Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Critical RCE Vulnerabilities in React and Next.js

wiz.io

Post reply on HN
Print view View original

41–50 of 92 posts

Re: Critical RCE Vulnerabilities in React and Next.js

#41

Post by rvnx »

jfindper wrote: post #30
tensegrist wrote: post #25

Earlier quoted context omitted.

the tl;dr definitely came out of an llm presentation and formatting aside the constant attempts to manufacture legitimacy and signal urgency are a classic tell. everything is "near-100%" reliable, urgent, critical, reproducible, catastrophic. siren emoji

The authors have said it isn't. I can't believe saying a security vulnerability is "reproducible", "critical", etc. is a "classic tell of ai". I've used "reproducible" and "critical" in my deliverables since well before ai was a thing.

Is it so important ? It's a mix of AI and human-written. It's normal nowadays and perfectly acceptable.

+ it is maybe 10% AI max, which seems to be for the structure / readability, and there is legit information under.

Re: Critical RCE Vulnerabilities in React and Next.js

#42

Post by 1vuio0pswjnm7 »

_f9cu wrote: post #19

What is RCE? Remote call execution?

From the blog post:

"Assigned CVE-2025-55182 (React) and CVE-2025-66478 (Next.js), this flaw allows for unauthenticated remote code execution (RCE) on the server due to insecure deserialization."

Re: Critical RCE Vulnerabilities in React and Next.js

#43

Post by mvdtnz »

mmsc wrote: post #5

These wiz.io blog posts should be banned from HN; AFAICT, they're AI generated. Here's the original post with the details: https://react.dev/blog/2025/12/03/critical-security-vulnerab... - the vulnerability was not found by a Wiz employee at all, and the Wiz article (unlike the react.dev article) does not provide any meaningful technical information. The important part to know: - Even if your app does not implement a…

I can't even read the Wiz post, it just plays an unrelated full screen video at me after flickering a couple of times.

Re: Critical RCE Vulnerabilities in React and Next.js

#44

Post by jfindper »

rvnx wrote: post #41
jfindper wrote: post #30

Earlier quoted context omitted.

The authors have said it isn't. I can't believe saying a security vulnerability is "reproducible", "critical", etc. is a "classic tell of ai". I've used "reproducible" and "critical" in my deliverables since well before ai was a thing.

Is it so important ? It's a mix of AI and human-written. It's normal nowadays and perfectly acceptable. + it is maybe 10% AI max, which seems to be for the structure / readability, and there is legit information under.

>Because author says it, it doesn't mean that it is true.

And because random HNer says it is ai doesn't mean it is ai.

>But still, is it so important?

Not to me, no. If the information is useful/entertaining/etc., I don't really care. But having to read "it's ai!" comments on literally every article/blog posted for the next 10 years is going to be super annoying. Especially if the reasoning provided is "they used the word critical". At least you pointed to something kind of interesting with the quotation marks (although, certainly not definitive of anything), rather than saying some extremely common word = ai.

Re: Critical RCE Vulnerabilities in React and Next.js

#45

Post by deathanatos »

jfindper wrote: post #36
mmsc wrote: post #28

Earlier quoted context omitted.

Hackernews' submission guidelines clearly state: "Please submit the original source. If a post reports on something found on another site, submit the latter." [0] The Wiz post has significantly changed since it was first published (and how it looked when first posted to HN), FYI -- see [1]. When it was published, it was a summary of the React announcement, and was somehow longer than the original and yet provided les…

[flagged]

> It just comes off as condescending.

Or, … they're just citing the source for the information, so that, in case you aren't aware as to where to find them, now you are.

I think that's a doubly reasonable thing to do, given that your account is new, too.

Re: Critical RCE Vulnerabilities in React and Next.js

#46

Post by cyberax »

bri3d wrote: post #8

Here's a patch diff: https://github.com/vercel/next.js/compare/v15.0.4...v15.0.5 It looks like the fix is checking hasOwnProperty, so it's almost certainly an issue with prototype chain pollution.

I think this is the fix for the React Server: https://github.com/facebook/react/pull/35277/files

It looks like it only affects dynamic reloading? If I understand correctly, the client can just politely ask the server to load arbitrary code, and the server agrees.

This should never be enabled in production in the first place. I'm not surprised that they are fundamentally vulnerable, and this is likely not going to be the last RCE in this part of the code.

Re: Critical RCE Vulnerabilities in React and Next.js

#47

Post by nostrademons »

rvnx wrote: post #41
jfindper wrote: post #30

Earlier quoted context omitted.

The authors have said it isn't. I can't believe saying a security vulnerability is "reproducible", "critical", etc. is a "classic tell of ai". I've used "reproducible" and "critical" in my deliverables since well before ai was a thing.

Is it so important ? It's a mix of AI and human-written. It's normal nowadays and perfectly acceptable. + it is maybe 10% AI max, which seems to be for the structure / readability, and there is legit information under.

So smart quotes is now an LLM tell? You know that a lot of people write in word processors that automatically replace standard quotes with smart quotes (like, say, MS Word), and that these word processors can then export HTML straight into your block or preserve the smart quotes across a copy & paste? Several blog WYSIWYG editors will also directly insert them as well.

Re: Critical RCE Vulnerabilities in React and Next.js

#48

Post by rvnx »

jfindper wrote: post #44
rvnx wrote: post #41

Earlier quoted context omitted.

Is it so important ? It's a mix of AI and human-written. It's normal nowadays and perfectly acceptable. + it is maybe 10% AI max, which seems to be for the structure / readability, and there is legit information under.

> Because author says it, it doesn't mean that it is true. And because random HNer says it is ai doesn't mean it is ai. > But still, is it so important? Not to me, no. If the information is useful/entertaining/etc., I don't really care. But having to read "it's ai!" comments on literally every article/blog posted for the next 10 years is going to be super annoying. Especially if the reasoning provided is "they used t…

Absolutely, anyway you'll have critical judgment to make your own opinion.

What bothers me about the Wiz post is why they want to hide this HTTP request is actually not helpful in terms of security.

On the plus side, they help getting the word out there, so at least something.

Re: Critical RCE Vulnerabilities in React and Next.js

#49

Post by cyberax »

tempaccount420 wrote: post #39

Basically, JavaScript should not be running on servers. Vulnerabilities caused by shoddy JS are a lot more impactful to a server since multiple users will be served by the same runtime instance.

It's not JavaScript by itself. It's unsafe coding practices that blend production and development code.

The bug here is in the hot reloading code. It should not be enabled anywhere but on developers' machines.

Post reply on HN