React CVE score 10.0!

[posta246]

Is NPM impacted?!?! https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components

[onelots]

I wonder as well

[magicmayu]

I recieved cloud provider's warning mail. I think the problem is from NPM

[pollocluck]

Latest version of NPM is using Next Server 15.5.4 and according to this Reddit post, 15.5.7 has the fix. I am killing my NPM container for the time being until a quick fix is released on the NPM side.

Edit: taking a second glance it was paperlessngx with this issue. I apologize for misleading you all.

[sopex]

Latest version of NPM is using Next Server 15.5.4 and according to this Reddit post, 15.5.7 has the fix. I am killing my NPM container for the time being until a quick fix is released on the NPM side.

Where do you see 15.5.4 ??

[posta246]

Is there an easy way to replace the affected lib?

[posta246]

Hope jc21 is ok and can fix it as soon as he can.

[posta246]

apparently yes it is, from package.json it is using react ^19.2.0 which is vulnerable I believe rebuilding their image could be enough since they are using ^19.2.0 (depending on the dockerfile and the CI)

I dont understand if react is used client side or server side. The cve refers to this second case.

[pollocluck]

Latest version of NPM is using Next Server 15.5.4 and according to this Reddit post, 15.5.7 has the fix. I am killing my NPM container for the time being until a quick fix is released on the NPM side.

Where do you see 15.5.4 ??

Whoops, you are right. I updated my response to reflect that.

[sopex]

Someone actually providing proof that any of the affected packages are used...?

[ViNoS-ab]

apparently yes it is, from package.json it is using react ^19.2.0 which is vulnerable I believe rebuilding their image could be enough since they are using ^19.2.0 (depending on the dockerfile and the CI)

I dont understand if react is used client side or server side. The cve refers to this second case.

oh, yeah you are right totally missed that part sorry

[ViNoS-ab]

it is just statically built and served by nginx

[Ed1ks]

Isn’t it only the server that’s affected when the following packages are involved?

• react-server-dom-webpack
• react-server-dom-parcel
• react-server-dom-turbopack

The package.json of NPM does not have any of these.

[krutoileshii]

Affected frameworks and bundlers Some React frameworks and bundlers depended on, had peer dependencies for, or included the vulnerable React packages. The following React frameworks & bundlers are affected: next, react-router, waku, @parcel/rsc, @vitejs/plugin-rsc, and rwsdk.

pretty sure react router is a dependency as well

[apateluk]

Anyone know if NPM is affected or not ?

[Ed1ks]

react router is a dependency but npm does not use rsc mode as much as I can see.

[ViNoS-ab]

Anyone know if NPM is affected or not ?

I believe it's not : this is the build script

and this is how it is served via nginx

so it is fully client side, the JS script runs only on the client side, so no react server components are being used

[Ed1ks]

The Maintainer should still update npm asap. If Affected or probably not is too high risk if the fix is just an update of some deps.

[krutoileshii]

anyone want to slap a PR for this?

[krutoileshii]

New CVEs dropped

https://react.dev/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components