New blog: https://www.veracode.com/blog/decoding-cve-2025-66478-signal-vs-noise-in-sca/

In early December 2025, security dashboards lit up with alerts for CVE-2025-66478, a critical vulnerability seemingly targeting Next.js. The advisory pointed to a remote code execution (RCE) flaw, sending development and security teams scrambling. Yet, a closer look reveals a more complex reality—one that underscores the importance of precision in Software Composition Analysis (SCA).