"We did a number of refactors [...] This also fixes a critical security vulnerability." 👀
CVE-2025-55182, an RCE in React Server Components just landed:
https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components
Enjoy your patching, and make sure to check your bundled frameworks and dependencies.
Here's the commit:
https://github.com/facebook/react/commit/7dc903cd29dac55efb4424853fd0442fef3a8700
Jan Schaumann
npub1z6…wehl4
2025-12-03 15:55:53 UTC
Author Public Key
npub1z6e60xgyfcjq42deezd8695tp5ne08dkxqs7acg40ntmcrr23arsjwehl4Seen on
wss://relay.momostr.pinkPublished at
2025-12-03 15:55:53 UTCEvent JSON
{
"id": "def278101ac7149a11239de06b87235e99926ee752a36f996d75605e37c819ec",
"pubkey": "16b3a799044e240aa9b9c89a7d168b0d27979db63021eee1157cd7bc0c6a8f47",
"created_at": 1764777353,
"kind": 1,
"tags": [
[
"proxy",
"https://mstdn.social/@jschauma/115656448649390437",
"web"
],
[
"proxy",
"https://mstdn.social/users/jschauma/statuses/115656448649390437",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://mstdn.social/users/jschauma/statuses/115656448649390437",
"pink.momostr"
],
[
"-"
]
],
"content": "\"We did a number of refactors [...] This also fixes a critical security vulnerability.\" 👀\n\nCVE-2025-55182, an RCE in React Server Components just landed:\n\nhttps://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components\n\nEnjoy your patching, and make sure to check your bundled frameworks and dependencies.\n\nHere's the commit:\nhttps://github.com/facebook/react/commit/7dc903cd29dac55efb4424853fd0442fef3a8700",
"sig": "c132fc715e3b2091a56b1731927df07537b4d253b17972d28dfc38ed49ade2cd4b2ec70735a8c3c4f4b65173be4276657e30fb417a446304c2e17a3144b1c546"
}