Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

RCE Vulnerability in React and Next.js

github.com

Post reply on HN
Print view View original

21–30 of 276 posts

Re: RCE Vulnerability in React and Next.js

#21

Post by nine_k »

hackhomelab wrote: post #17
benmmurphy wrote: post #10

I suspect the commit to fix is: https://github.com/facebook/react/commit/bbed0b0ee64b89353a4... and it looks like its been squashed with some other stuff to hide it or maybe there are other problems as well. this pattern appears 4 times and looks like it is reducing the functions that are exposed to the 'whitelist'. i presume the modules have dangerous functions in the prototype chain and clients were able to invoke…

It could also be https://github.com/facebook/react/commit/7dc903cd29dac55efb4... ("This also fixes a critical security vulnerability.")

It does the same thing here, too: https://github.com/facebook/react/commit/7dc903cd29dac55efb4...

Re: RCE Vulnerability in React and Next.js

#22

Post by nine_k »

AgentK20 wrote: post #2

CVE 10.0 is bonkers for a project this widely used

The packages affected, like [1], literally say:

> Experimental React Flight bindings for DOM using Webpack.

> Use it at your own risk.

311,955 weekly downloads though :-|

[1]: https://www.npmjs.com/package/react-server-dom-webpack

Re: RCE Vulnerability in React and Next.js

#24

Post by dzonga »

till this day, I don't know the substantial benefits of React Server Components over say classically rendered html pages + using htmx ?

mind you react in 2017 paid my rent. now cz of the complexity I refuse to work with react.

Re: RCE Vulnerability in React and Next.js

#25

Post by karimf »

> Projects hosted on Vercel benefit from platform-level protections that already block malicious request patterns associated with this issue.

https://vercel.com/changelog/cve-2025-55182

> Cloudflare WAF proactively protects against React vulnerability

https://blog.cloudflare.com/waf-rules-react-vulnerability/

Re: RCE Vulnerability in React and Next.js

#27

Post by Rauchg »

karimf wrote: post #25

> Projects hosted on Vercel benefit from platform-level protections that already block malicious request patterns associated with this issue. https://vercel.com/changelog/cve-2025-55182 > Cloudflare WAF proactively protects against React vulnerability https://blog.cloudflare.com/waf-rules-react-vulnerability/

We collaborated with many industry partners to proactively deploy mitigations due to the severity of the issue.

We still strongly recommend everyone to upgrade their Next, React, and other React meta-frameworks (peer)dependencies immediately.

Re: RCE Vulnerability in React and Next.js

#28

Post by ascorbic »

nine_k wrote: post #22
AgentK20 wrote: post #2

CVE 10.0 is bonkers for a project this widely used

The packages affected, like [1], literally say: > Experimental React Flight bindings for DOM using Webpack. > Use it at your own risk. 311,955 weekly downloads though :-| [1]: https://www.npmjs.com/package/react-server-dom-webpack

That number is misleadingly low, because it doesn't include Next.js which bundles the dependency. Almost all usage in the wild will be Next.js, plus a few using the experimental React Router support.

Re: RCE Vulnerability in React and Next.js

#29

Post by ptx »

cluckindan wrote: post #23
dizlexic wrote: post #12

[flagged]

This is not related to ”use server”. That’s used to mark Server Actions / Server Functions, and it is not necessarily used in files with Server Components.

It sounds related to me. The react.dev blog post [1] says that the vulnerability is

> a flaw in how React decodes payloads sent to React Server Function endpoints

and the react.dev docs for React Server Functions [2] say that

> Server Components can define Server Functions with the "use server" directive [...] Client Components can import Server Functions from files that use the "use server" directive

So it certainly sounds like the vulnerability is related to React Server Functions which are related to "use server".

[1] https://react.dev/blog/2025/12/03/critical-security-vulnerab...

[2] https://react.dev/reference/rsc/server-functions

Post reply on HN