Hey #Javascript folks, why does no one talking about the recent #React #CVE mentions defensive mechanisms like node's --disallow-code-generation-from-strings which from what I've seen would have prevented the RCE (there may be ways to exploit the prototype pollution but would make the attacker's job much harder).
There is also --disable-proto=delete but I don't know if it's practical.
Using Content Security Policies in the frontend is table stakes, why not also on the server?
#NodeJS #NextJS
Soso
npub144…2pth4
2025-12-10 18:14:15 UTC
Author Public Key
npub144axvvmme0kpjtenmd05lk3yakat3qv4nyylh04tmgz2348u28xs62pth4Seen on
wss://relay.momostr.pinkPublished at
2025-12-10 18:14:15 UTCEvent JSON
{
"id": "a9f1cb9c14a28274e0be48e5bec060aa0b21e1e3a4095ce5f0d9db8959d1ffc0",
"pubkey": "ad7a66337bcbec192f33db5f4fda24edbab881959909fbbeabda04a8d4fc51cd",
"created_at": 1765390455,
"kind": 1,
"tags": [
[
"t",
"react"
],
[
"t",
"nextjs"
],
[
"proxy",
"https://pouet.chapril.org/@sgued/115696628889020692",
"web"
],
[
"t",
"nodejs"
],
[
"t",
"javascript"
],
[
"t",
"cve"
],
[
"proxy",
"https://pouet.chapril.org/users/sgued/statuses/115696628889020692",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://pouet.chapril.org/users/sgued/statuses/115696628889020692",
"pink.momostr"
],
[
"-"
]
],
"content": "Hey #Javascript folks, why does no one talking about the recent #React #CVE mentions defensive mechanisms like node's --disallow-code-generation-from-strings which from what I've seen would have prevented the RCE (there may be ways to exploit the prototype pollution but would make the attacker's job much harder).\n\nThere is also --disable-proto=delete but I don't know if it's practical.\n\nUsing Content Security Policies in the frontend is table stakes, why not also on the server?\n\n#NodeJS #NextJS",
"sig": "df88a942885e1c78cb651192a80977297e61a982ca931803ec60b069c9cd56a98d94c7e075cbe738d48133e4d7612bd933c823cd35c964b5ddf6b91386c0b9b8"
}