Cybersecurity
Ten out of ten
The score no developer wants to see in a security advisory.
Ten out of ten.
On an exam, that's great news.
On a vulnerability severity scale, not so much. 😬
On December 3, 2025, the React team publicly disclosed a critical vulnerability in certain React Server Components packages. Its identifier: CVE-2025-55182, also known as React2Shell.
Its severity score: CVSS 10.0.
I don't think the useful part of this story is another apocalyptic headline. It's how a weakness in a widely used building block can force thousands of teams to review their applications almost overnight.
What happened
According to React's official advisory, the issue was reported on November 29, 2025, and disclosed on December 3.
It involved how certain React Server Components packages processed data sent to server functions. In vulnerable configurations, a crafted request could lead to unauthenticated remote code execution.
Affected versions included releases of:
- react-server-dom-webpack;
- react-server-dom-parcel;
- react-server-dom-turbopack.
Applications relying on those components, including some Next.js App Router versions, could therefore be exposed.
Not every React application was automatically vulnerable. You need to inspect the versions and configuration actually deployed.
Why the risk was so serious
We often think about application security through user accounts: authentication, roles, permissions and passwords.
But a weakness exploitable before authentication changes the picture.
Imagine a polished application with carefully designed access controls, while an underlying server dependency has a critical flaw.
The interface may look perfect. The problem sits deeper in the stack.
It's a reminder that the security of our software also depends on code we didn't write.
Is updating enough?
It's the first step, but not the entire story.
React and Next.js published patched versions. Yet later React advisories described additional vulnerabilities found after the initial fixes.
That makes it important to check current advisories and install a currently patched stable release, rather than blindly following an old patch number from a 2025 blog post.
The Next.js advisory helps identify affected branches.
What I'd check on a project
- Inventory: which apps use React Server Components, and which versions are actually deployed?
- Dependencies: what packages are installed, including transitive dependencies?
- Updates: have patched versions been tested and deployed everywhere needed?
- Logs: is there unusual activity during the potential exposure window?
- Secrets: if compromise is suspected, do credentials need rotation and an incident response?
- Prevention: will automated checks catch the next critical advisory sooner?
A web application firewall may provide an extra layer of protection. It is not a replacement for fixing the vulnerable dependency.
My developer takeaway
With AI assistants and ready-made libraries, building an application quickly has never been easier.
But each dependency is also something we need to track.
That isn't a reason to reinvent everything. It's a reason to take maintenance, updates and security reviews seriously.
The most useful question after an advisory isn't just “Does my website still work?”
It's: “Do I know exactly what's running on my server?”
This article covers the December 2025 incident and general security practices. Always consult current vendor advisories for operational guidance.
