Skip to content

Commit 0fc59ed

Browse files
docschina-botdocschina-bot
committed
docs(en): merging all conflicts
2 parents c12f240 + 72f8998 commit 0fc59ed

File tree

7 files changed

+288
-11
lines changed

7 files changed

+288
-11
lines changed

‎src/content/blog/2025/12/03/critical-security-vulnerability-in-react-server-components.md‎

Lines changed: 39 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,7 @@ If your app’s React code does not use a server, your app is not affected by th
4242

4343
Some React frameworks and bundlers depended on, had peer dependencies for, or included the vulnerable React packages. The following React frameworks & bundlers are affected: [next](https://www.npmjs.com/package/next), [react-router](https://www.npmjs.com/package/react-router), [waku](https://www.npmjs.com/package/waku), [@parcel/rsc](https://www.npmjs.com/package/@parcel/rsc), [@vitejs/plugin-rsc](https://www.npmjs.com/package/@vitejs/plugin-rsc), and [rwsdk](https://www.npmjs.com/package/rwsdk).
4444

45-
We will update this post with upgrade instructions on how to upgrade as they become available.
45+
See the [update instructions below](#update-instructions) for how to upgrade to these patches.
4646

4747
### Hosting Provider Mitigations {/*hosting-provider-mitigations*/}
4848

@@ -58,27 +58,40 @@ An unauthenticated attacker could craft a malicious HTTP request to any Server F
5858

5959
## Update Instructions {/*update-instructions*/}
6060

61+
<Note>
62+
63+
These instructions have been updated to include the new vulnerabilities:
64+
65+
66+
- **Denial of Service - High Severity**: [CVE-2025-55184](https://www.cve.org/CVERecord?id=CVE-2025-55184) (CVSS 7.5)
67+
- **Source Code Exposure - Medium Severity**: [CVE-2025-55183](https://www.cve.org/CVERecord?id=CVE-2025-55183) (CVSS 5.3)
68+
69+
See the [follow-up blog post](/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components) for more info.
70+
71+
</Note>
72+
6173
### Next.js {/*update-next-js*/}
6274

6375
All users should upgrade to the latest patched version in their release line:
6476

6577
```bash
66-
npm install next@15.0.5 // for 15.0.x
67-
npm install next@15.1.9 // for 15.1.x
68-
npm install next@15.2.6 // for 15.2.x
69-
npm install next@15.3.6 // for 15.3.x
70-
npm install next@15.4.8 // for 15.4.x
71-
npm install next@15.5.7 // for 15.5.x
72-
npm install next@16.0.7 // for 16.0.x
78+
npm install next@14.2.34 // for 14.x
79+
npm install next@15.0.6 // for 15.0.x
80+
npm install next@15.1.10 // for 15.1.x
81+
npm install next@15.2.7 // for 15.2.x
82+
npm install next@15.3.7 // for 15.3.x
83+
npm install next@15.4.9 // for 15.4.x
84+
npm install next@15.5.8 // for 15.5.x
85+
npm install next@16.0.9 // for 16.0.x
7386
```
7487

75-
If you are on Next.js 14.3.0-canary.77 or a later canary release, downgrade to the latest stable 14.x release:
88+
If you are on `next@14.3.0-canary.77` or a later canary release, downgrade to the latest stable 14.x release:
7689

7790
```bash
7891
npm install next@14
7992
```
8093

81-
See the [Next.js changelog](https://nextjs.org/blog/CVE-2025-66478) for more info.
94+
See the [Next.js blog](https://nextjs.org/blog/security-update-2025-12-11) for the latest update instructions and the [previous changelog](https://nextjs.org/blog/CVE-2025-66478) for more info.
8295

