High-Severity DoS Vulnerability in React Server Components Exposes Web Apps to Attacks A critical vulnerability (CVE-2026-23869) has been identified in React Server Components, enabling unauthenticated remote attackers to launch Denial of Service (DoS) attacks by exhausting backend server resources. The flaw, rated High severity by GitHub’s Security Advisory, requires no user interaction or elevated privileges, making it a significant risk for production environments using affected packages. The attack exploits weaknesses in how React Server Components process data at Server Function endpoints. Malicious HTTP requests trigger two vulnerabilities: - Deserialization of untrusted data (CWE-502), allowing unsafe input processing. - Uncontrolled resource consumption (CWE-400), forcing excessive CPU usage for up to a minute, degrading performance and blocking legitimate users. The vulnerability affects React 19.0, 19.1, and 19.2 branches, specifically these npm packages: - `react-server-dom-parcel` (versions 19.0.0–19.0.4, 19.1.0–19.1.5, 19.2.0–19.2.4) - `react-server-dom-turbopack` (same versions) - `react-server-dom-webpack` (same versions) Not all React apps are vulnerable only those using server-side rendering with affected packages. Client-side-only React applications or those without Server Component support remain unaffected. The React team has released patches in versions 19.0.5, 19.1.6, and 19.2.5, urging developers to upgrade immediately to mitigate the flaw.

CISA Warns of Actively Exploited React Native CLI Vulnerability (CVE-2025-11953) The Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2025-11953, a critical OS command injection vulnerability in the React Native Community Command-Line Interface (CLI), to its Known Exploited Vulnerabilities (KEV) catalog after confirming active exploitation in the wild. The flaw affects the Metro Development Server, a core component of the React Native CLI used for bundling JavaScript during app development. Attackers can exploit the vulnerability by sending crafted POST requests to exposed Metro Server endpoints, enabling arbitrary command execution particularly severe on Windows systems, where it allows full control over development machines or build servers. Due to relaxed security controls in development environments, exposed Metro Servers (e.g., on public Wi-Fi or insecure networks) are prime targets for remote code execution (RCE), making this an attractive entry point for threat actors, including initial access brokers and data exfiltration campaigns. CISA has set a remediation deadline of February 26, 2026, for Federal Civilian Executive Branch (FCEB) agencies, mandating patches or discontinuation of vulnerable versions. The agency advises all organizations to: - Upgrade to the latest patched version of `@react-native-community/cli`. - Restrict access to Metro Servers, avoiding exposure to untrusted networks. - Monitor network logs for suspicious activity on the default Metro port (8081). Exploitation requires no authentication, and successful attacks could lead to privilege escalation or lateral movement within compromised environments. While the vulnerability primarily impacts development systems, its potential for full host compromise underscores the urgency of mitigation.

Critical React flaw (CVE-2025-55182) enables pre-auth RCE in React Server Components Affects versions 19.0–19.2.0 and frameworks like Next, React Router, Vite; patches released in 19.0.1, 19.1.2, 19.2.1 Experts warn exploitation is imminent with near 100% success rate; urgent upgrades strongly advised React is one of the most popular JavaScript libraries, which powers much of today’s internet. Researchers recently discovered a maximum-severity vulnerability. This bug could allow even the low-skilled threat actors to execute malicious code (RCE) on vulnerable instances. Earlier this week, the React team published a new security advisory detailing a pre-authentication bug in multiple versions of multiple packs, affecting React Server Components. The versions that are affected include 19.0, 19.1.0, 19.1.1, and 19.2.0, of react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack. The bug is now tracked as CVE-2025-55182, and was given a severity score of 10/10 (critical). Exploitation imminent - no doubt about it Default configurations of multiple React frameworks and bundlers are also affected by this bug, it was said, including next, react-router, waku, @parcel/rsc, @vitejs/plugin-rsc, and rwsdk. Versions that have addressed the bug are 19.0.1, 19.1.2, and 19.2.1, and React urges all users to apply the fix as soon as possible. "We recommend upgrading immediately," the React team said. According to The Register, React powers almost two in five of