RCE Vulnerability in React and Next.js • Hacker News Board

Re: RCE Vulnerability in React and Next.js

#11

Post by rs_rs_rs_rs_rs » Wed, Dec 03, 2025, 5:19 PM UTC

AgentK20 wrote: post #2

CVE 10.0 is bonkers for a project this widely used

React is widely used, react server components not so much.

Re: RCE Vulnerability in React and Next.js

#12

Post by dizlexic » Wed, Dec 03, 2025, 5:24 PM UTC

[flagged]

Re: RCE Vulnerability in React and Next.js

#13

Post by dizlexic » Wed, Dec 03, 2025, 5:24 PM UTC

bitbasher wrote: post #3

It's almost like trying to magically wire up your frontend to the backend through magical functions is a bad idea.

ikr, no way this could have been predicted and warned about for months and months before now.

Re: RCE Vulnerability in React and Next.js

#14

Post by dizlexic » Wed, Dec 03, 2025, 5:25 PM UTC

bitbasher wrote: post #9

baiwl wrote: post #8

Earlier quoted context omitted.

[flagged]

I don't think money is a good proxy for idea quality. AI? Blockchain? Crime in general? Plenty of bad ideas make a whole lot of money.

Enron made boat loads.

Re: RCE Vulnerability in React and Next.js

#15

Post by anonymars » Wed, Dec 03, 2025, 5:25 PM UTC

nickthegreek wrote: post #7

dupe: https://news.ycombinator.com/item?id=46136067

[flagged]

Re: RCE Vulnerability in React and Next.js

#16

Post by _jab » Wed, Dec 03, 2025, 5:31 PM UTC

rs_rs_rs_rs_rs wrote: post #11

AgentK20 wrote: post #2

CVE 10.0 is bonkers for a project this widely used

React is widely used, react server components not so much.

Next.js is still pretty damn widely used.

Re: RCE Vulnerability in React and Next.js

#17

Post by hackhomelab » Wed, Dec 03, 2025, 5:31 PM UTC

benmmurphy wrote: post #10

I suspect the commit to fix is: https://github.com/facebook/react/commit/bbed0b0ee64b89353a4... and it looks like its been squashed with some other stuff to hide it or maybe there are other problems as well. this pattern appears 4 times and looks like it is reducing the functions that are exposed to the 'whitelist'. i presume the modules have dangerous functions in the prototype chain and clients were able to invoke…

It could also be https://github.com/facebook/react/commit/7dc903cd29dac55efb4... ("This also fixes a critical security vulnerability.")

Re: RCE Vulnerability in React and Next.js

#18

Post by beders » Wed, Dec 03, 2025, 5:38 PM UTC

bitbasher wrote: post #3

It's almost like trying to magically wire up your frontend to the backend through magical functions is a bad idea.

One could get the impression that the only really really important non-functional requirement for such a thing is to absolutely ensure that you can only call the "good" functions with the "good" payload.

Re: RCE Vulnerability in React and Next.js

#19

Post by filearts » Wed, Dec 03, 2025, 5:42 PM UTC

embedding-shape wrote: post #6

From Facebook/Meta: https://www.facebook.com/security/advisories/cve-2025-55182 > A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Functi…

Given that the fix appears to be to look for own properties, the attack was likely to reference prototype level module properties or the gift-that-keeps-giving the that is __proto__.

Re: RCE Vulnerability in React and Next.js

#20

Post by bossyTeacher » Wed, Dec 03, 2025, 5:43 PM UTC

bitbasher wrote: post #3

It's almost like trying to magically wire up your frontend to the backend through magical functions is a bad idea.

CV driven development needs new ideas for resume padding regardless of whether the idea is good or bad. Then you get this