Kevin Beaumont
There is an unauthenticated remote code execution vulnerability in React Server Components.
Even if your app does not implement any React Server Function endpoints it may still be vulnerable if your app supports React Server Components.
If your app’s React code does not use a server, your app is not affected by this vulnerability.
CVE-2025-55182
Mastodon server not impacted btw.
https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components
Christoffer S.
@GossiTheDog Worth mentioning that Node.js appears affected 15.x and 16.x.
Kevin Beaumont
Vulnerability hype train derail time - these vulns only apply to React 19 (released within the past year) and only when using a specific new feature, React Server.
Andrew Golding
@GossiTheDog I had to doublecheck our FE at work just to be sure we're not using the affected components. Luckily, while React Router (formerly remix) is affected by this, it is only affected if experimental support for React Server Components is enabled.
Meanwhile, this does nothing to lessen the general levels of ire I have for the entire JavaScript and friends ecosystem.
Cedric
@GossiTheDog With this many sightings (mostly from Bluesky), there is surely at least a bit of hype: https://vulnerability.circl.lu/vuln/CVE-2025-55182#sightings
Kevin Beaumont
The React vulns have the usual panicked nonsense going on - people posting fake PoCs (all of them are fake), people spraying fake PoCs over the whole internet, people posting screenshots of fake PoC activity thinking it real, doomsday scenario posts etc etc.
It’s actually a niche scenario bug for vast majority of orgs, just stay calm and patch if you are actually impacted (spoiler: you probably aren’t).
SirBeringer
@GossiTheDog hmmm, normally Maurice doesn’t post BS
Kevin Beaumont
We have our first victim of overreacting to the React vuln - the Cloudflare global outage was them taking down their own service to fix an actually very niche vuln.
evariste.gal🌈is
@GossiTheDog Well, they sell WAF-as-a-Product, so introducing observability to identify CVE-2025-55182 payloads seems a legitimate choice, I don't think it is overreacting in this case
Kevin Beaumont
New by me - cybersecurity industry overreacts to React vulnerabilities, sets itself on fire https://doublepulsar.com/cybersecurity-industry-overreacts-to-react-vulnerability-starts-panic-burns-own-house-down-again-e85c10ad1607
iced depresso
mschade_
@GossiTheDog did Qualys really use the Fake POC to show that they reconstructed the vulnerability? https://threatprotect.qualys.com/2025/12/04/react-server-components-rsc-remote-code-execution-vulnerabilities/
MemoryLeech
Potential exploitation being seen itw, no surprise the miners may be first past the post.
fuzzyfuzzyfungus
@GossiTheDog There isn't; but there probably should be a level of engineering professionalism and change control where "an actor working within the scope of his authorization broke the system" is more damning than "an attacker broke the system" rather than less.
Kevin Beaumont
Really interesting thing happening with the React vuln where lots of the cyber companies reporting exploitation don't appear to realise they're reporting on exploit attempts for GitHub PoCs which aren't actually real - said PoCs just set up a vuln webapp in a way nobody would in real world.
It's not all the attempts but it's a large portion.
Me:
Kevin Beaumont
Similarly attacks are spraying the internet with PoCs where I don't think they realise they don't actually work, largely. Cybersecurity is great, I love it.
Scott Leggett :fedi: :golang:
@GossiTheDog The bit I think you might be missing is that Next.js has been vulnerable in every 15.x and 16.x release since January 2025 until last week.
11 months is not "new" in the JS world. In fact, I'd imagine in the age of dependabot et. al. more Next.js sites would have been vulnerable to this when the vuln dropped than not.
Yes, React Server Components might be niche. But Next.js absolutely is not.
Kevin Beaumont
I keep seeing all the vendor write ups about botnets using that React vuln.. but I’m not sure the vendors understand that botnets integrating something does not equal success.
The whole thing has been pretty eye opening.
GNU social JP is a social network, courtesy of GNU social JP管理人. It runs on GNU social, version 2.0.2-dev, available under the GNU Affero General Public License.
All GNU social JP content and data are available under the Creative Commons Attribution 3.0 license.