Notifications
Clear all
Topic starter
02/08/2026 12:13 pm
TL;DR: CVE-2025-66478 was rejected as a duplicate of CVE-2025-55182, but the underlying flaw remained in React Server Component runtimes that Next.js and other frameworks bundle, according to Veracode Threat Research. The incident shows that SCA accuracy now depends on tracing transitive dependencies to the true source package, not the wrapper framework.
NHIMG editorial — based on content published by Veracode: Decoding CVE-2025-66478, signal vs. noise in SCA
By the numbers:
- Any application using versions of these packages below 19.0.1 / 19.1.2 / 19.2.1 is exposed.
- The vulnerability is fully resolved in patched Next.js releases including 15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7, and 16.0.7.
Questions worth separating out
Q: What breaks when SCA points to the wrong package instead of the vulnerable source?
A: Teams waste remediation effort on wrapper frameworks, duplicate alerts inflate the backlog, and the real vulnerable dependency can remain unpatched.
Q: When should organisations prioritise transitive dependency review over top-level package updates?
A: They should do it whenever the vulnerability may live in a bundled runtime, shared library, or deserialisation path that the top-level framework merely invokes.
Q: What do security teams get wrong about duplicate CVEs in SCA?
A: They often assume a duplicate means the issue is gone or that the alert can be ignored.
Practitioner guidance
- Audit lock files for the vulnerable runtime packages Inspect package trees for react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack, then confirm whether the vulnerable versions are present in the resolved graph.
- Upgrade the package that actually carries the flaw Move to patched versions of the affected React Server Component packages or the Next.js releases that bundle them, then verify the resolved dependency tree after the update.
- Consolidate duplicate CVEs in SCA workflows Configure triage so duplicate records map back to one source issue and one remediation path, which prevents wrapper frameworks from being treated as independent vulnerabilities.
What's in the full analysis
Veracode's full article covers the operational detail this post intentionally leaves for the source:
- Exact package inventory command examples for checking resolved React Server Component versions
- The full patched-version matrix for Next.js and the underlying runtime packages
- How Veracode maps duplicate CVEs back to a single source issue in its analysis pipeline
- The vendor's step-by-step remediation guidance for teams working from SBOM and lock-file evidence
👉 Read Veracode's analysis of CVE-2025-66478 and React Server Component exposure →
CVE-2025-66478 and SCA noise: where should teams focus now?
Explore further
02/08/2026 1:16 pm
Signal quality is now a governance control, not just a tooling feature. SCA only works when it distinguishes the actual vulnerable package from the framework that consumes it. When duplicate CVEs are surfaced as if they were separate flaws, remediation queues become polluted and teams spend time on the wrong layer. The governance lesson is straightforward: precision in dependency attribution is part of secure software delivery.
A few things that frame the scale:
- Only 1.5 out of 10 organisations are highly confident in their ability to secure NHIs, compared to nearly 1 in 4 for securing human identities, according to The State of Non-Human Identity Security.
- Lack of credential rotation is cited as the top cause of NHI-related attacks by 45% of organisations, according to The State of Non-Human Identity Security.
A question worth separating out:
Q: How can developers verify that an SCA finding is truly remediated?
A: Re-run dependency inspection after patching and confirm the vulnerable package no longer appears in the resolved tree. Do not rely only on the top-level framework version or on a scanner’s silence. A clean result requires proof that the vulnerable runtime package has been replaced or removed.
👉 Read our full editorial: CVE-2025-66478 shows why SCA must trace the real source