8396
### React Router {/*update-react-router*/}
8497

@@ -156,6 +169,22 @@ Update to the latest version:
156169
npm install react@latest react-dom@latest react-server-dom-webpack@latest
157170
```
158171

172+
173+
### React Native {/*react-native*/}
174+
175+
For React Native users not using a monorepo or `react-dom`, your `react` version should be pinned in your `package.json`, and there are no additional steps needed.
176+
177+
If you are using React Native in a monorepo, you should update _only_ the impacted packages if they are installed:
178+
179+
- `react-server-dom-webpack`
180+
- `react-server-dom-parcel`
181+
- `react-server-dom-turbopack`
182+
183+
This is required to mitigate the security advisory, but you do not need to update `react` and `react-dom` so this will not cause the version mismatch error in React Native.
184+
185+
See [this issue](https://github.com/facebook/react-native/issues/54772#issuecomment-3617929832) for more information.
186+
187+
159188
## Timeline {/*timeline*/}
160189

161190
* **November 29th**: Lachlan Davidson reported the security vulnerability via [Meta Bug Bounty](https://bugbounty.meta.com/).

‎src/content/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components.md‎

Lines changed: 164 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,164 @@
1+
---
2+
title: "Denial of Service and Source Code Exposure in React Server Components"
3+
author: The React Team
4+
date: 2025/12/11
5+
description: Security researchers have found and disclosed two additional vulnerabilities in React Server Components while attempting to exploit the patches in last week’s critical vulnerability. High vulnerability Denial of Service (CVE-2025-55184), and medium vulnerability Source Code Exposure (CVE-2025-55183)
6+
7+
8+
---
9+
10+
December 11, 2025 by [The React Team](/community/team)
11+
12+
---
13+
14+
<Intro>
15+
16+
Security researchers have found and disclosed two additional vulnerabilities in React Server Components while attempting to exploit the patches in last week’s critical vulnerability.
17+
18+
**These new vulnerabilities do not allow for Remote Code Execution.** The patch for React2Shell remains effective at mitigating the Remote Code Execution exploit.
19+
20+
</Intro>
21+
22+
---
23+
24+
The new vulnerabilities are disclosed as:
25+
26+
- **Denial of Service - High Severity**: [CVE-2025-55184](https://www.cve.org/CVERecord?id=CVE-2025-55184) (CVSS 7.5)
27+
- **Source Code Exposure - Medium Severity**: [CVE-2025-55183](https://www.cve.org/CVERecord?id=CVE-2025-55183) (CVSS 5.3)
28+
29+
We recommend upgrading immediately due to the severity of the newly disclosed vulnerabilities.
30+
31+
<Note>
32+
33+
#### The patches published last week are vulnerable. {/*the-patches-published-last-week-are-vulnerable*/}
34+
35+
If you already updated for the Critical Security Vulnerability, you will need to update again.
36+
37+
Please see [the instructions in the previous post](/blog/2025/12/03/critical-security-vulnerability-in-react-server-components#update-instructions) for upgrade steps.
38+
39+
</Note>
40+
41+
Further details of these vulnerabilities will be provided after the rollout of the fixes are complete.
42+
43+
## Immediate Action Required {/*immediate-action-required*/}
44+
45+
These vulnerabilities are present in the same packages and versions as [CVE-2025-55182](/blog/2025/12/03/critical-security-vulnerability-in-react-server-components).
46+
47+
This includes versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1 of:
48+
49+
* [react-server-dom-webpack](https://www.npmjs.com/package/react-server-dom-webpack)
50+
* [react-server-dom-parcel](https://www.npmjs.com/package/react-server-dom-parcel)
51+
* [react-server-dom-turbopack](https://www.npmjs.com/package/react-server-dom-turbopack?activeTab=readme)
52+
53+
Fixes were backported to versions 19.0.2, 19.1.3, and 19.2.2. If you are using any of the above packages please upgrade to any of the fixed versions immediately.
54+
