React/Next.js 曝满分RCE漏洞，无需认证即可远程代码执行

近期，聚铭安全攻防实验室监测发现了一项与React Server Components相关的远程代码执行漏洞， 该漏洞已被披露，编号为 CVE-2025-55182，CVSS 评分为 10.0 。 该漏洞主要波及react-server-dom-webpack的Server Actions功能。由于在处理客户端提交的表单数据时，系统未能实施充分的安全性校验，导致攻击者能够通过精心设计的恶意表单请求 ...
腾讯网

Dify v1.11.1修复react重要漏洞，官方建议立即升级

Dify 将前端核心框架 react 和 react-dom 升级到了 19.2.3，并同步更新了 Next.js 的安全补丁。这次修复的是核心依赖库中已知的 CVE ...

React 最高危漏洞曝光，开发者需紧急升级！

在科技的快速发展中，安全问题始终是开发者们无法忽视的隐患。今天凌晨，React团队发布了一则紧急通知，警告用户一个最高危漏洞（CVE-2025-55182）的出现，CVSS评分高达10.0分，标志着这一漏洞的危险程度相当于黑客能轻易在服务器上执行任意代码，简直是开发者的噩梦！
Techzine Europe

Three new vulnerabilities discovered in React Server Components

Following the critical vulnerability CVE-2025-55182 in React Server Components, researchers have found three new leaks. Two ...
CoinDesk

New React bug that can drain all your tokens is impacting 'thousands of' websites

Attackers are using the vulnerability to deploy malware and crypto-mining software, compromising server resources and ...
腾讯网

新型PCPcat恶意软件利用React2Shell漏洞48小时内入侵超5.9万台服务器

新型恶意软件PCPcat通过针对性利用Next.js和React框架中的关键漏洞，在48小时内成功入侵了超过5.9万台服务器。该恶意软件利用两个关键漏洞（CVE-2025-29927和CVE-2025-66478）攻击Next.js部署环境，这些漏洞 ...
TechCentral.ie

State-linked groups target critical vulnerability in React Server Components

Researchers warn that critical vulnerabilities in Meta’s React Server Components and Next.js are under threat from botnets ...
Cybernews

React, Next.js disclose follow-up vulnerabilities, again urge users to patch immediately

React and Next.js are urging developers to immediately patch two additional, follow-up vulnerabilities that were discovered ...

Cloudflare says its WAF is already protecting users from new React security flaws: Here ...

Cloudflare activates automatic WAF protection against a major React Server Components flaw as developers race to patch vulnerable systems worldwide.
Opinion
知乎 on MSNOpinion

一年内连爆两个高危 CVE，我们是否可以认为 React/Next.js 押宝 SSR 是 ...

一年两个高危CVE，React/Next.js的问题不是SSR，是前端被逼着干后端的活 CVE年年有，今年特别多，这不稀奇。什么时候开始一个”前端框架”的漏洞，能造成这么大的攻击面了？ 2015年的React就是个View层的库，Virtual DOM diff一下完事儿。现在你点开Next.js的文档看看，Server Components、Server ...