Post

A critical vulnerability in React Server Components (CVE-2025-55182) affects React 19 and frameworks, including Next.js (CVE-2025-66478). All users should upgrade to the latest patched version in their release line. nextjs.org/blog/CVE-20...

nextjs.orgSecurity Advisory: CVE-2025-66478A critical vulnerability (CVE-2025-66478) has been identified in the React Server Components protocol. Users should upgrade to patched versions immediately.

3/12/25, 4:42 pm12 reposts26 likes

Deno

@deno.land

3 Dec 2025

Many thanks to the team for sharing this information so that we could get mitigation in place to protect our users. bsky.app/profile/deno...

Deno@deno.land

Next.js / React Server Components vulnerability identified. Apps deployed on Deno Deploy infrastructure are already protected by a runtime-level patch applied by our team. See this post for more information on how to protect your projects. deno.com/blog/react-s...

deno.comReact Server Functions / Next.js Vulnerability: Deno Deploy users protected | DenoA critical Remote Code Execution (RCE) vulnerability has been found in React Server Functions and Next.js. Deno has implemented mitigations in Deno Deploy. Immediate upgrades are required for other us...

AndyJessop

@andyjessop.bsky.social

3 Dec 2025

This is quite catastrophic in many cases, no?

Luna

@shi.gg

3 Dec 2025

basically the worst kind of a vuln for everyone using server components

Bruce

@bruceroettgers.eu

3 Dec 2025

"Even if your app does not implement any React Server Function endpoints it may still be vulnerable if your app supports React Server Components." (From React blog) Unfortunately not just for those using them

Luna

@shi.gg

3 Dec 2025

dam even worse