GitHub
github.com › facebook › react › security › advisories › GHSA-fv66-9v8q-g76r
Critical Security Vulnerability in React Server Components
December 3, 2025 - ### Impact There is an unauthenticated remote code execution vulnerability in React Server Components. We recommend upgrading immediately. The vulnerability is present in versions 19.0, 19...
GitHub
github.com › facebook › react › security › advisories › GHSA-83fc-fqcc-2hmg
Denial of Service Vulnerabilities in React Server Components
January 26, 2026 - 19.0.0, 19.0.1, 19.0.2, 19.0.3, ... React Server Components were incomplete and we found multiple denial of service vulnerabilities still exist in React Server Components....
Critical Vulnerabilities in React and Next.js: everything you need to know - A critical vulnerability has been identified in the React Server Components (RSC) "Flight" protocol, affecting the React 19 ecosystem and frameworks that implement it, most notably Next.js
Feels like having all the behind the scenes magic and hidden endpoints isn't the best approach to build robust solutions. Devs should define all open endpoints and expose them as part of routing configuration. More on reddit.com
82
236
December 3, 2025React 19 RCE vulnerability - can we stop pretending modern frameworks are automatically more secure?
Sir, this is a Wendy’s. More on reddit.com
12
0
January 27, 2026Critical Security Vulnerability in React Server Components
Expo is not affected since nothing is server side rendered. The vulnerability here is that someone can execute code on your server to, for example, extract the whole database. Native apps on a phone are client side apps, anything shipped in an application should be considered public. Same applies to expo-web, which run client side in a browser. More on reddit.com
6
5
December 5, 2025What is the newly disclosed React Server Components vulnerability (CVE-2025-55182)? How serious is it for Next.js apps?
There’s a vulnerability that would allow an attacker to run malicious code against server based components. Update to the appropriate specified version asap. They are intentionally not disclosing details. Just upgrade to the latest version and you’ll be fine. More on reddit.com
49
38
December 4, 2025Videos
07:31
React’s Worst Vulnerability Ever (RCE Exploit Explained) - YouTube
08:44
React HACKED - Initial review and incident summary - YouTube
11:14
Next.js & React vulnerability will break the internet - YouTube
10:02
React Got Hacked Again (this is bad) - YouTube
03:57
React.js shell shocked by 10.0 critical vulnerability… - YouTube
12:22
Everyone's Talking About This React Exploit - YouTube
Medium
medium.com › @jitendrakhilar609 › react-19-vulnerability-explained-8333eeee1961
React 19 Vulnerability Explained. Recently, a critical security… | by Jitendra Khilar | Medium
December 7, 2025 - Link 2 — https://github.com/... for all software and hardware, not just React. In short: React 19 RSC protocol could be hacked to execute commands....
GitHub
github.com › facebook › react › security › advisories › GHSA-7gmr-mq3h-m5h9
Denial of Service Vulnerability in React Server Components
December 11, 2025 - It was found that the fix to address CVE-2025-55184 in React Server Components was incomplete and does not prevent a denial of service attack in a specific case. We recommend updating immediately. The vulnerability exists in versions 19.0.2, 19.1.3, and 19.2.2 of:
React
react.dev › blog › 2025 › 12 › 03 › critical-security-vulnerability-in-react-server-components
Critical Security Vulnerability in React Server Components – React
A fix was introduced in versions 19.0.1, 19.1.2, and 19.2.1. If you are using any of the above packages please upgrade to any of the fixed versions immediately. If your app’s React code does not use a server, your app is not affected by this vulnerability.
Cyber Security News
cybersecuritynews.com › home › cyber security news › react server components vulnerability enables dos attacks
React Server Components Vulnerability Enables DoS Attacks
2 days ago - The React maintenance team has successfully backported security fixes to address the resource exhaustion flaw. Development teams on GitHub are urged to audit dependencies and upgrade immediately to restore security.
GitHub
github.com › advisories › GHSA-fv66-9v8q-g76r
React Server Components are Vulnerable to RCE · CVE-2025-55182 · GitHub Advisory Database · GitHub
December 3, 2025 - There is an unauthenticated remote code execution vulnerability in React Server Components. We recommend upgrading immediately. The vulnerability is present in versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 of:
Rankiteo Blog
blog.rankiteo.com › rea1775809531-react-vulnerability-april-2026
React: React Server Components Vulnerability Enables DoS Attacks
2 days ago - The flaw exploits ' 'weaknesses ... ' 'vulnerabilities in affected ' 'packages', 'root_causes': 'Deserialization of untrusted data ' '(CWE-502) and uncontrolled ' 'resource consumption (CWE-400) in ' 'React Server Components'}, 'recommendations': 'Upgrade to patched versions (19.0.5, 19.1.6, 19.2.5) ' 'immediately. Review server-side rendering configurations ' 'for potential exposure.', 'references': [{'source': 'GitHub Security ...
GitHub
github.com › dwisiswant0 › CVE-2025-55182
GitHub - dwisiswant0/CVE-2025-55182: Pre-auth RCE in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0. · GitHub
Pre-auth RCE in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0. - dwisiswant0/CVE-2025-55182
Starred by 61 users
Forked by 15 users
Languages JavaScript 96.4% | Dockerfile 3.6%
OX Security
ox.security › blog › react-cve-2025-55184-67779-55183-react-19-vulnerabilities
React Vulnerabilities Strike Again: Denial Of Service & Information Leakage in Patched Versions of React2Shell - OX Security
December 12, 2025 - New React vulnerabilities (CVE-2025-55184, CVE-2025-67779, CVE-2025-55183) affect React 19.0.0–19.2.2, including patched React2Shell versions. Learn the impact and how to fix it fast.
