Critical Security Vulnerability in React Server Components

#1

Post by nomaxx117 » Wed, Dec 03, 2025, 3:43 PM UTC

Critical Security Vulnerability in React Server Components
react.dev

Re: Critical Security Vulnerability in React Server Components

#2

Post by Veliladon » Wed, Dec 03, 2025, 3:56 PM UTC

It's a wonderful day on the Internet. A beautiful day for a CVSS 10 exploit!

Re: Critical Security Vulnerability in React Server Components

#3

Post by jmholla » Wed, Dec 03, 2025, 4:39 PM UTC

Next[0] does have fixes for this. Fixed versions:

* 15.0.5

* 15.1.9

* 15.2.6

* 15.3.6

* 15.4.8

* 15.5.7

* 16.0.7

[0]: https://nextjs.org/blog/CVE-2025-66478

Re: Critical Security Vulnerability in React Server Components

#4

Post by lioeters » Wed, Dec 03, 2025, 4:53 PM UTC

> An unauthenticated attacker could craft a malicious HTTP request to any Server Function endpoint that, when deserialized by React, achieves remote code execution on the server. ..Affected: next, react-router, waku, @parcel/rsc, @vitejs/plugin-rsc, and rwsdk.

Oof, that's bad. Good thing I've only used RSC for static site generation and don't run it on a production server.

Re: Critical Security Vulnerability in React Server Components

#5

Post by ChrisArchitect » Wed, Dec 03, 2025, 5:38 PM UTC

More discussion: https://news.ycombinator.com/item?id=46136067

Re: Critical Security Vulnerability in React Server Components

#6

Post by bek-shoyatbek » Wed, Dec 03, 2025, 7:57 PM UTC

React first caused Cloudflare down with simple hook then now, a new feature server components causing an issue... I would rather be coding with HTMX....

Re: Critical Security Vulnerability in React Server Components

#7

Post by ChrisArchitect » Wed, Dec 03, 2025, 10:27 PM UTC

ChrisArchitect wrote: post #5

More discussion: https://news.ycombinator.com/item?id=46136067

More more discussion: https://news.ycombinator.com/item?id=46136026