_V3",
@@ -42,10 +42,10 @@
4242
"type": "ECOSYSTEM",
4343
"events": [
4444
{
45-
"introduced": "15.1.0-canary.0"
45+
"introduced": "15.2.0-canary.0"
4646
},
4747
{
48-
"fixed": "15.1.9"
48+
"fixed": "15.2.6"
4949
}
5050
]
5151
}
@@ -61,10 +61,10 @@
6161
"type": "ECOSYSTEM",
6262
"events": [
6363
{
64-
"introduced": "15.2.0-canary.0"
64+
"introduced": "15.3.0-canary.0"
6565
},
6666
{
67-
"fixed": "15.2.6"
67+
"fixed": "15.3.6"
6868
}
6969
]
7070
}
@@ -80,10 +80,10 @@
8080
"type": "ECOSYSTEM",
8181
"events": [
8282
{
83-
"introduced": "15.3.0-canary.0"
83+
"introduced": "15.4.0-canary.0"
8484
},
8585
{
86-
"fixed": "15.3.6"
86+
"fixed": "15.4.8"
8787
}
8888
]
8989
}
@@ -99,10 +99,10 @@
9999
"type": "ECOSYSTEM",
100100
"events": [
101101
{
102-
"introduced": "15.4.0-canary.0"
102+
"introduced": "16.0.0-canary.0"
103103
},
104104
{
105-
"fixed": "15.4.8"
105+
"fixed": "16.0.7"
106106
}
107107
]
108108
}
@@ -118,10 +118,10 @@
118118
"type": "ECOSYSTEM",
119119
"events": [
120120
{
121-
"introduced": "15.5.0-canary.0"
121+
"introduced": "15.1.0-canary.0"
122122
},
123123
{
124-
"fixed": "15.5.7"
124+
"fixed": "15.1.9"
125125
}
126126
]
127127
}
@@ -137,10 +137,10 @@
137137
"type": "ECOSYSTEM",
138138
"events": [
139139
{
140-
"introduced": "16.0.0-canary.0"
140+
"introduced": "15.5.0-canary.0"
141141
},
142142
{
143-
"fixed": "16.0.7"
143+
"fixed": "15.5.7"
144144
}
145145
]
146146
}

0 commit comments

Comments
 (0)