React2Shell Aftershocks: New React and Next.js Vulnerabilities Open Pandora's Box

We had barely recovered from the critical React2Shell flaw (the one with a perfect 10 on the CVSS scale that I wrote about earlier), and Vercel is already sending out notifications that ruin a perfectly good weekend coffee.

In the security world, there's a phenomenon I call the "Flashlight Effect." When a major hole turns up in a large, popular codebase (like Next.js or React), thousands of security researchers suddenly turn their attention to it. Everyone wants to find "the second" vulnerability. And guess what? They just did. Actually, they found two.

Here's what you need to know about the new CVEs that surfaced on December 12, and why your previous update isn't enough.

What turned up in the wreckage?

A joint effort by the Bug Bounty community (a collaboration between Vercel and Meta) has revealed that the problem with React Server Components (RSC) runs deeper than we thought. Two new players have entered the stage:

1. CVE-2025-55184: The Loop of Death (Denial of Service)

Severity: High

This is a classic DoS attack with a modern twist. A malicious HTTP request sent to an App Router endpoint can cause the server process to hang while consuming 100% of the CPU. It happens during data deserialization. Interestingly, the bulletin notes that the first fix for this bug was incomplete (which led to yet another identifier, CVE-2025-67779). That shows just how complex this territory is: even the framework's own developers needed several attempts to close the door.

2. CVE-2025-55183: Code Exhibitionism (Source Code Exposure)

Severity: Medium

This one is less destructive but more embarrassing. A specially crafted request can force the server to return the compiled source code of Server Actions. The good news? If you follow best practices and keep secrets (API keys, passwords) in environment variables (.env) rather than hardcoding them in .ts/.js files, you're relatively safe. The bad news? The attacker learns your business logic. They can see how you validate data and what edge cases you handle, and that's an excellent map for planning further attacks.

Why does this matter?

First: Scope. The issue affects React 19 (versions 19.0.0 through 19.2.1) and Next.js (from version 13.x all the way up to the latest 16.x). If you use the App Router, you're a target.

Second: A false sense of security. Many admins breathed a sigh of relief after patching React2Shell. But Vercel's message is brutally clear:

"Even customers who patched React2Shell need to update to the latest version."

This isn't an optional performance patch. It's a must.

Something to think about this weekend

What we're seeing is React Server Components technology going through painful growing pains. Moving rendering logic to the server has blurred the line between frontend and backend, creating new attack vectors that we're only beginning to understand.

Remember the principle of limited trust. Frameworks do a lot of magic for us, but when the magic fails, we're left empty-handed, staring at... the server logs.

What should you do?

1. Don't wait until Monday. Update next and react to the latest versions (patched as of December 12).
2. Audit your code for hardcoded secrets. CVE-2025-55183 doesn't forgive laziness.
3. If you host on Vercel, check your dashboard, but for peace of mind, rebuild your project (redeploy).

Have a safe (and hopefully now quiet) weekend.

Aleksander

Sources:

• Security Bulletin: CVE-2025-55184 and CVE-2025-55183 - Vercel Knowledge Base

FAQ

Is the React2Shell (CVE-2025-56546) update enough to keep me safe?

No. These new vulnerabilities (CVE-2025-55184 and CVE-2025-55183) are separate and require an additional update to the Next.js and React versions patched on December 12, 2024. Even if you applied the previous patch, you need to update again.

Which versions of Next.js are affected?

The issue affects Next.js versions 13.x through the latest 16.x that use the App Router and React Server Components. The Pages Router is not vulnerable to these specific CVEs.

Are my API secrets safe after CVE-2025-55183?

If you store API keys, passwords and other secrets in environment variables (.env) instead of hardcoding them in your code, they are safe. However, an attacker can still see the business logic of your Server Actions, which may help them plan further attacks.