> This page is for Developer.

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.bigcommerce.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.bigcommerce.com/_mcp/server.

# Catalyst version 1.3.7 Release Notes

A high-severity Denial of Service ([CVE-2025-55184](https://www.cve.org/CVERecord?id=CVE-2025-55184)) and a medium-severity Source Code Exposure ([CVE-2025-55183](https://www.cve.org/CVERecord?id=CVE-2025-55183)) related to React Server Components have been disclosed affecting React versions 19.0. This includes Next.js which is used for internal applications at Commerce as well as customers building storefronts using Catalyst and Makeswift. To avoid exposure, Next.js and React need to be updated to their latest patched versions.

The initial fix was incomplete and did not fully prevent denial-of-service attacks for all payload types, resulting in [CVE-2025-67779](https://www.cve.org/CVERecord?id=CVE-2025-67779).

> **Note**
>
> **Important**: This release provides an additional security patch for the same
> CVEs addressed in [1.3.6](/developer/docs/storefront/catalyst/release-notes/1-3-6). You
> should upgrade to `1.3.7` to receive the latest security fixes.

Catalyst v1.3.7 release addresses these security vulnerabilities, including the additional CVE-2025-67779.

## Key Changes

* **Next.js 15.5.9**: Upgraded from Next.js 15.5.8 to 15.5.9
* **React 19**: Upgraded to React 19.1.4 and React DOM 19.1.4

## Migration Guide

### Update Dependencies

Update dependencies in your `package.json`:

```json showLineNumbers={false}
{
	"dependencies": {
		"next": "15.5.9",
		"react": "19.1.4",
		"react-dom": "19.1.4"
	},
	"devDependencies": {
		"@next/bundle-analyzer": "15.5.9",
		"eslint-config-next": "15.5.9"
	}
}
```

### Run `pnpm install`

```bash showLineNumbers={false}
pnpm install
```

> **Note**
>
> **Note**: `next` will automatically update your `tsconfig.json` file.

## Release Tags

We have published new tags for the Core and Makeswift versions of Catalyst. Target these tags to pull the latest code:

* [**@bigcommerce/catalyst-core@1.3.7**](https://github.com/bigcommerce/catalyst/releases/tag/%40bigcommerce%2Fcatalyst-core%401.3.7)
* [**@bigcommerce/catalyst-makeswift@1.3.8**](https://github.com/bigcommerce/catalyst/releases/tag/%40bigcommerce%2Fcatalyst-makeswift%401.3.8)

And as always, you can pull the latest stable release with these tags:

* [**@bigcommerce/catalyst-core@latest**](https://github.com/bigcommerce/catalyst/releases/tag/%40bigcommerce%2Fcatalyst-core%40latest)
* [**@bigcommerce/catalyst-makeswift@latest**](https://github.com/bigcommerce/catalyst/releases/tag/%40bigcommerce%2Fcatalyst-makeswift%40latest)