Articles

Vulnerability Article

<hr /> If you haven’t already heard the React shot heard ‘round the world, <a target="_blank" rel="noopener noreferrer" href="https://www.linkedin.com/company/carapace-nz/posts/?feedView=all">Carapace Security’s</a> Innovation Lead <a target="_blank" rel="noopener noreferrer" href="https://www.linkedin.com/in/lachlan-s-davidson/">Lachlan Davidson</a> discovered a critical vulnerability in components of the popular and widely used <a target="_blank" rel="noopener noreferrer" href="https://react.dev/">React library.</a> It allows unauthenticated remote code execution by exploiting a flaw in how React decodes payloads sent to React Server Function endpoints.How back is it? Using the <a target="_blank" rel="noopener noreferrer" href="https://en.wikipedia.org/wiki/Common_Vulnerability_Scoring_System">Common Vulnerability Scoring System</a> (CVSS), it was disclosed as <a target="_blank" rel="noopener noreferrer" href="https://www.cve.org/CVERecord?id=CVE-2025-55182">CVE-2025-55182</a> and is rated CVSS 10.0. That’s as severe as it gets. Where is it, exactly? According to sources, the vulnerability is present in versions 19.0, 19.1.0, 19.1.1, and 19.2.0 of <a target="_blank" rel="noopener noreferrer" href="https://www.npmjs.com/package/react-server-dom-webpack">react-server-dom-webpack</a>, <a target="_blank" rel="noopener noreferrer" href="https://www.npmjs.com/package/react-server-dom-parcel">react-server-dom-parcel</a>, and <a target="_blank" rel="noopener noreferrer" href="https://www.npmjs.com/package/react-server-dom-turbopack?activeTab=readme">react-server-dom-turbopack</a>.While it was first detected on November 29th, it wasn’t publicly disclosed until December 3rd. That’s when the <a target="_blank" rel="noopener noreferrer" href="https://aws.amazon.com/blogs/security/china-nexus-cyber-threat-groups-rapidly-exploit-react2shell-vulnerability-cve-2025-55182/">AWS threat intelligence teams</a> observed active exploitation attempts by multiple China state-nexus threat groups, including Earth Lamia and Jackpot Panda. For detailed upgrade and mitigation instructions, read the <a target="_blank" rel="noopener noreferrer" href="https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components">React blog</a> and check back regularly for additional updates.<h3 id="don’t-panic,-but-act-quickly">Don’t panic, but act quickly</h3>A fix was introduced in versions <a target="_blank" rel="noopener noreferrer" href="https://github.com/facebook/react/releases/tag/v19.0.1">19.0.1</a>, <a target="_blank" rel="noopener noreferrer" href="https://github.com/facebook/react/releases/tag/v19.1.2">19.1.2</a>, and <a target="_blank" rel="noopener noreferrer" href="https://github.com/facebook/react/releases/tag/v19.2.1">19.2.1</a>. Even if your app doesn’t implement any React Server Function endpoints, it might still be vulnerable if it supports React Server Components. The bottom line is that you should upgrade immediately.A key point: if your app’s React code does not use a server – or a framework, bundler, or bundler plugin that supports React Server Components – it’s not impacted by this vulnerability. That said, certain React frameworks and bundlers might have dependencies or include vulnerable React packages, such as:<ul><li><a target="_blank" rel="noopener noreferrer" href="https://nextjs.org/blog/CVE-2025-66478">Next.js (versions 14.x canary, 15.x, 16.x)</a></li><li><a target="_blank" rel="noopener noreferrer" href="https://reactrouter.com/how-to/react-server-components">React Router (RSC preview versions)</a></li><li><a target="_blank" rel="noopener noreferrer" href="https://waku.gg/">Waku (minimal React framework)</a></li><li><a target="_blank" rel="noopener noreferrer" href="https://www.npmjs.com/package/@vitejs/plugin-rsc">@vitejs/plugin-rsc </a></li><li><a target="_blank" rel="noopener noreferrer" href="https://parceljs.org/recipes/rsc/">@parcel/rsc </a></li><li><a target="_blank" rel="noopener noreferrer" href="https://www.npmjs.com/package/rwsdk">RedwoodJS (rwsdk) </a></li></ul>According to the React blog, there are temporary hosting provider mitigations in place, but you shouldn’t rely on these to performantly secure your app. So roll with that update. <a target="_blank" rel="noopener noreferrer" href="https://cmscritic.com/products/vercel">Vercel</a>, the company behind the incredibly popular <a target="_blank" rel="noopener noreferrer" href="https://cmscritic.com/products/nextjs">Next.js,</a> is also taking proactive steps. Any new deployment containing a vulnerable version of the framework will automatically fail to deploy on its platform. <h3 id="what-the-heck-happened?">What the heck happened?