Automated React2Shell vulnerability patching is now available
Vercel Agent now automatically detects vulnerable packages in your project and generates pull requests to upgrade them to patched versions, addressing the critical React2Shell (CVE-2025-55182) remote code execution vulnerability affecting React 19 and Next.js. These automatic fixes are available at no cost and help teams stay secure with minimal manual effort.
Vercel Agent now detects vulnerable packages in your project, and automatically generates pull requests with fixes to upgrade them to .patched versions
Powered by Vercel's , these auto-fix upgrades are available at no cost and help teams stay secure with minimal manual effort.self-driving infrastructure
is a critical remote code execution vulnerability in React Server Components that affects React 19 and frameworks that use it like Next.js. Specially crafted requests can trigger unintended code execution if your application is running a vulnerable version. Immediate upgrades are required for all projects using affected React and Next.js releases.About React2ShellReact2Shell (CVE-2025-55182)
Get the or view the .latest updates on React2Shellnew dashboard here
Automatic detection of vulnerable React, Next.js, and related RSC packages
Automatic PR creation
Full execution and verification of updates inside isolated Sandbox environments
Preview links generated with PR, to manually validate updates
Source: original entry ↗
More from Vercel
Follow Vercel to get its new changes in your feed and email digest.
OpenAI Decisions API now available on AI Gateway
OpenAI's Decisions API is now accessible through Vercel's AI Gateway with an OpenAI-compatible endpoint, enabling decision models to answer typed questions and return probabilities, choices, and scores for routing, triage, and guardrails use cases. Support is available across the OpenAI SDK, AI SDK, HTTP API, and CLI with the latest versions.
Timestamp attributes now supported in Vercel Flags
Vercel Flags now supports timestamp attributes for entities, allowing you to create time-based targeting rules. Use this feature to run limited-time campaigns, show content between specific dates, or target users based on registration date.
Glyph Cluster now available in stealth on AI Gateway
Glyph Cluster, a reasoning model for coding and long-context analysis, is now available as a stealth model on Vercel's AI Gateway for Pro and Enterprise plan teams with purchased AI Gateway credits at no cost during the stealth period. The model supports function calling, streams responses, and can be accessed via AI SDK, OpenAI-compatible APIs, and coding agents.