Security vulnerability identified with React Server Components

Event timeline

How this incident unfolded, from the official status page.

1. Investigating

   11 months ago

   Sanity

   A security vulnerability (CVE-2025-55182) affecting React Server Components (RSC) and several related packages including Next.js was disclosed today by the React Team (https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components). Our Impact: Vercel has already rolled out platform-level protections and preventative measures. We are acting proactively and have started rolling out fixes across our platform and services as well. Required Action: Sanity studio deployments are not affected and require no action. If your Studio is deployed using Next.js, please follow the recommended steps outlined here: https://vercel.com/changelog/cve-2025-55182#resolution.

2. Monitoring

   11 months ago

   Sanity

   Our team has applied the initial recommended updates from the React Team regarding the recent vulnerability. We are actively completing remaining internal package updates and closely monitoring any further guidance from React and Vercel. Required Action for Next Studio Deployments: Note: Sanity Studio deployments are not affected and require no action. If your Studio is deployed using Next.js, please follow the recommended steps outlined here: https://vercel.com/changelog/cve-2025-55182#resolution

3. Resolved

   11 months ago

   Sanity

   We have completed dependency updates per guidance from Vercel and the React team. Sanity studio deployments are not affected and require no action. If your Studio is deployed using Next.js, please follow the recommended steps outlined here: https://vercel.com/changelog/cve-2025-55182#resolution.