React and Next.js Under Fire: Critical RCE Vulnerability (CVSS 10.0!)
React Server Components: "It'll be safe," they said...
If you're a frontend developer (or a full-stack dev pretending to like CSS), I hope you weren't planning a quiet Friday. News has broken about a critical vulnerability in the React ecosystem that is making admins everywhere lose sleep.
We are talking about CVE-2025-55182. What's so scary about it? It received the rarely seen, "prestigious" CVSS score of 10.0. Yes, that is on a ten-point scale. It means it's bad. Very bad.
What's the Issue? (For Techies and Non-Techies)
The problem lies within React Server Components (RSC). In short: the mechanism deserializes data from untrusted sources (i.e., users) without proper verification. If you're thinking "sounds like a classic hole," you're right.
An attacker can send a specially crafted HTTP request which the server accepts, and then – instead of rendering a component – it executes malicious code sent by the hacker. We are talking about full Remote Code Execution (RCE) here. No privileges, login, or user interaction are required. The doors are wide open.
Who Is Affected?
The list is specific and includes the most popular tools:
- React: versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0.
- Next.js: versions 15.x, 16.x, and Canary builds (above 14.3.0-canary.77).
- Packages such as
react-server-dom-parcel,react-server-dom-webpack,react-server-dom-turbopack.
If you are using Next.js version 15 or newer with App Router – you are a target.
What to Do?
Don't panic (unless you haven't started updating yet). The library creators have risen to the occasion.
- Update React to versions: 19.0.1, 19.1.2, or 19.2.1.
- Update Next.js to the latest patches: 15.0.5, 15.1.9, 15.2.6, etc.
Good news for the lazy ones: If you host your app on Vercel, their team has already deployed rules at the WAF level to block attacks. But don't use that as an excuse – update your packages!
Źródła / Sources: React Blog - Critical Security Vulnerability Next.js Security Advisory (GHSA-9qr9-h5gf-34mp)
Aleksander
About the Author
Dyrektor ds. Technologii w SecurHub.pl
Doktorant z zakresu neuronauki poznawczej. Psycholog i ekspert IT specjalizujący się w cyberbezpieczeństwie.
Powiązane artykuły
Echa React2Shell: Puszka Pandory została otwarta
Myśleliście, że patch na CVSS 10.0 zakończył temat? Błąd. Gdy światła reflektorów padły na React Server Components, badacze znaleźli coś więcej. Analizujemy „wstrząsy wtórne” w ekosystemie Next.js.
Cl0p kradnie dane przez lukę w Oracle – czy twoja firma jest następna w kolejce?
Grupa ransomware Cl0p wykorzystała zero-day w Oracle E-Business Suite (CVE-2025-61882), kradnąc dane od wielu firm w sierpniu. Oracle właśnie wydał łatkę, ale eksperci ostrzegają: sprawdźcie swoje systemy natychmiast, bo ataki trwają.
Dogłębna Analiza Luki 0-Day w WhatsApp: Jak Działał Cichy Atak na iPhony?
Szczegółowa analiza mechanizmu i odkrycia luki CVE-2025-55177 w WhatsApp. Wyjaśniamy, jak atakujący łączyli dwie podatności 0-day, by stworzyć potężne narzędzie szpiegowskie typu "zero-click".
Komentarze
Ładowanie komentarzy...