Critical Security Vulnerability in React Server Components

Discuss @tom.sherman.is's post on Frontpage.

Critical Security Vulnerability in React Server Components – React

The library for web and native user interfaces

GitHub - fatguru/CVE-2025-55182-scanner: A non-intrusive surface scanner for CVE-2025-55182 (React Server Components RCE). Detects exposed RSC endpoints in React 19 and Next.js applications

A non-intrusive surface scanner for CVE-2025-55182 (React Server Components RCE). Detects exposed RSC endpoints in React 19 and Next.js applications - fatguru/CVE-2025-55182-scanner

Railway on Twitter / X

A critical RCE vulnerability was discovered in React Server Components. Railway has collaborated with Meta/Vercel teams & deployed a platform-level patch that blocks malicious requests matching this exploit pattern at our Web Application Firewall.Your service is protected while… https://t.co/8a5WWYshzN— Railway (@Railway) December 3, 2025

Cloudflare WAF proactively protects against React vulnerability

Cloudflare offers protection against a new high profile vulnerability for React Server Components: CVE-2025-55182. All WAF customers are automatically protected as long as the WAF is deployed.

High Fidelity Detection Mechanism for RSC/Next.js RCE (CVE-2025-55182 & CVE-2025-66478) › Searchlight Cyber

This morning, an advisory was released for Next.js about a vulnerability that leads to RCE in default configurations, with no prerequisites. The root cause of this issue lies in React Server Components, which Next.js utilizes. Over the last day, we have noticed an incredible amount of incorrect PoCs floating around on GitHub that do not

Netlify's response to the critical React security vulnerability

Netlify has patched a critical remote code execution vulnerability in React Server Functions. All Netlify customers are protected.

Summary of CVE-2025-55182 - Vercel

Vercel has provided a patch for CVE-2025-55182 affecting any frameworks allowing Server Components usage.

State of React 2025

The 2025 edition of the annual survey about the latest trends in the React ecosystem.

How an Omitted Write Barrier in V8 Turns Into RCE in Chrome: CVE-2026-5865

In March, our system detected a severe vulnerability in V8, the JavaScript engine used by Chrome. This vulnerability enabled remote code execution against billions of Chrome users worldwide.

2021 JavaScript Rising Stars

A complete overview of the JavaScript landscape in 2021: trends about front-end and Node.js frameworks, React and Vue.js ecosystems, build tools, state management...

GitHub RCE Vulnerability: CVE-2026-3854 Breakdown | Wiz Blog

A CVSS 8.7 vulnerability in GitHub Enterprise Server allows remote code execution. Read the threat brief and find vulnerable GHES instances from Wiz.

React v19 – React

The library for web and native user interfaces

Mitigating High Severity RunC Vulnerability (CVE-2019-5736)

A high severity (CVSS score 7.2) vulnerability (CVE-2019-5763) was found in runc, allowing attackers to compromise the container host. Patches are already available from most providers. Aqua customers can prevent this vulnerability from being exploited by applying the appropriate runtime policies.

Real-World React: Designing Frontend Architectures That Survive Production | Workshops | Faris Aziz

Most React workshops focus on building features. This one focuses on keeping them alive. In production, React applications fail in ways that local environments never show: partial outages, slow dependencies, silent errors, broken rollouts, and performance regressions that only appear under real traffic. This workshop is a practical, architecture-first walkthrough of how experienced teams design React systems that stay resilient, observable, and scalable long after the first release. We will explore how component architecture, reconciliation in practice, and runtime failure patterns shape performance and operability far more than memoization tricks or framework features. Using React and Next.js as shared reference points, we will work through concrete patterns for failure recovery, error containment, safe rollouts, and post-deployment confidence. This is a hands-on, experience-driven workshop based on real production constraints, tradeoffs, and lessons learned from operating large React applications at scale. Attendees will leave with a mental model for building frontend systems that can fail safely, recover quickly, and ship continuously without fear. Most of the workshop is framework and library-agnostic, but we'll use React and Next.js as our common ground for communication and examples. This is not an exhaustive masterclass; it's a conversation starter and experience share to jumpstart your journey toward battle-tested software architecture.