Theme

JavaScript

Critical remote-code-execution vulnerability reported in React Server Components and related frameworks

Brievox summary

A critical unauthenticated remote-code-execution vulnerability affects React Server Components; a separate notice also identifies React Server Functions and Next.js. React published fixes in versions 19.0.1, 19.1.2 and 19.2.1, while Deno says it mitigated the issue in Deno Deploy. Other affected users are urged to upgrade immediately.

2 sourcesFirst reported by ReactPublished Updated

Why it matters

Operators using affected React Server Components versions should upgrade immediately to a fixed version; Deno Deploy users are described as protected by mitigations.

Primary source

Critical Security Vulnerability in React Server Components React

What we know

Confirmed by several sources

  • A critical remote-code-execution vulnerability is reported in React server-side functionality, and immediate upgrades are recommended for users who are not protected by mitigations. — Deno, React

Reported by one source

  • The vulnerability is unauthenticated and affects React Server Components; fixes are listed in versions 19.0.1, 19.1.2 and 19.2.1. — React
  • The affected scope includes React Server Functions and Next.js, and Deno Deploy has implemented mitigations. — Deno

Coverage 2 publishers

  1. ReactFirst reportPrimary source

    Critical Security Vulnerability in React Server Components

    There is an unauthenticated remote code execution vulnerability in React Server Components. A fix has been published in versions 19.0.1, 19.1.2, and 19.2.1. We recommend upgrading immediately.

  2. DenoPrimary source

    React Server Functions / Next.js Vulnerability: Deno Deploy users protected

    A critical Remote Code Execution (RCE) vulnerability has been found in React Server Functions and Next.js. Deno has implemented mitigations in Deno Deploy. Immediate upgrades are required for other users.

Earliest report first. Articles stay on their publishers’ sites; each link opens the original.