{"id":329246,"date":"2025-12-04T03:29:08","date_gmt":"2025-12-04T03:29:08","guid":{"rendered":"https:\/\/www.newsbeep.com\/us\/329246\/"},"modified":"2025-12-04T03:29:08","modified_gmt":"2025-12-04T03:29:08","slug":"admins-and-defenders-gird-themselves-against-maximum-severity-server-vuln","status":"publish","type":"post","link":"https:\/\/www.newsbeep.com\/us\/329246\/","title":{"rendered":"Admins and defenders gird themselves against maximum-severity server vuln"},"content":{"rendered":"<p>\u201cI usually don\u2019t say this, but patch right freakin\u2019 now,\u201d one researcher <a href=\"https:\/\/infosec.exchange\/@mttaggart\/115656660264185977\" rel=\"nofollow noopener\" target=\"_blank\">wrote<\/a>. \u201cThe React CVE listing (CVE-2025-55182) is a perfect 10.\u201d<\/p>\n<p>React versions 19.0.1, 19.1.2, or 19.2.1 contain the vulnerable code. Third-party components known to be affected include:<\/p>\n<p>Vite RSC plugin<br \/>\nParcel RSC plugin<br \/>\nReact Router RSC preview<br \/>\nRedwoodSDK<br \/>\nWaku<br \/>\nNext.js<\/p>\n<p>According to Wiz and fellow security firm <a href=\"https:\/\/www.aikido.dev\/blog\/react-nextjs-cve-2025-55182-rce\" rel=\"nofollow noopener\" target=\"_blank\">Aikido,<\/a> the vulnerability, tracked as CVE-2025-55182, resides in Flight, a protocol found in the React Server Components. Next.js has assigned the designation CVE-2025-66478 to track the vulnerability in its package.<\/p>\n<p>The vulnerability stems from unsafe deserialization, the coding process of converting strings, byte streams, and other \u201cserialized\u201d formats into objects or data structures in code. Hackers can exploit the insecure deserialization using payloads that execute malicious code on the server. Patched React versions include stricter validation and hardened deserialization behavior.<\/p>\n<p>\u201cWhen a server receives a specially crafted, malformed payload, it fails to validate the structure correctly,\u201d Wiz explained. \u201cThis allows attacker-controlled data to influence server-side execution logic, resulting in the execution of privileged JavaScript code.\u201d<\/p>\n<p>The company added:<\/p>\n<p>In our experimentation, exploitation of this vulnerability had high fidelity, with a near 100% success rate and can be leveraged to a full remote code execution. The attack vector is unauthenticated and remote, requiring only a specially crafted HTTP request to the target server. It affects the default configuration of popular frameworks.<\/p>\n<p>Both companies are advising admins and developers to upgrade React and any dependencies that rely on it. Users of any of the Remote-enabled frameworks and plugins mentioned above should check with the maintainers for guidance. Aikido also suggests admins and developers scan their codebases and repositories for any use of React using <a href=\"https:\/\/app.aikido.dev\/login?_gl=1*1czpwpg*_gcl_au*ODIxNjcwMTU2LjE3NjQ3ODg2NTI.*FPAU*NjIzODM2OTQ3LjE3NjQ3ODg2NTI.*_ga*ODgyNTA0MzYyLjE3NjQ3ODg2NTI.*_ga_NCP2435BFQ*czE3NjQ3ODg2NTIkbzEkZzEkdDE3NjQ3ODkwMTAkajYwJGwwJGgxNzMyMDM0NjIw\" rel=\"nofollow noopener\" target=\"_blank\">this<\/a> link.<\/p>\n","protected":false},"excerpt":{"rendered":"\u201cI usually don\u2019t say this, but patch right freakin\u2019 now,\u201d one researcher wrote. \u201cThe React CVE listing (CVE-2025-55182)&hellip;\n","protected":false},"author":2,"featured_media":329247,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[31],"tags":[74],"class_list":["post-329246","post","type-post","status-publish","format-standard","has-post-thumbnail","category-technology","tag-technology"],"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/posts\/329246","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/comments?post=329246"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/posts\/329246\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/media\/329247"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/media?parent=329246"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/categories?post=329246"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/tags?post=329246"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}