Critical Security Vulnerability in React Server Components

Critical Security Vulnerability in React Server Components – React

The library for web and native user interfaces

Railway on Twitter / X

A critical RCE vulnerability was discovered in React Server Components. Railway has collaborated with Meta/Vercel teams & deployed a platform-level patch that blocks malicious requests matching this exploit pattern at our Web Application Firewall.Your service is protected while… https://t.co/8a5WWYshzN— Railway (@Railway) December 3, 2025

Netlify's response to the critical React security vulnerability

Netlify has patched a critical remote code execution vulnerability in React Server Functions. All Netlify customers are protected.

High Fidelity Detection Mechanism for RSC/Next.js RCE (CVE-2025-55182 & CVE-2025-66478) › Searchlight Cyber

This morning, an advisory was released for Next.js about a vulnerability that leads to RCE in default configurations, with no prerequisites. The root cause of this issue lies in React Server Components, which Next.js utilizes. Over the last day, we have noticed an incredible amount of incorrect PoCs floating around on GitHub that do not

GitHub - fatguru/CVE-2025-55182-scanner: A non-intrusive surface scanner for CVE-2025-55182 (React Server Components RCE). Detects exposed RSC endpoints in React 19 and Next.js applications

A non-intrusive surface scanner for CVE-2025-55182 (React Server Components RCE). Detects exposed RSC endpoints in React 19 and Next.js applications - fatguru/CVE-2025-55182-scanner

Cloudflare WAF proactively protects against React vulnerability

Cloudflare offers protection against a new high profile vulnerability for React Server Components: CVE-2025-55182. All WAF customers are automatically protected as long as the WAF is deployed.

Common Sense Refactoring of a Messy React Component | Alex Kondov

One thing I've learned from all the consulting I've done is that rewrites rarely lead to anything good. Almost in all cases, when you have an application runnin

Real-World React: Designing Frontend Architectures That Survive Production | Workshops | Faris Aziz

Most React workshops focus on building features. This one focuses on keeping them alive. In production, React applications fail in ways that local environments never show: partial outages, slow dependencies, silent errors, broken rollouts, and performance regressions that only appear under real traffic. This workshop is a practical, architecture-first walkthrough of how experienced teams design React systems that stay resilient, observable, and scalable long after the first release. We will explore how component architecture, reconciliation in practice, and runtime failure patterns shape performance and operability far more than memoization tricks or framework features. Using React and Next.js as shared reference points, we will work through concrete patterns for failure recovery, error containment, safe rollouts, and post-deployment confidence. This is a hands-on, experience-driven workshop based on real production constraints, tradeoffs, and lessons learned from operating large React applications at scale. Attendees will leave with a mental model for building frontend systems that can fail safely, recover quickly, and ship continuously without fear. Most of the workshop is framework and library-agnostic, but we'll use React and Next.js as our common ground for communication and examples. This is not an exhaustive masterclass; it's a conversation starter and experience share to jumpstart your journey toward battle-tested software architecture.

The Axios supply chain attack used individually targeted social engineering

The Axios team have published a full postmortem on the supply chain attack which resulted in a malware dependency going out in a release the other day, and it involved …

The Axios supply chain attack used individually targeted social engineering

The Axios team have published a full postmortem on the supply chain attack which resulted in a malware dependency going out in a release the other day, and it involved …

Post Mortem: axios npm supply chain compromise · Issue #10636 · axios/axios

Post Mortem: axios npm supply chain compromise Date: March 31, 2026 Author: Jason Saayman Status: Remediation in progress On March 31, 2026, two malicious versions of axios (1.14.1 and 0.30.4) were...

Patch FlightReplyServer with fixes from ReactFlightClient by sebmarkbage · Pull Request #35277 · facebook/react

FlightReplyServer are for client->server and ReactFlightClient is for server->client. They're not 100% symmetrical. We did a number of refactors to ReactFlightClient in PRs li...