React's/Next.js Worst Week Ever! Just Got Worse

Full Stack Developer | Freelancer | JavaScript | React | Nodejs.
Loves sharing knowledge through technical articles.
Dev.to: https://dev.to/myogeshchavan97
https://linktr.ee/myogeshchavan97
Search for a command to run...

Full Stack Developer | Freelancer | JavaScript | React | Nodejs.
Loves sharing knowledge through technical articles.
Dev.to: https://dev.to/myogeshchavan97
https://linktr.ee/myogeshchavan97
No comments yet. Be the first to comment.
In this tutorial, you will build a Task Management App using Next.js 16 and Prisma 7 from scratch. By creating this app, you will learn: How to set up Prisma 7 with the new Rust-free architecture How to configure a database with Prisma's driver ada...

Is your React app dragging its feet, but you can’t pinpoint the cause? You might think you’re following the best practices, but some common development patterns are actually degrading your app’s performance behind the scenes. In this article, we’ll u...

How to Use Separate SSH Keys for Company and Personal GitHub Accounts Managing multiple GitHub accounts is a common challenge for developers who juggle both personal and professional projects. It becomes even more complex when you want to use differe...

Have you ever built a React app only to realize that users from different countries can't use it effectively because it only supports English? In this tutorial, you'll learn how to build truly global React application using internationalization (i18n...

If you're a React/Next.js developer who diligently updated your packages last week after the critical React2Shell vulnerability (CVE-2025-55182), I have some frustrating news: you need to update again.
Security researchers, while probing the patches from last week's critical Remote Code Execution fix, discovered two additional vulnerabilities lurking in the same code paths.
The good news? These new vulnerabilities don't allow Remote Code Execution. The bad news? They're still serious enough to warrant immediate action.
A malicious HTTP request can trigger an infinite loop when deserialized by React, hanging your server process and consuming CPU. Even if you don't explicitly implement Server Functions, your app may still be vulnerable if it supports React Server Components.
A crafted request to a vulnerable Server Function can leak its source code, including any hardcoded secrets. If you've got database connection strings, API keys, or credentials directly in your 'use server' functions (instead of environment variables), they could be exposed.
Are You Affected?
You're safe if:
Your React app is purely client-side (no server)
You don't use a framework/bundler that supports React Server Components
You're vulnerable if you use these packages:
react-server-dom-webpack
react-server-dom-parcel
react-server-dom-turbopack
Or these frameworks:
Next.js
React Router
Waku
@parcel/rsc
@vitejs/plugin-rsc
rwsdk (RedwoodJS)
Vulnerable versions:
19.0.0, 19.0.1, 19.0.2, 19.1.0, 19.1.1, 19.1.2, 19.1.2, 19.2.0, 19.2.1 and 19.2.2
All users should upgrade to the latest patched version in their release line:
npm install next@14.2.35 // for 13.3.x, 13.4.x, 13.5.x, 14.x
npm install next@15.0.7 // for 15.0.x
npm install next@15.1.11 // for 15.1.x
npm install next@15.2.8 // for 15.2.x
npm install next@15.3.8 // for 15.3.x
npm install next@15.4.10 // for 15.4.x
npm install next@15.5.9 // for 15.5.x
npm install next@16.0.10 // for 16.0.x
npm install next@15.6.0-canary.60 // for 15.x canary releases
npm install next@16.1.0-canary.19 // for 16.x canary releases
If you are on version 13.3 or later version of Next.js 13 (13.3.x, 13.4.x, or 13.5.x) please upgrade to version 14.2.35.
If you are on next@14.3.0-canary.77 or a later Canary release, downgrade to the latest stable 14.x release:
npm install next@14
If you are using React Router’s unstable RSC APIs, you should upgrade the following package.json dependencies if they exist:
npm install react@latest
npm install react-dom@latest
npm install react-server-dom-parcel@latest
npm install react-server-dom-webpack@latest
npm install @vitejs/plugin-rsc@latest
The source code exposure vulnerability can leak secrets hardcoded in the source code. Audit any 'use server' functions and ensure you're using environment variables (process.env.SECRET) rather than inline secrets, runtime env vars are not exposed.
If you updated last week for the critical RCE vulnerability, you need to update again
Hosting providers like Vercel have temporary mitigations, but don't rely on them
React Native users only need to update if using these specific RSC packages in a monorepo
Access The Ultimate React Ebooks Collection By Clicking The Image Below👇
Download The Complete Redux Toolkit Ebook Here