Skip to content

Commit 249b7c7

Browse files
alinkeddalinkedd
authored
Merge pull request #648 from reactjs/sync-e22544e6
Sync with react.dev @ e22544e
2 parents 676f012 + b30b020 commit 249b7c7

File tree

9 files changed

+411
-217
lines changed

9 files changed

+411
-217
lines changed

‎package.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@
3535
"classnames": "^2.2.6",
3636
"debounce": "^1.2.1",
3737
"github-slugger": "^1.3.0",
38-
"next": "15.4.8",
38+
"next": "15.1.9",
3939
"next-remote-watch": "^1.0.0",
4040
"parse-numeric-range": "^1.2.0",
4141
"react": "^19.0.0",

‎src/components/MDX/Sandpack/template.ts‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -35,8 +35,8 @@ root.render(
3535
eject: 'react-scripts eject',
3636
},
3737
dependencies: {
38-
react: '^19.2.0',
39-
'react-dom': '^19.2.0',
38+
react: '^19.2.1',
39+
'react-dom': '^19.2.1',
4040
'react-scripts': '^5.0.0',
4141
},
4242
},

‎src/components/MDX/SandpackWithHTMLOutput.tsx‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -56,8 +56,8 @@ export default function formatHTML(markup) {
5656
const packageJSON = `
5757
{
5858
"dependencies": {
59-
"react": "^19.2.0",
60-
"react-dom": "^19.2.0",
59+
"react": "^19.2.1",
60+
"react-dom": "^19.2.1",
6161
"react-scripts": "^5.0.0",
6262
"html-format": "^1.1.2"
6363
},

‎src/content/blog/2025/12/03/critical-security-vulnerability-in-react-server-components.md‎