55+
As before, if your app’s React code does not use a server, your app is not affected by these vulnerabilities. If your app does not use a framework, bundler, or bundler plugin that supports React Server Components, your app is not affected by these vulnerabilities.
56+
57+
<Note>
58+
59+
#### It’s common for critical CVEs to uncover follow‑up vulnerabilities. {/*its-common-for-critical-cves-to-uncover-followup-vulnerabilities*/}
60+
61+
When a critical vulnerability is disclosed, researchers scrutinize adjacent code paths looking for variant exploit techniques to test whether the initial mitigation can be bypassed.
62+
63+
This pattern shows up across the industry, not just in JavaScript. For example, after [Log4Shell](https://nvd.nist.gov/vuln/detail/cve-2021-44228), additional CVEs ([1](https://nvd.nist.gov/vuln/detail/cve-2021-45046), [2](https://nvd.nist.gov/vuln/detail/cve-2021-45105)) were reported as the community probed the original fix.
64+
65+
Additional disclosures can be frustrating, but they are generally a sign of a healthy response cycle.
66+
67+
</Note>
68+
69+
### Affected frameworks and bundlers {/*affected-frameworks-and-bundlers*/}
70+
71+
Some React frameworks and bundlers depended on, had peer dependencies for, or included the vulnerable React packages. The following React frameworks & bundlers are affected: [next](https://www.npmjs.com/package/next), [react-router](https://www.npmjs.com/package/react-router), [waku](https://www.npmjs.com/package/waku), [@parcel/rsc](https://www.npmjs.com/package/@parcel/rsc), [@vite/rsc-plugin](https://www.npmjs.com/package/@vitejs/plugin-rsc), and [rwsdk](https://www.npmjs.com/package/rwsdk).
72+
73+
Please see [the instructions in the previous post](https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components#update-instructions) for upgrade steps.
74+
75+
### Hosting Provider Mitigations {/*hosting-provider-mitigations*/}
76+
77+
As before, we have worked with a number of hosting providers to apply temporary mitigations.
78+
79+
You should not depend on these to secure your app, and still update immediately.
80+
81+
### React Native {/*react-native*/}
82+
83+
For React Native users not using a monorepo or `react-dom`, your `react` version should be pinned in your `package.json`, and there are no additional steps needed.
84+
85+
If you are using React Native in a monorepo, you should update _only_ the impacted packages if they are installed:
86+
87+
- `react-server-dom-webpack`
88+
- `react-server-dom-parcel`
89+
- `react-server-dom-turbopack`
90+
91+
This is required to mitigate the security advisories, but you do not need to update `react` and `react-dom` so this will not cause the version mismatch error in React Native.
92+
93+
See [this issue](https://github.com/facebook/react-native/issues/54772#issuecomment-3617929832) for more information.
94+
95+
## High Severity: Denial of Service {/*high-severity-denial-of-service*/}
96+
97+
**CVE:** [CVE-2025-55184](https://www.cve.org/CVERecord?id=CVE-2025-55184)
98+
**Base Score:** 7.5 (High)
99+
100+
Security researchers have discovered that a malicious HTTP request can be crafted and sent to any Server Functions endpoint that, when deserialized by React, can cause an infinite loop that hangs the server process and consumes CPU. Even if your app does not implement any React Server Function endpoints it may still be vulnerable if your app supports React Server Components.
101+
102+
This creates a vulnerability vector where an attacker may be able to deny users from accessing the product, and potentially have a performance impact on the server environment.
103+
104+
The patches published today mitigate by preventing the infinite loop.
105+
106+
107+
## Medium Severity: Source Code Exposure {/*low-severity-source-code-exposure*/}
108+
109+
**CVE:** [CVE-2025-55183](https://www.cve.org/CVERecord?id=CVE-2025-55183)
110+
**Base Score**: 5.3 (Medium)
111+
112+
