CVE-2025-55182: Frequently Asked Questions About React2Shell: React Server Components Remote Code Execution Vulnerability
www.tenable.com
React2Shell: A critical React flaw allowing unauthenticated RCE. Impacts include Next.js, React Router, and apps using Server Components.

I got an email from Vercel urging to upgrade Next.js based project 3 days ago. POC was published 2 days ago. Today I’ve checked my logs and I could already see attack attempts.

  • kungen@feddit.nu
    3·
    20 hours ago

    Now, most people use, or at least are recommended to use, SSR/RSC these days.

    Why though?

    • TehPers@beehaw.orgEnglish
      1·
      11 hours ago

      I’m not the one recommending it lol.

      If I had to guess, it’s to improve page performance by prerendering as much as possible, but I find it overkill and prefer to just prerender as much of the page as I can at build time and do CSR for the rest, though this doesn’t work if you have dynamic routes or some kind of server-side logic (good for blogs and such though).