Next.js Security Update: Two New React Server Component Vulnerabilities Identified
By
0xedb
Pure flour-power. Hearty enough to carry you through lunch.
Summary
Two new security vulnerabilities (CVE-2025-55183 and CVE-2025-55184) have been discovered in React Server Components (RSC) protocol, affecting Next.js applications using App Router. These vulnerabilities were found while examining patches for React2Shell, but unlike React2Shell, they do not allow Remote Code Execution. The React2Shell patch remains effective. Users are advised to upgrade to patched versions immediately.
Key quotes
· 5 pulledTwo additional vulnerabilities have been identified in the React Server Components (RSC) protocol.
These issues were discovered while security researchers examined the patches for React2Shell.
Importantly, neither of these new issues allow for Remote Code Execution.
These vulnerabilities originate in the upstream React implementation (CVE-2025-55183, CVE-2025-55184).
This advisory tracks the downstream impact on Next.js applications using the App Router.
You might also wanna read
Why Security Through Obscurity Still Matters as a Practical Defense Layer
The article challenges the common developer mantra that "security through obscurity is bad," arguing that obscurity (like JavaScript obfusca
mobeigi.com·28d ago
Scratch's ongoing security challenges with SVG sanitization
The article discusses the security challenges Scratch faces with SVG sanitization. Scratch parses user-generated (attacker-controlled) SVG c
CT Log Explorer: A Tool for Browsing Certificate Transparency Logs
CT Log Explorer is a tool for browsing Certificate Transparency logs, which are public records of SSL/TLS certificates issued by Certificate
certs.swerdlow.dev·4mo ago
Svelte Ecosystem Releases Security Patches for 5 Vulnerabilities
The Svelte ecosystem has released security patches for 5 vulnerabilities affecting multiple packages including devalue, svelte, @sveltejs/ki
svelte.dev·4mo ago
Security Warning: Exposed Supabase API Keys Leave Databases Publicly Accessible
The article describes a security vulnerability where developers often leave their Supabase databases publicly accessible by exposing API key
skilldeliver.com·5mo ago
Critical Security Vulnerability in React Server Components (CVE-2025-55182) Allows Remote Code Execution
The React team disclosed a critical security vulnerability (CVE-2025-55182) rated CVSS 10.0 that allows unauthenticated remote code executio
react.dev·5mo ago