Palo Alto Networks
unit42.paloaltonetworks.com › cve-2025-55182-react-and-cve-2025-66478-next
Exploitation of Critical Vulnerability in React Server Components (Updated December 12)
December 12, 2025 - We observed attackers installing an interactive web shell disguised as a React File Manager (fm.js) retrieved directly from GitHub.
GitHub
github.com › advisories › GHSA-9qr9-h5gf-34mp
Next.js is vulnerable to RCE in React flight protocol · GHSA-9qr9-h5gf-34mp · GitHub Advisory Database · GitHub
December 3, 2025 - A vulnerability affects certain React packages1 for versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 and frameworks that use the affected packages, including Next.js 15.x and 16.x using the App Router.
Reddit
reddit.com › r/reactjs › critical vulnerabilities in react and next.js: everything you need to know - a critical vulnerability has been identified in the react server components (rsc) "flight" protocol, affecting the react 19 ecosystem and frameworks that implement it, most notably next.js
r/reactjs on Reddit: Critical Vulnerabilities in React and Next.js: everything you need to know - A critical vulnerability has been identified in the React Server Components (RSC) "Flight" protocol, affecting the React 19 ecosystem and frameworks that implement it, most notably Next.js
December 3, 2025 - They said Next.js: 15.0.5+ is patched, ... Vite users are not safe. The vulnerability exists in the React Flight implementation (the wire protocol for RSCs) that is shared across all RSC implementations....
Wiz
wiz.io › blog › critical-vulnerability-in-react-cve-2025-55182
React2Shell (CVE-2025-55182): Critical React Vulnerability | Wiz Blog
December 3, 2025 - A critical vulnerability has been ... it, most notably Next.js. Assigned CVE-2025-55182, this flaw allows for unauthenticated remote code execution (RCE) on the server due to insecure deserialization....
Microsoft
microsoft.com › home › defending against the cve-2025-55182 (react2shell) vulnerability in react server components
Defending against the CVE-2025-55182 (React2Shell) vulnerability in React Server Components | Microsoft Security Blog
December 15, 2025 - When a client requests data, the ... component tree. The vulnerability exists because affected React Server Components versions fail to validate incoming payloads....
Vercel
vercel.com › changelog › cve-2025-55182
Summary of CVE-2025-55182 - Vercel
react-server-dom-turbopack (19.0.0, 19.1.0, 19.1.1, and 19.2.0) These packages are included in the following frameworks and bundlers: Next.js with versions ≥14.3.0-canary.77, ≥15 and ≥16 · Other frameworks and plugins that embed or depend on React Server Components implementation (e.g., Vite, Parcel, React Router, RedwoodSDK, Waku) After creating mitigations to address this vulnerability, we deployed them across our globally-distributed platform to quickly protect our customers.
Google Cloud
cloud.google.com › blog › products › identity-security › responding-to-cve-2025-55182
Responding to CVE-2025-55182 | Google Cloud Blog
December 4, 2025 - Vulnerable versions: React 19.0, 19.1.0, 19.1.1, and 19.2.0 · Patched in React 19.2.1 · Fix: https://github.com/facebook/react/commit/7dc903cd29dac55efb4424853fd0442fef3a8700 · Announcement: https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components ·
React
react.dev › blog › 2025 › 12 › 11 › denial-of-service-and-source-code-exposure-in-react-server-components
Denial of Service and Source Code Exposure in React Server Components – React
This left previous versions vulnerable. Versions 19.0.4, 19.1.5, 19.2.4 are safe.
Reddit
reddit.com › r/reactjs › react 19 rce vulnerability - can we stop pretending modern frameworks are automatically more secure?
r/reactjs on Reddit: React 19 RCE vulnerability - can we stop pretending modern frameworks are automatically more secure?
January 27, 2026 -
The React 19 RCE bug from December (CVE-2025-66478) is a good reminder that no framework is magically secure.
I keep seeing people say WordPress is insecure and moving to Next/React solves security problems. But like... React Server Components just had a critical remote code execution vulnerability. WordPress core is actually pretty solid, most security issues are from old plugins or bad hosting.
Security comes from keeping stuff updated, decent infrastructure, not installing random plugins/packages, and actually knowing what you're deploying. That's it.
The "WordPress bad, modern frameworks secure" thing is getting old when they all have vulnerabilities.
Curious if anyone else has clients who think switching stacks = better security? That conversation is always fun.
Top answer 1 of 5
14
Sir, this is a Wendy’s.
2 of 5
4
Frustratingly, if I understand the vulnerability, it should have been solved by something approaching a common ESLint rule about using `hasOwnProperty()` or `Object.hasOwn()` when building their custom stream token handler? Or using `Object.create(null)` for the storage object. Basically, critical functionality didn't cover common prototype vulnerabilities, likely because people just don't know them anymore.
Replit
blog.replit.com › replit blog › critical security vulnerability in react server components
Replit — Critical Security Vulnerability in React Server Components
December 5, 2025 - Unlike traditional malware that targets individual systems, this attack specifically compromises JavaScript packages that developers install in the projects. When the package is being installed, it executes the malicious npm postinstall lifecycle ...