
- Critical React flaw (CVE-2025-55182) enables pre-auth RCE in React Server Components
- Affects versions 19.0–19.2.0 and frameworks like Next, React Router, Vite; patches released in 19.0.1, 19.1.2, 19.2.1
- Experts warn exploitation is imminent with near 100% success rate; urgent upgrades strongly advised
React is one of the most popular JavaScript libraries, which powers much of today’s internet. Researchers recently discovered a maximum-severity vulnerability. This bug could allow even the low-skilled threat actors to execute malicious code (RCE) on vulnerable instances.