Next.js Released a Scanner to Detect and Update Apps Impacted by React2Shell Vulnerability

A new CLI tool, fix-react2shell-next, is available to detect and automatically patch the critical React2Shell RCE (CVE-2025-66478) in Next.js and React Server Components by recursively scanning package.json files (including monorepos), upgrading identified vulnerable packages to specified patched versions, and refreshing lockfiles; the advisory lists affected version ranges and provides npx usage with dry-run, json, and forced-fix options.