A security researcher has discovered that a malicious HTTP request sent to a vulnerable Server Function may unsafely return the source code of any Server Function. Exploitation requires the existence of a Server Function which explicitly or implicitly exposes a stringified argument:
113+
114+
```javascript
115+
'use server';
116+
117+
export async function serverFunction(name) {
118+
const conn = db.createConnection('SECRET KEY');
119+
const user = await conn.createUser(name); // implicitly stringified, leaked in db
120+
121+
return {
122+
id: user.id,
123+
message: `Hello, ${name}!` // explicitly stringified, leaked in reply
124+
}}
125+
```
126+
127+
An attacker may be able to leak the following:
128+
129+
```txt
130+
0:{"a":"$@1","f":"","b":"Wy43RxUKdxmr5iuBzJ1pN"}
131+
1:{"id":"tva1sfodwq","message":"Hello, async function(a){console.log(\"serverFunction\");let b=i.createConnection(\"SECRET KEY\");return{id:(await b.createUser(a)).id,message:`Hello, ${a}!`}}!"}
132+
```
133+
134+
The patches published today prevent stringifying the Server Function source code.
135+
136+
<Note>
137+
138+
#### Only secrets in source code may be exposed. {/*only-secrets-in-source-code-may-be-exposed*/}
139+
140+
Secrets hardcoded in source code may be exposed, but runtime secrets such as `process.env.SECRET` are not affected.
141+
142+
The scope of the exposed code is limited to the code inside the Server Function, which may include other functions depending on the amount of inlining your bundler provides.
143+
144+
Always verify against production bundles.
145+
146+
</Note>
147+
148+
---
149+
150+
## Timeline {/*timeline*/}
151+
* **December 3rd**: Leak reported to Vercel and [Meta Bug Bounty](https://bugbounty.meta.com/) by [Andrew MacPherson](https://github.com/AndrewMohawk).
152+
* **December 4th**: Initial DoS reported to [Meta Bug Bounty](https://bugbounty.meta.com/) by [RyotaK](https://ryotak.net).
153+
* **December 6th**: Both issues confirmed by the React team, and the team began investigating.
154+
* **December 7th**: Initial fixes created and the React team began verifying and planning new patch.
155+
* **December 8th**: Affected hosting providers and open source projects notified.
156+
* **December 10th**: Hosting provider mitigations in place and patches verified.
157+
* **December 11th**: Additional DoS reported to [Meta Bug Bounty](https://bugbounty.meta.com/) and added to patch.
158+
* **December 11th**: Patches published and publicly disclosed as [CVE-2025-55183](https://www.cve.org/CVERecord?id=CVE-2025-55183) and [CVE-2025-55184](https://www.cve.org/CVERecord?id=CVE-2025-55184).
159+
160+
---
161+
162+
## Attribution {/*attribution*/}
163+
164+
Thank you to [Andrew MacPherson (AndrewMohawk)](https://github.com/AndrewMohawk) for reporting the Source Code Exposure, [RyotaK](https://ryotak.net) from GMO Flatt Security Inc for reporting the initial Denial of Service vulnerability.

‎src/content/blog/index.md‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,17 @@ title: React Blog
1111

1212
<div className="sm:-mx-5 flex flex-col gap-5 mt-12">
1313

14+
<<<<<<< HEAD
1415
<BlogCard title="服务器组件中的严重安全漏洞" date="2025 年 12 月 3 日" url="/blog/2025/12/03/critical-security-vulnerability-in-react-server-components">
16+
=======
17+
<BlogCard title="Denial of Service and Source Code Exposure in React Server Components" date="December 11, 2025" url="/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components">
18+
19+
Security researchers have found and disclosed two additional vulnerabilities in React Server Components while attempting to exploit the patches in last week’s critical vulnerability...
20+
21+
</BlogCard>
22+
23+
<BlogCard title="Critical Security Vulnerability in React Server Components" date="December 3, 2025" url="/blog/2025/12/03/critical-security-vulnerability-in-react-server-components">
24+
>>>>>>> 72f8998872ab958924a0ff1fda818fae48d5b031
1525
1626
服务器组件中存在未经身份验证的远程代码执行漏洞。版本 19.0.1、19.1.2 和 19.2.1 已经修复该漏洞。我们建议立即升级。
1727

0 commit comments

Comments
 (0)