Over the past days, many of our customers have seen reports about a critical remote code execution vulnerability in React Server Components (CVE-2025-55182) and the related Next.js vulnerability (CVE-2025-66478). These issues have received a lot of attention and have understandably raised questions about potential impact.

We have analyzed both vulnerabilities in detail and reviewed all Nextron products that use React, including:
• ASGARD Management Center
• ASGARD Analysis Cockpit
• ASGARD Security Center
• THOR Cloud
• THOR Cloud Lite
• Nextron Customer Portal

The affected vulnerability applies only to React version 19 in combination with React Server Components and Server Functions, as well as to specific versions of Next.js that integrate this React Server Components model.
React version 19 became stable in December 2024, making it a relatively new major release.

All Nextron products listed above are currently based on React version 18 and do not use React Server Components.
As a result, none of our products are affected by CVE-2025-55182 or CVE-2025-66478.

We continuously monitor security developments in the ecosystems our products rely on and evaluate major framework changes very carefully before adopting them in production systems. This also applies to future React and Next.js upgrades.

If you have any questions regarding this topic or need clarification for your environment, our support team is happy to help.