Critical React Flaw Triggers Calls for Immediate Action

A maximum-severity vulnerability in the React open source library could enable remote code execution across a large number of cloud environments. The flaw was disclosed with two CVEs: CVE-2025-55182 in the React Server Components protocol and CVE-2025-66478 affecting the downstream Next.js framework, each carrying a maximum CVSS score of 10.

According to Wiz, exploitation is highly feasible with a near 100% success rate in their testing, using unauthenticated, remote HTTP requests to targeted servers due to unsafe deserialization. The researchers say the vulnerability affects the default configuration of popular frameworks, and Wiz urged immediate action in a Wednesday blog post.

The advisory notes 39% of cloud environments are vulnerable to either CVE, and Cloudflare has implemented new WAF rules to automatically prevent exploitation for React traffic proxied through its service. Organizations should upgrade to React versions 19.0.1, 19.1.2, and 19.2.1, and Next.js versions 15.0.5 to 16.0.7, with the caveat that apps not using a server or a supporting framework may not be affected.