Consider marking npm's next as a directly affected (downstream) package for CVE-2025-55183 / CVE-2025-55184

[fingeromer]

I'd like to raise a modeling question regarding CVE-2025-55183 and CVE-2025-55184, currently associated with the upstream React RSC packages (react-server-dom-*).

In practice, Next.js is affected even when those packages do not appear as npm dependencies, because Next copies the React Server Components implementation directly into the next package itself (under next/dist/compiled). This means the vulnerable code is physically present and executed from next, rather than being consumed via a standard npm dependency relationship.

The official Next.js advisory explicitly states that:

“These vulnerabilities originate in the upstream React implementation… This advisory tracks the downstream impact on Next.js applications using the App Router.”
https://nextjs.org/blog/security-update-2025-12-11

Next.js addressed these issues by backporting the upstream React fixes into its own vendored code, not by bumping an npm dependency. As a result:

• Applications may be vulnerable even if no react-server-dom-* package exists in the dependency graph
• The only actionable remediation is upgrading next
• SCA/SBOM tools that rely solely on dependency graphs may miss or misattribute the risk

Given this, we wanted to ask whether it would make sense for OSV to also list next as a directly affected downstream package for:

CVE-2025-55183
CVE-2025-55184

This would more accurately reflect runtime reality and help downstream tooling correctly identify and remediate affected applications.

Thanks for considering!

[conorfitch]

Hey, do these advisories cover what you're looking for?:

https://osv.dev/vulnerability/GHSA-w37m-7fhw-fmv9
https://osv.dev/vulnerability/GHSA-mwv6-3258-q52c

[fingeromer]

Thanks @conorfitch - the advisories do cover next's vulnerabilities! But I wonder why they are not have the CVE as alias.
What are the conditions for this match?
I also see NVD has next in CPEs - https://nvd.nist.gov/vuln/detail/CVE-2025-55184

[conorfitch]

The same issue interestingly came up after last week's React vulnerability. It was explained in this PR that, due to a technical limitation in GitHub's backend, GitHub are unable to add the same alias to multiple advisories: github/advisory-database#6496.

However, as brought up in that PR, a more accurate use of the OSV schema for this relationship, would be to use the upstream field.

Although, if you look at the OSV records of GitHub advisories, you'll see that they say "schema_version": "1.4.0". The upstream field was only added in v1.7.0 of the schema, so GitHub would have to make an update for that to be used.