Lines changed: 168 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,168 @@
1+
---
2+
title: "Critical Security Vulnerability in React Server Components"
3+
author: The React Team
4+
date: 2025/12/03
5+
description: There is an unauthenticated remote code execution vulnerability in React Server Components. A fix has been published in versions 19.0.1, 19.1.2, and 19.2.1. We recommend upgrading immediately.
6+
7+
---
8+
9+
December 3, 2025 by [The React Team](/community/team)
10+
11+
---
12+
13+
<Intro>
14+
15+
There is an unauthenticated remote code execution vulnerability in React Server Components.
16+
17+
We recommend upgrading immediately.
18+
19+
</Intro>
20+
21+
---
22+
23+
On November 29th, Lachlan Davidson reported a security vulnerability in React that allows unauthenticated remote code execution by exploiting a flaw in how React decodes payloads sent to React Server Function endpoints.
24+
25+
Even if your app does not implement any React Server Function endpoints it may still be vulnerable if your app supports React Server Components.
26+
27+
This vulnerability was disclosed as [CVE-2025-55182](https://www.cve.org/CVERecord?id=CVE-2025-55182) and is rated CVSS 10.0.
28+
29+
The vulnerability is present in versions 19.0, 19.1.0, 19.1.1, and 19.2.0 of:
30+
31+
* [react-server-dom-webpack](https://www.npmjs.com/package/react-server-dom-webpack)
32+
* [react-server-dom-parcel](https://www.npmjs.com/package/react-server-dom-parcel)
33+
* [react-server-dom-turbopack](https://www.npmjs.com/package/react-server-dom-turbopack?activeTab=readme)
34+
35+
## Immediate Action Required {/*immediate-action-required*/}
36+
37+
A fix was introduced in versions [19.0.1](https://github.com/facebook/react/releases/tag/v19.0.1), [19.1.2](https://github.com/facebook/react/releases/tag/v19.1.2), and [19.2.1](https://github.com/facebook/react/releases/tag/v19.2.1). If you are using any of the above packages please upgrade to any of the fixed versions immediately.
38+
39+
If your app’s React code does not use a server, your app is not affected by this vulnerability. If your app does not use a framework, bundler, or bundler plugin that supports React Server Components, your app is not affected by this vulnerability.
40+
41+
### Affected frameworks and bundlers {/*affected-frameworks-and-bundlers*/}
42+
43+
Some React frameworks and bundlers depended on, had peer dependencies for, or included the vulnerable React packages. The following React frameworks & bundlers are affected: [next](https://www.npmjs.com/package/next), [react-router](https://www.npmjs.com/package/react-router), [waku](https://www.npmjs.com/package/waku), [@parcel/rsc](https://www.npmjs.com/package/@parcel/rsc), [@vitejs/plugin-rsc](https://www.npmjs.com/package/@vitejs/plugin-rsc), and [rwsdk](https://www.npmjs.com/package/rwsdk).
44+
45+
We will update this post with upgrade instructions on how to upgrade as they become available.
46+
47+
### Hosting Provider Mitigations {/*hosting-provider-mitigations*/}
48+
49+
We have worked with a number of hosting providers to apply temporary mitigations.
50+
51+
You should not depend on these to secure your app, and still update immediately.
52+
53+
### Vulnerability overview {/*vulnerability-overview*/}
54+
55+
[React Server Functions](https://react.dev/reference/rsc/server-functions) allow a client to call a function on a server. React provides integration points and tools that frameworks and bundlers use to help React code run on both the client and the server. React translates requests on the client into HTTP requests which are forwarded to a server. On the server, React translates the HTTP request into a function call and returns the needed data to the client.
56+
57+
An unauthenticated attacker could craft a malicious HTTP request to any Server Function endpoint that, when deserialized by React, achieves remote code execution on the server. Further details of the vulnerability will be provided after the rollout of the fix is complete.
58+
59+
## Update Instructions {/*update-instructions*/}
60+
61+
### Next.js {/*update-next-js*/}
62+
63+
All users should upgrade to the latest patched version in their release line:
64+
65+
```bash
66+
npm install next@15.0.5 // for 15.0.x
67+
npm install next@15.1.9 // for 15.1.x
68+
npm install next@15.2.6 // for 15.2.x
69+
npm install next@15.3.6 // for 15.3.x
70+
npm install next@15.4.8 // for 15.4.x
71+
npm install next@15.5.7 // for 15.5.x
72+
npm install next@16.0.7 // for 16.0.x
73+
```
74+
75+
If you are on Next.js 14.3.0-canary.77 or a later canary release, downgrade to the latest stable 14.x release:
76+
77+
```bash
78+
npm install next@14
79+
```
80+
81+
See the [Next.js changelog](https://nextjs.org/blog/CVE-2025-66478) for more info.
82+
83+
### React Router {/*update-react-router*/}
84+
85+
If you are using React Router's unstable RSC APIs, you should upgrade the following package.json dependencies if they exist:
86+
87+
```bash
88+
npm install react@latest
89+
npm install react-dom@latest
90+
npm install react-server-dom-parcel@latest
91+
npm install react-server-dom-webpack@latest
92+
npm install @vitejs/plugin-rsc@latest
93+
```
94+
95+
### Expo {/*expo*/}
96+
97+
To learn more about mitigating, read the article on [expo.dev/changelog](https://expo.dev/changelog/mitigating-critical-security-vulnerability-in-react-server-components).
98+
99+
### Redwood SDK {/*update-redwood-sdk*/}
100+
101+
Ensure you are on rwsdk>=1.0.0-alpha.0
102+
103+
For the latest beta version:
104+
105+
```bash
106+
npm install rwsdk@latest
107+
```
108+
109+
Upgrade to the latest `react-server-dom-webpack`:
110+
111+
```bash
112+
npm install react@latest react-dom@latest react-server-dom-webpack@latest
113+
```
114+
115+
See [Redwood docs](https://docs.rwsdk.com/migrating/) for more migration instructions.
116+
117+
### Waku {/*update-waku*/}
118+
119+
Upgrade to the latest `react-server-dom-webpack`:
120+
121+
```bash
122+
npm install react@latest react-dom@latest react-server-dom-webpack@latest waku@latest
123+
```
124+
125+
See [Waku announcement](https://github.com/wakujs/waku/discussions/1823) for more migration instructions.
126+
127+
### `@vitejs/plugin-rsc` {/*vitejs-plugin-rsc*/}
128+
129+
Upgrade to the latest RSC plugin:
130+
131+
```bash
132+
npm install react@latest react-dom@latest @vitejs/plugin-rsc@latest
133+
```
134+
135+
### `react-server-dom-parcel` {/*update-react-server-dom-parcel*/}
136+
137+
Update to the latest version:
138+
139+
```bash
140+
npm install react@latest react-dom@latest react-server-dom-parcel@latest
141+
```
142+
143+
### `react-server-dom-turbopack` {/*update-react-server-dom-turbopack*/}
144+
145+
Update to the latest version:
146+
147+
```bash
148+
npm install react@latest react-dom@latest react-server-dom-turbopack@latest
149+
```
150+
151+
### `react-server-dom-webpack` {/*update-react-server-dom-webpack*/}
152+
153+
Update to the latest version:
154+
155+
```bash
156+
npm install react@latest react-dom@latest react-server-dom-webpack@latest
157+
```
158+
159+
## Timeline {/*timeline*/}
160+
161+
* **November 29th**: Lachlan Davidson reported the security vulnerability via [Meta Bug Bounty](https://bugbounty.meta.com/).
162+
* **November 30th**: Meta security researchers confirmed and began working with the React team on a fix.
163+
* **December 1st**: A fix was created and the React team began working with affected hosting providers and open source projects to validate the fix, implement mitigations and roll out the fix
164+
* **December 3rd**: The fix was published to npm and the publicly disclosed as CVE-2025-55182.
165+
166+
## Attribution {/*attribution*/}
167+
168+
Thank you to [Lachlan Davidson](https://github.com/lachlan2k) for discovering, reporting, and working to help fix this vulnerability.