</h3>As Lachlan said in his <a target="_blank" rel="noopener noreferrer" href="https://www.linkedin.com/posts/lachlan-s-davidson_critical-security-vulnerability-in-react-activity-7402099900987142144-65Kz/">recent LinkedIn post,</a> there's more nitty-gritty to unpack with all of this, and we’re sure to get more details regarding the vulnerability after the rollout is considered complete and the dust settles.Currently, here’s the gist of it: As we know, <a target="_blank" rel="noopener noreferrer" href="https://react.dev/reference/rsc/server-functions">React Server Functions</a> allow a client to call a function on a server, providing integration points and tools that frameworks and bundlers use to help React code run on both the client and the server. React then translates requests into HTTP requests, which are forwarded to a server, moved into a function call, and returned to the client.According to <a target="_blank" rel="noopener noreferrer" href="https://thehackernews.com/2025/12/critical-react2shell-flaw-added-to-cisa.html">The Hacker News,</a> the real problem stems from <a target="_blank" rel="noopener noreferrer" href="https://www.rapid7.com/blog/post/etr-react2shell-cve-2025-55182-critical-unauthenticated-rce-affecting-react-server-components/">insecure deserialization</a> in the library's RSC Flight protocol, which React uses to enable that server/client communication. With this vulnerability, an unauthenticated remote attacker could fashion a malicious HTTP request or arbitrary commands to any Server Function endpoint. When deserialized by React, it could enable remote code execution on the server. And that’s where the trouble starts. <h3 id="why-it-matters">Why it matters</h3>React has been a game-changer in the digital landscape, specifically through the rise of headless CMSes and Jamstack architectures. There are a lot of fuzzy numbers out there, but most reputable estimates suggest that React is used by millions of websites globally. <a target="_blank" rel="noopener noreferrer" href="https://w3techs.com/technologies/details/js-react">W3Techs reports that React is used by 7.7%</a> of all websites whose JavaScript library is known, which translates to 6.2% of all websites.That’s not the lion’s share, but when you consider the notable enterprises utilizing it within their workloads, the scope feels even bigger. Major brands like Facebook, Netflix, Airbnb, Instagram, WhatsApp, and Shopify utilize React or React Native in various parts of their platforms, demonstrating its widespread adoption in both web and mobile development.Security is job zero for everyone, and no system or framework will ever be beyond a vulnerability at some point in its lifecycle. And the more dependent we are on open source libraries and composable, interoperable architectures, the more likely it is that we’ll see a growing surface area of failure points.From a “fix” perspective, transparency is key. We need to shorten the response time and the gap to action, so stakeholders can “react” as quickly as possible and minimize the impact. Obviously, having performant packages in place to upgrade was a key part of the solution, but I think it was smart to enable the hosting resources as a temporary measure of defense. As we learn more, we'll dig into it. For now, the best advice? Stay vigilant. And stay updated, my friends… <hr /><h3 id="upcoming-events">Upcoming Events</h3> <img style="width:31.44%" src="https://cmscritic.com/ms-content/uploads/2025/08/cms-kickoff-2026-logo.png" alt="" /><h4 id="cms-kickoff-2026"><a target="_blank" rel="noopener noreferrer" href="https://www.boye-co.com/conferences/cmskickoff26">CMS Kickoff 2026</a></h4>January 13-14, 2026 – St. Petersburg, FLMeet industry leaders at our fourth annual CMS Kickoff – the industry's premier global CMS event. Similar to a traditional kickoff, we reflect on recent trends and share stories from the frontlines. Additionally, we will delve into the current happenings and shed light on the future. Prepare for an unparalleled in-person CMS conference experience that will equip you to move things forward. This is an exclusive event – space is limited, <a target="_blank" rel="noopener noreferrer" href="https://www.boye-co.com/conferences/cmskickoff26">so secure your tickets today.</a>

React Now: Why a Major Security Vulnerability in React Server Components is a Severe Threat

matt-garrepy

Explore a wide range of informative articles on Vulnerability, insights, and industry updates. Stay informed and ahead of the curve with our diverse collection of news and posts covering the latest trends and developments in the industry