React2Shell (CVSS 10.0): Patch React & Next.js NOW | Unauth RCE Explained

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical CVSS 10.0 Vulnerability in React & Next.js Requires Immediate Patch A critical vulnerability with a CVSS score of 10.0 has been identified in React Server Components, specifically affecting the Flight protocol. This flaw allows unauthenticated attackers to execute remote code, impacting applications built with React and Next.js. Users are urged to apply patches immediately to mitigate potential exploitation. 3 sources 63