Critical React and Next.js Enables Remote Attackers to Execute Malicious Code

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical React Flaw CVE-2025-55182 Exposes Major Security Risks A maximum-severity vulnerability in the React JavaScript library, tracked as CVE-2025-55182, allows unauthenticated remote code execution on affected instances. Security researchers report that 39 percent of cloud environments are vulnerable, and exploitation is expected to occur imminently. Developers are actively working to patch the flaw as it threatens numerous applications relying on React Server Components. 47 sources 62