React 19 Server Components Security Vulnerability – Nextra Compatibility Issue

[NileshChouhan7]

Hi Nextra team,

I came across the critical security vulnerability in React Server Components (CVE-2025-55182) affecting versions 19.0, 19.1.0, 19.1.1, and 19.2.0. The fix requires upgrading to 19.0.1, 19.1.2, or 19.2.1.

However, I noticed that Nextra currently does not support React 19.x. I’m concerned about the security implications since my project uses Nextra.

Does Nextra have a recommended workaround or mitigation for this vulnerability?

Are there plans to support React 19.x with the security patches soon?

If my project doesn’t directly use React Server Functions, am I still considered at risk?

Thanks in advance for guidance!

[dimaMachina]

Where did you find it that nextra doesn't support React 19?

[NileshChouhan7]

npm warn While resolving: @theguild/remark-mermaid@0.1.3
npm warn Found: react@19.2.1
npm warn Could not resolve dependency:
npm warn peer react@"^18.2.0" from @theguild/remark-mermaid@0.1.3
npm warn @theguild/remark-mermaid@"^0.1.3" from nextra@3.3.1