Related Next.js blog: https://nextjs.org/blog/CVE-2025-66478
Critical RCE Vulnerabilities in React and Next.js
21–30 of 92 posts
Re: Critical RCE Vulnerabilities in React and Next.js
#22https://www.cve.org/CVERecord?id=CVE-2025-66478 isn't even public yet, did they release this early?
[deleted]
Re: Critical RCE Vulnerabilities in React and Next.js
#23Dang, Cloudflare is moving fast. Cloudflare WAF proactively protects against React vulnerability https://blog.cloudflare.com/waf-rules-react-vulnerability/
This is what coordinated disclosure looks like.
Re: Critical RCE Vulnerabilities in React and Next.js
#24Where is the exploit ? So we can test if we fixed it properly ?
Bad actors anyway will find it, so at least we should see.
Re: Critical RCE Vulnerabilities in React and Next.js
#25These wiz.io blog posts should be banned from HN; AFAICT, they're AI generated. Here's the original post with the details: https://react.dev/blog/2025/12/03/critical-security-vulnerab... - the vulnerability was not found by a Wiz employee at all, and the Wiz article (unlike the react.dev article) does not provide any meaningful technical information. The important part to know: - Even if your app does not implement a…
> AFAICT, they're AI generated. What is the "tell"? I'm not saying they are or aren't, but... people say this about literally everything now and it's typically some flimsy reasoning like "they used a bullet point". I don't see anything in particular that makes me think ai over a standard template some junior fills out. > the vulnerability was not found by a Wiz employee at all I've re-read the Wiz article a few times…
the tl;dr definitely came out of an llm
presentation and formatting aside the constant attempts to manufacture legitimacy and signal urgency are a classic tell. everything is "near-100%" reliable, urgent, critical, reproducible, catastrophic. siren emoji
Re: Critical RCE Vulnerabilities in React and Next.js
#26Earlier quoted context omitted.
> AFAICT, they're AI generated. What is the "tell"? I'm not saying they are or aren't, but... people say this about literally everything now and it's typically some flimsy reasoning like "they used a bullet point". I don't see anything in particular that makes me think ai over a standard template some junior fills out. > the vulnerability was not found by a Wiz employee at all I've re-read the Wiz article a few times…
the tl;dr definitely came out of an llm presentation and formatting aside the constant attempts to manufacture legitimacy and signal urgency are a classic tell. everything is "near-100%" reliable, urgent, critical, reproducible, catastrophic. siren emoji
[deleted]
Re: Critical RCE Vulnerabilities in React and Next.js
#27I don't have time to look into it right now (def later)! However, I was curious to see if github copilot can reverse engineer it based on the latest commits and seems that what it is saying aligns with both advisories. It pointed out that it has to do with circular reference handling which sounds to me something that can be easily overlooked. While this analysis might be completely off, the simple fact that I could g…
It's easier for a bad actor to get an exploit, than for an operator to test his own site if the upgrade succeded
Re: Critical RCE Vulnerabilities in React and Next.js
#28These wiz.io blog posts should be banned from HN; AFAICT, they're AI generated. Here's the original post with the details: https://react.dev/blog/2025/12/03/critical-security-vulnerab... - the vulnerability was not found by a Wiz employee at all, and the Wiz article (unlike the react.dev article) does not provide any meaningful technical information. The important part to know: - Even if your app does not implement a…
> AFAICT, they're AI generated. What is the "tell"? I'm not saying they are or aren't, but... people say this about literally everything now and it's typically some flimsy reasoning like "they used a bullet point". I don't see anything in particular that makes me think ai over a standard template some junior fills out. > the vulnerability was not found by a Wiz employee at all I've re-read the Wiz article a few times…
Hackernews' submission guidelines clearly state: "Please submit the original source. If a post reports on something found on another site, submit the latter." [0]
The Wiz post has significantly changed since it was first published (and how it looked when first posted to HN), FYI -- see [1]. When it was published, it was a summary of the React announcement, and was somehow longer than the original and yet provided less useful information than the original.
In any case, the "tell" is the syntactic structure (as Chomsky would say) and certain phrases used in the post.
[0]: https://news.ycombinator.com/newsguidelines.html
[1]: https://web.archive.org/web/20251203162416/https://www.wiz.i...
Re: Critical RCE Vulnerabilities in React and Next.js
#29These wiz.io blog posts should be banned from HN; AFAICT, they're AI generated. Here's the original post with the details: https://react.dev/blog/2025/12/03/critical-security-vulnerab... - the vulnerability was not found by a Wiz employee at all, and the Wiz article (unlike the react.dev article) does not provide any meaningful technical information. The important part to know: - Even if your app does not implement a…
There is some value: > The vulnerability exists in the default configuration of affected applications Can be inferred from the react blog but isn't really explicit > According to Wiz data, 39% of cloud environments have instances vulnerable to CVE-2025-55182 and/or CVE-2025-66478. Numbers!
>> According to Wiz data, 39% of cloud environments have instances vulnerable to CVE-2025-55182 and/or CVE-2025-66478.
> Numbers!
I do not see how such numbers are valuable to people reading this post, as the first indication of the existence of this vulnerability.
Re: Critical RCE Vulnerabilities in React and Next.js
#30Earlier quoted context omitted.
> AFAICT, they're AI generated. What is the "tell"? I'm not saying they are or aren't, but... people say this about literally everything now and it's typically some flimsy reasoning like "they used a bullet point". I don't see anything in particular that makes me think ai over a standard template some junior fills out. > the vulnerability was not found by a Wiz employee at all I've re-read the Wiz article a few times…
the tl;dr definitely came out of an llm presentation and formatting aside the constant attempts to manufacture legitimacy and signal urgency are a classic tell. everything is "near-100%" reliable, urgent, critical, reproducible, catastrophic. siren emoji
The authors have said it isn't.
I can't believe saying a security vulnerability is "reproducible", "critical", etc. is a "classic tell of ai".
I've used "reproducible" and "critical" in my deliverables since well before ai was a thing.