‎src/content/blog/index.md‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,12 @@ title: Блог React
1212

1313
<div className="sm:-mx-5 flex flex-col gap-5 mt-12">
1414

15+
<BlogCard title="Critical Security Vulnerability in React Server Components" date="December 3, 2025" url="/blog/2025/12/03/critical-security-vulnerability-in-react-server-components">
16+
17+
There is an unauthenticated remote code execution vulnerability in React Server Components. A fix has been published in versions 19.0.1, 19.1.2, and 19.2.1. We recommend upgrading immediately.
18+
19+
</BlogCard>
20+
1521
<BlogCard title="React Conf 2025 Recap" date="October 16, 2025" url="/blog/2025/10/16/react-conf-2025-recap">
1622

1723
Last week we hosted React Conf 2025. In this post, we summarize the talks and announcements from the event...

‎src/content/reference/react/addTransitionType.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,7 @@ startTransition(() => {
3939

4040
#### Returns {/*returns*/}
4141

42-
`startTransition` does not return anything.
42+
`addTransitionType` does not return anything.
4343

4444
#### Caveats {/*caveats*/}
4545

‎src/content/versions.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -54,8 +54,12 @@ title: Версії React
5454
- [React 19 Deep Dive: Coordinating HTML](https://www.youtube.com/watch?v=IBBN-s77YSI)
5555

5656
**Релізи**
57+
- [v19.2.1 (Грудень, 2025)](https://github.com/facebook/react/blob/main/CHANGELOG.md#1921-dec-3-2025)
5758
- [v19.2.0 (Жовтень, 2025)](https://github.com/facebook/react/blob/main/CHANGELOG.md#1920-october-1st-2025)
59+
- [v19.1.2 (Грудень, 2025)](https://github.com/facebook/react/blob/main/CHANGELOG.md#1912-dec-3-2025)
60+
- [v19.1.1 (Липень, 2025)](https://github.com/facebook/react/blob/main/CHANGELOG.md#1911-july-28-2025)
5861
- [v19.1.0 (Березень, 2025)](https://github.com/facebook/react/blob/main/CHANGELOG.md#1910-march-28-2025)
62+
- [v19.0.1 (Грудень, 2025)](https://github.com/facebook/react/blob/main/CHANGELOG.md#1901-dec-3-2025)
5963
- [v19.0.0 (Грудень, 2024)](https://github.com/facebook/react/blob/main/CHANGELOG.md#1900-december-5-2024)
6064

6165
### React 18 {/*react-18*/}

‎src/sidebarBlog.json‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,13 @@
1111
"path": "/blog",
1212
"skipBreadcrumb": true,
1313
"routes": [
14+
{
15+
"title": "Critical Security Vulnerability in React Server Components",
16+
"titleForHomepage": "Vulnerability in React Server Components",
17+
"icon": "blog",
18+
"date": "December 03, 2025",
19+
"path": "/blog/2025/12/03/critical-security-vulnerability-in-react-server-components"
20+
},
1421
{
1522
"title": "React Conf 2025 Recap",
1623
"titleForHomepage": "React Conf 2025 Recap",

0 commit comments

Comments
 (0)