security: patch CVE-2025-55182 (React RCE vulnerability)

[freeqaz-scale]

Summary

This PR patches CVE-2025-55182, a critical Remote Code Execution vulnerability affecting React Server Components.

What's Changed

• Added overrides / resolutions to package.json to pin Next.js to patched versions
  • 16.x → 16.0.7
  • 15.x → 15.5.7
  • 14.3.0-canary.* → 14.3.0-canary.88 (if applicable)
• Regenerated lockfile with patched dependencies

Why This Matters

"Default configurations are vulnerable — a standard Next.js app created with create-next-app and built for production can be exploited with no code changes by the developer."
— Wiz Security Research

Applications using React Server Components (including all Next.js App Router apps) are vulnerable to unauthenticated RCE via malicious payloads sent to Server Function endpoints.

CVE Details

CVE	CVE-2025-55182
CVSS Score	10.0 (Critical)
Attack Vector	Network (unauthenticated)
Impact	Remote Code Execution

References

• React Security Advisory
• Wiz Technical Writeup
• Next.js Security Advisory (GHSA-9qr9-h5gf-34mp)
• Internal Reference PR

Test Plan

• CI passes
• Application builds successfully
• yarn.lock / package-lock.json / pnpm-lock.yaml shows patched Next.js version

Patched Subdirectories

• ✅ agentex-ui: 15.5.2 → 15.5.7 (npm)

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​next@​15.5.2 ⏵ 15.5.7	+18		+10	+3	+31

View full report