Critical RSC flaws in React and Next.js enable unauthenticated remote code execution; users should update to patched versions ...

如果你在用 React 19 / Next.js 15 / 16， 这篇就当是一个温柔但坚决的催命信： Vercel 已经出手，在它的全球 Web Application Firewall（WAF）上， 加了一层拦截规则，免费帮所有托管在上面的项目挡一波。

编译 | Tina、冬梅上周刚追完 10 级补丁，以为能喘口气了？还不行。12 月 12 日，React 官方确认，研究人员在验证上周补丁时，竟又在 React Server ...

React2Shell (CVE-2025-55182) is a critical vulnerability affecting the most widely used React-based services across the web ...

In early December 2025, the React core team disclosed two new vulnerabilities affecting React Server Components (RSC). These issues – Denial-of-Service and Source Code Exposure were found by security ...

Security and developer teams are scrambling to address a highly critical security flaw in frameworks tied to the popular React JavaScript library. Not only is the vulnerability, which also is in the ...

React团队于12月3日发布了有史以来最严重的安全漏洞公告（CVE-2025-55182），该漏洞被评为CVSS 10.0分——最高风险等级。 这一被称为“React2shell”的漏洞，堪比一把开启服务器大门的“万能钥匙”，攻击者无需任何身份验证，仅需发送一个精心构造的HTTP请求，便可直接控制企业服务器。

A maximum severity vulnerability, dubbed 'React2Shell', in the React Server Components (RSC) 'Flight' protocol allows remote code execution without authentication in React and Next.js applications.

A CVSS 10 rate critical vulnerability impacts React Server Components in versions 19.0–19.2.0. A patched update has been ...

A newly discovered security flaw in the React ecosystem — one of the most widely used technologies on the web — is prompting ...