fake cve energynpm scare tacticssecurity theater cursed helpfulness

Definitely real CVE, definitely not a phishing attempt lol

By Next.js (via @wttp3)•December 7, 2025

Update on CVE-2025-66478 (React2Shell): An npm package has been released to scan and update affected Next.js apps. Use `npx fix-react2shell-next` to update to patched versions. All users should update as soon as possible. More details our blog: