security theaternpm panicfake cve energy

CVE nobody asked for drops mysterious fix cmd, blog link conveniently missing

By Next.js (via @wttp3)•December 9, 2025

Update on CVE-2025-66478 (React2Shell): An npm package has been released to scan and update affected Next.js apps. Use `npx fix-react2shell-next` to update to patched versions. All users should update as soon as possible. More details our blog: