Critical React and Next.js Vulnerabilities Enable Remote Attackers to Execute Malicious Code

Cyberpress • December 4, 2025

Share: View original

Two critical vulnerabilities have been discovered in the React Server Components (RSC) “Flight” protocol, allowing unauthenticated attackers to ...

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical React Flaw CVE-2025-55182 Exposes Major Security Risks A maximum-severity vulnerability in the React JavaScript library, tracked as CVE-2025-55182, allows unauthenticated remote code execution on affected instances. Security researchers report that 39 percent of cloud environments are vulnerable, and exploitation is expected to occur imminently. Developers are actively working to patch the flaw as it threatens numerous applications relying on React Server Components. 47 sources 62

Extracted Entities

Platforms (3)

Next.js React React Server Components Flight Protocol