Critical Security Vulnerability in React Server Components – React

The library for web and native user interfaces

Critical Security Vulnerability in React Server Components

Discuss @tom.sherman.is's post on Frontpage.

Netlify's response to the critical React security vulnerability

Netlify has patched a critical remote code execution vulnerability in React Server Functions. All Netlify customers are protected.

Railway on Twitter / X

A critical RCE vulnerability was discovered in React Server Components. Railway has collaborated with Meta/Vercel teams & deployed a platform-level patch that blocks malicious requests matching this exploit pattern at our Web Application Firewall.Your service is protected while… https://t.co/8a5WWYshzN— Railway (@Railway) December 3, 2025

High Fidelity Detection Mechanism for RSC/Next.js RCE (CVE-2025-55182 & CVE-2025-66478) › Searchlight Cyber

This morning, an advisory was released for Next.js about a vulnerability that leads to RCE in default configurations, with no prerequisites. The root cause of this issue lies in React Server Components, which Next.js utilizes. Over the last day, we have noticed an incredible amount of incorrect PoCs floating around on GitHub that do not

GitHub - fatguru/CVE-2025-55182-scanner: A non-intrusive surface scanner for CVE-2025-55182 (React Server Components RCE). Detects exposed RSC endpoints in React 19 and Next.js applications

A non-intrusive surface scanner for CVE-2025-55182 (React Server Components RCE). Detects exposed RSC endpoints in React 19 and Next.js applications - fatguru/CVE-2025-55182-scanner

Cloudflare WAF proactively protects against React vulnerability

Cloudflare offers protection against a new high profile vulnerability for React Server Components: CVE-2025-55182. All WAF customers are automatically protected as long as the WAF is deployed.

Next.js by Vercel - The React Framework

Production grade React applications that scale. The world's leading companies use Next.js by Vercel to build static and dynamic websites and web applications.

State of React 2025

The 2025 edition of the annual survey about the latest trends in the React ecosystem.

next.js/packages/next/README.md at canary · vercel/next.js

The React Framework. Contribute to vercel/next.js development by creating an account on GitHub.

Deno Deploy

One simple platform for anything that runs with JavaScript or Typescript.

Next.js — The Perpetual Beta Framework

Exploring 6 years of Next.js, from early days to App Router & RSC, with migrations, performance tweaks, and framework insights

The secure way to release an npm package in 2026—Martian Chronicles, Evil Martians’ team blog

How to protect your npm package from being stolen in a supply chain attack and improve its position in security ratings

Post Mortem: axios npm supply chain compromise · Issue #10636 · axios/axios

Post Mortem: axios npm supply chain compromise Date: March 31, 2026 Author: Jason Saayman Status: Remediation in progress On March 31, 2026, two malicious versions of axios (1.14.1 and 0.30.4) were...