Notifications
Clear all
Topic starter
02/08/2026 12:14 pm
TL;DR: A remote code execution flaw in React Server Functions, tracked as CVE-2025-55182, affects multiple downstream frameworks including Next, React Router, Waku, Parcel RSC, Vite RSC, and RedwoodJS, according to Semgrep’s advisory summary of the React team disclosure. The exposure is especially relevant where organisations rely on transitive dependencies and assume framework-level isolation protects server-side execution paths.
NHIMG editorial — based on content published by Semgrep: React Server Functions RCE disclosure and affected downstream frameworks
By the numbers:
- A second CVE-2025-66478 had been submitted specifically for the Next dependency.
Questions worth separating out
Q: What should teams do first when a framework RCE flaw exposes server-side application code?
A: Start by identifying which workloads expose the vulnerable endpoint, then patch the affected framework versions and isolate any public assets that may already have been touched.
Q: Why do transitive dependencies make framework vulnerabilities harder to manage?
A: Because the application team may not directly install the vulnerable package, yet still inherit the same execution path through another framework.
Q: What breaks when organisations rely on firewall rules instead of patching?
A: Firewall rules can block known exploit paths, but they do not remove the vulnerable code or the residual risk on other environments.
Practitioner guidance
- Inventory direct and transitive framework exposure Build a dependency inventory that includes direct packages, bundled components, and transitive server-component frameworks such as Next-related and RSC-enabled libraries.
- Patch affected packages on a verified rollout path Move impacted applications to the patched versions identified in the disclosure, then verify the change in build output and deployed artefacts rather than assuming the package manager update propagated everywhere.
- Review runtime credentials on exposed application hosts Check whether the affected runtimes can reach service account tokens, API keys, signing certificates, or cloud metadata.
What's in the full analysis
Semgrep's full advisory covers the operational detail this post intentionally leaves for the source:
- Exact affected package ranges for Next, react-server-dom-* variants, and downstream frameworks.
- React's update instructions and the precise patched versions teams should deploy.
- Hosting-provider firewall context for Cloudflare, Vercel, and Railway deployments.
- Usage patterns for React Server Components that can be abused in practice.
👉 Read Semgrep's analysis of the React Server Functions RCE and affected frameworks →
React Server Functions RCE: are your downstream frameworks exposed?
Explore further
02/08/2026 1:16 pm
Execution-path risk now matters as much as package risk: this disclosure shows that application security teams can no longer treat framework dependencies as passive libraries. When a server component accepts attacker-influenced payloads, the dependency itself becomes an execution surface. That means exposure management must extend beyond version tracking to runtime behaviour, route reachability, and privilege on the host. The practical conclusion is that software composition analysis alone is not enough without execution-path verification.
A few things that frame the scale:
- 64% of valid secrets leaked in 2022 are still valid and exploitable today, according to The State of Secrets Sprawl 2026.
- 28.65 million new hardcoded secrets were detected in public GitHub commits in 2025 alone, a 34% year-over-year increase and the largest single-year jump ever recorded.
A question worth separating out:
Q: How should teams reduce identity risk after application code execution exposure?
A: Assume any reachable secrets may be exposed and rotate them in priority order, starting with service account tokens, API keys, and signing certificates. Then narrow runtime privileges so the compromised process cannot reach broader cloud or internal services if exploitation occurs again.
👉 Read our full editorial: React Server Functions RCE exposes downstream frameworks to attack
