Notifications
Clear all
Topic starter
02/08/2026 12:12 pm
TL;DR: React Server Components in react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack were affected by CVE-2025-55183 and CVE-2025-55184, adding source code exposure and denial-of-service risk after React2Shell, according to Semgrep. Patch reach is uneven because exploitation depends on specific server-component patterns, making dependency review and fix propagation the real control point.
NHIMG editorial — based on content published by Semgrep: React Server Components follow-on vulnerabilities after React2Shell
By the numbers:
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them.
- 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools.
- 79% of organisations have experienced secrets leaks, with 77% of these incidents resulting in tangible damage.
Questions worth separating out
Q: What breaks when React Server Components are not fully patched?
A: Two things can fail at once.
Q: Why do server-component flaws matter for secret governance?
A: Because source-code disclosure can reveal embedded API keys, connection strings, and other non-human identities hidden in code.
Q: How do teams know if a vulnerability is truly exploitable?
A: They validate it in the live environment using safe testing that shows whether an attacker can reach the condition, trigger it, and move beyond it.
Practitioner guidance
- Inventory affected React Server Components dependencies Identify every instance of react-server-dom-parcel, react-server-dom-turbopack, react-server-dom-webpack, and dependent Next.js versions across build and runtime environments, then confirm whether the fixed versions are actually deployed in production and staging.
- Search for secrets in server-component source paths Review server functions and inline code for hardcoded credentials, tokens, and connection strings that could be exposed through stringification or disclosure paths, and rotate any discovered secrets immediately.
- Contain high-risk routes with availability guardrails Apply rate limiting, request throttling, and workload isolation to routes that exercise vulnerable server-component code so a crafted request cannot monopolise CPU across shared services.
What's in the full analysis
Semgrep's full article covers the operational detail this post intentionally leaves for the source:
- Patch mapping across every affected React and Next.js release line, including the exact versions that received fixes.
- Example detection rules for source code disclosure and denial-of-service conditions in Semgrep Supply Chain.
- The concrete preconditions needed for CVE-2025-55183 to expose source material in a server component.
- Version-by-version guidance for identifying whether your application stack still carries the vulnerable dependency chain.
👉 Read Semgrep's analysis of React Server Components source disclosure and DoS risk →
React Server Components flaws: what practitioners need to patch now?
Explore further
02/08/2026 1:15 pm
Follow-on framework flaws matter because patching the headline CVE rarely closes the operational risk. The article shows that adjacent packages can inherit the same trust assumptions after public disclosure, which means security teams need to think in dependency clusters rather than isolated tickets. In practice, the risk is not one vulnerability but the persistence of a shared execution model across multiple packages and release lines.
A few things that frame the scale:
- 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools, according to the Ultimate Guide to NHIs.
- 91.6% of secrets remain valid five days after the targeted organisation is notified, showing a critical gap in remediation procedures.
A question worth separating out:
Q: What should organisations do when framework flaws can expose code and disrupt service?
A: Prioritise dependency inventory, emergency patch validation, and secret rotation in the same remediation flow. When application frameworks can leak code or consume CPU aggressively, containment has to include both code-level fixes and operational guardrails such as throttling, isolation, and secret review.
👉 Read our full editorial: React Server Components flaws widen risk beyond React2Shell
