Developers using React 19 and related frameworks are strongly advised to update immediately following the discovery of a significant security vulnerability. Researchers at Wiz identified a flaw in the React Server Components (RSC) Flight protocol that could allow attackers to execute malicious code remotely, posing a serious risk to affected applications.

Details of the Vulnerability

The vulnerability, assigned CVE-2025-55182, affects React versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0. and involves a logical deserialization weakness in the server package. When a server processes malformed or specially crafted payloads, it fails to validate the data properly, enabling attackers to influence server-side execution and run arbitrary JavaScript code.

Because the default configurations of many applications are vulnerable, standard deployments are at immediate risk. Wiz’s testing confirms that even a typical Next.js application created with create-next-app and built for production can be exploited without any specific code modifications.

Impacted Frameworks and Precautions

The flaw impacts not only React but also frameworks built upon it, notably Next.js, which uses the RSC protocol by default. The affected Next.js versions include 15.x and 16.x utilizing the App Router. The associated CVE for Next.js is CVE-2025-66478.

The recommended fix is to upgrade both React and Next.js to their latest versions. React’s official blog provides comprehensive upgrade instructions to ensure proper patching. Given the widespread use of React in cloud environments—currently estimated at 39%—prompt action is critical.

Industry experts, including Johannes Ullrich of the SANS Institute, warn that this is a serious vulnerability, with public exploits likely to emerge soon. Developers are urged to act quickly to mitigate potential threats and secure their applications against malicious attacks.

Inspired by

• https://www.infoworld.com/article/4100641/developers-urged-to-immediately-upgrade-react-next-js.html

Sources

• shutterstock.com
• react.dev
• wiz.io
• github.com
• react.dev