---
title: Protection from CVE-2025-55182 (React) and CVE-2025-66478 (Next.js)
summary: null
url: >-
  https://www.fastly.com/documentation/reference/changes/2025/12/added-virtual-patch-for-cve-2025-66478
---

A critical Remote Code Execution (RCE) vulnerability affecting both the React and Next.js frameworks has been assigned two CVEs: CVE-2025-55182 (React) and CVE-2025-66478 (Next.js). Fastly has created a single virtual patch labeled CVE-2025-66478 that addresses the vulnerabilities in both frameworks, and it is now available within your account. For more information, check out our [service advisory](https://www.fastlystatus.com/incident/378084).

To activate it and add protection to your services, follow the steps for your control panel below.

## Next-Gen WAF control panel

### Professional or Premier platform

1.   Log in to the [Next-Gen WAF control panel](https://dashboard.signalsciences.net).

2.   From the **Sites** menu, select a site if you have more than one site.

3. From the **Rules** menu, select **Templated Rules**.
4. In the search bar, enter `CVE-2025-66478` and then click **View** for the CVE-2025-66478 templated rule.
5. Click **Configure** and then **Add trigger**.
6. Select the **Block requests from an IP immediately if the CVE-2025-66478 signal is observed** checkbox.
7. Click **Update rule**.

### Essential platform

1.   Log in to the [Next-Gen WAF control panel](https://dashboard.signalsciences.net).

2.   From the **Sites** menu, select a site if you have more than one site.

3. Click the **Signals** tab.
4. In the search bar, enter `CVE-2025-66478` and then click **View** for the CVE-2025-66478 tag.
5. Click the **Detections** tab and then **Add detection**.
6. Verify the switch is set to **Enabled**.
7. Click **Create detection**.
8. Click the **Alerts** tab and then **Add alert**.
9. In the **Status** area, set the switch to **Enabled**.
10. Click **Save alert**.

## Fastly control panel

1.   Log in to the [Fastly control panel](https://manage.fastly.com).

2.   Go to **Security** > **Next-Gen WAF** > [**Workspaces**](https://manage.fastly.com/security/ngwaf/workspaces).

3. Click **Virtual Patches**.
4. In the search bar, enter `CVE-2025-66478` and then click the pencil to the right of the CVE-2025-66478 virtual patch.
5. From the **Status** menu, select **Enabled**.
6. _(Optional)_ If your workspace is in blocking mode, choose whether to **Block requests** or **Log requests** if the CVE-2025-66478 signal is observed.
7. Click **Update virtual patch**.