Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Critical RCE Vulnerabilities in React and Next.js

wiz.io

Post reply on HN
Print view View original

31–40 of 92 posts

Re: Critical RCE Vulnerabilities in React and Next.js

#31

Post by [deleted] »

galnagli wrote: post #10
mmsc wrote: post #5

These wiz.io blog posts should be banned from HN; AFAICT, they're AI generated. Here's the original post with the details: https://react.dev/blog/2025/12/03/critical-security-vulnerab... - the vulnerability was not found by a Wiz employee at all, and the Wiz article (unlike the react.dev article) does not provide any meaningful technical information. The important part to know: - Even if your app does not implement a…

Hey mmsc, first of all - the blogs are not AI Generated! Second of all, the blog did add more information "In our experimentation, exploitation of this vulnerability had high fidelity, with a near 100% success rate and can be leveraged to a full remote code execution. The attack vector is unauthenticated and remote, requiring only a specially crafted HTTP request to the target server. It affects the default configura…

[deleted]

Re: Critical RCE Vulnerabilities in React and Next.js

#32

Post by karimf »

xnorswap wrote: post #23
karimf wrote: post #20

Dang, Cloudflare is moving fast. Cloudflare WAF proactively protects against React vulnerability https://blog.cloudflare.com/waf-rules-react-vulnerability/

This is what coordinated disclosure looks like.

Given that most Next.js and RSC apps run on Vercel, I’m wondering if they’re doing the same thing. There’s no information about this in their latest blog post [0].

Update: They do similar thing. Mentioned here [1]

[0] https://nextjs.org/blog/CVE-2025-66478

[1] https://vercel.com/changelog/cve-2025-55182

Re: Critical RCE Vulnerabilities in React and Next.js

#33

Post by [deleted] »

jfindper wrote: post #30
tensegrist wrote: post #25

Earlier quoted context omitted.

the tl;dr definitely came out of an llm presentation and formatting aside the constant attempts to manufacture legitimacy and signal urgency are a classic tell. everything is "near-100%" reliable, urgent, critical, reproducible, catastrophic. siren emoji

The authors have said it isn't. I can't believe saying a security vulnerability is "reproducible", "critical", etc. is a "classic tell of ai". I've used "reproducible" and "critical" in my deliverables since well before ai was a thing.

[deleted]

Re: Critical RCE Vulnerabilities in React and Next.js

#35

Post by _pdp_ »

rvnx wrote: post #27
_pdp_ wrote: post #17

I don't have time to look into it right now (def later)! However, I was curious to see if github copilot can reverse engineer it based on the latest commits and seems that what it is saying aligns with both advisories. It pointed out that it has to do with circular reference handling which sounds to me something that can be easily overlooked. While this analysis might be completely off, the simple fact that I could g…

It's easier for a bad actor to get an exploit, than for an operator to test his own site if the upgrade succeded

An operator might not be able to upgrade at all!

Along the fixes, the advisories now need to contain detailed workarouds, firewall rules and other adhoc solutions to ensure they get quickly deployed.

Re: Critical RCE Vulnerabilities in React and Next.js

#36

Post by jfindper »

mmsc wrote: post #28
jfindper wrote: post #9

Earlier quoted context omitted.

> AFAICT, they're AI generated. What is the "tell"? I'm not saying they are or aren't, but... people say this about literally everything now and it's typically some flimsy reasoning like "they used a bullet point". I don't see anything in particular that makes me think ai over a standard template some junior fills out. > the vulnerability was not found by a Wiz employee at all I've re-read the Wiz article a few times…

Hackernews' submission guidelines clearly state: "Please submit the original source. If a post reports on something found on another site, submit the latter." [0] The Wiz post has significantly changed since it was first published (and how it looked when first posted to HN), FYI -- see [1]. When it was published, it was a summary of the React announcement, and was somehow longer than the original and yet provided les…

[flagged]

Re: Critical RCE Vulnerabilities in React and Next.js

#37

Post by bradly »

karimf wrote: post #20

Dang, Cloudflare is moving fast. Cloudflare WAF proactively protects against React vulnerability https://blog.cloudflare.com/waf-rules-react-vulnerability/

Would be interesting to hear from Cloudflare the extent of exploitation before today. I'm assuming they can see if/when this started being exploited.

Re: Critical RCE Vulnerabilities in React and Next.js

#38

Post by rvnx »

_pdp_ wrote: post #35
rvnx wrote: post #27

Earlier quoted context omitted.

It's easier for a bad actor to get an exploit, than for an operator to test his own site if the upgrade succeded

An operator might not be able to upgrade at all! Along the fixes, the advisories now need to contain detailed workarouds, firewall rules and other adhoc solutions to ensure they get quickly deployed.

A guide for mitigation is way more useful so we can back port only the fix and test if the fix works.

Re: Critical RCE Vulnerabilities in React and Next.js

#40

Post by internetter »

_pdp_ wrote: post #17

I don't have time to look into it right now (def later)! However, I was curious to see if github copilot can reverse engineer it based on the latest commits and seems that what it is saying aligns with both advisories. It pointed out that it has to do with circular reference handling which sounds to me something that can be easily overlooked. While this analysis might be completely off, the simple fact that I could g…

While I agree with your conclusion

> While this analysis might be completely off, the simple fact that I could get even this information without much efforts is mind-boggling. With better setup it might be able to get more.

This can essentially be rephrased as "I don't know if what the LLM said is true or not but the fact it may or may not be correct is amazing!"

Post reply on HN