React Server Components advisories: build a patch lane

On December 3, 2025, the React team disclosed CVE-2025-55182, known as React2Shell: unauthenticated remote code execution in React Server Components, rated CVSS 10.0. An attacker could send one crafted HTTP request to a Server Function endpoint, and React's payload decoder would run the attacker's code on your server.

The fix shipped that day. Over the next eight weeks, researchers probing the patch found four more bugs, and two of the patches that followed turned out to be incomplete. If you run the App Router, you patched React at least twice, and the second time caught teams that had closed the ticket.

The timeline

1. November 29, 2025

   Lachlan Davidson reports the RCE through Meta Bug Bounty.

2. December 1

   The React team has a fix and starts working with hosting providers and framework maintainers.

3. December 3

   React publishes 19.0.1, 19.1.2 and 19.2.1 and discloses CVE-2025-55182.

4. December 3 and 4

   Andrew MacPherson reports a source code leak. RyotaK reports a denial of service. Both came from probing the new patch.

5. December 11

   React discloses CVE-2025-55183 and CVE-2025-55184, then finds a missed DoS case and discloses CVE-2025-67779 the same day.

6. January 26, 2026

   More DoS paths, CVE-2026-23864. React ships 19.0.4, 19.1.5 and 19.2.4 and says the previous patches were incomplete.

React patched the critical bug four days after the report. Teams that upgraded once and moved on stayed exposed to the DoS bugs for weeks.

What each bug does

The vulnerable code lives in react-server-dom-webpack, react-server-dom-parcel and react-server-dom-turbopack. Your own package.json may not list them. Next.js, React Router, Waku, @parcel/rsc, @vitejs/plugin-rsc and RedwoodSDK pull them in.

One detail catches people: an app with no Server Functions can still be vulnerable if its framework supports Server Components. The endpoint exists either way. Apps without a server, or without an RSC-capable framework, are safe.

The source leak and your secrets

CVE-2025-55183 lets an attacker read the source of a Server Function that turns an argument into a string, through a template literal or a database write. The advisory's example shows a hardcoded connection string coming back in the response.

"use server";

export async function createUser(name: string) {
  // Leaks: a literal in the function body
  const conn = db.createConnection("SECRET KEY");
  // Safe: read at runtime, not part of the source
  const conn2 = db.createConnection(process.env.DB_URL);
  return { message: `Hello, ${name}!` };
}

Secrets you read from process.env at runtime stay safe. Secrets written into the source can leak, along with any functions your bundler inlined into the Server Function. The team says to check your production bundle, not your source files. If you find a literal secret there, rotate it.

Patched versions

Use the last line on each branch. Earlier fixes, including 19.0.3, 19.1.4 and 19.2.3, are vulnerable.

Each Next.js 15 minor has its own patch, from 15.0.8 to 15.5.10. The React post lists two different numbers for 15.4, so confirm against the Next.js security blog before you pin. React Native apps are safe. In a monorepo, update only the react-server-dom-* packages. Bumping react there breaks React Native with a version mismatch.

Hosting providers deployed temporary filters. The React team says not to rely on them.

The patch lane

Expect the two-round pattern again. Researchers probe each fresh patch, and the follow-up advisory can land a week later. Build the lane once:

1. Inventory. Run npm ls react-server-dom-webpack react-server-dom-turbopack react-server-dom-parcel in each app in the monorepo, including examples and internal tools.
2. Branch. Keep framework security bumps out of feature releases, with their own PR template and a same-day deploy path.
3. Verify. Check the version running in production, from the built bundle or a version endpoint, not the lockfile on main.
4. Re-open. Leave the ticket open for two weeks after a critical patch and watch the advisory for an update banner.
5. Rotate. If a CVE exposes source or memory, search the production bundle for literals and rotate what you find.

This week

Run the npm ls command above across your repos and confirm each hit resolves to 19.0.4, 19.1.5 or 19.2.4 or later. Then grep your Server Functions for string literals that look like keys, and move them to environment variables.