Holy shit. I'm cooked. Massive security vulnerabilities in react

[Jason Voorhees]

It's like 7 am and I'm sweating after receiving this email. Scouring the internet to find a fix. I never even knew about this and got an email from vercel on one of my deployments informing me about it. Holy shit.

New React RSC Vulnerabilities Enable DoS and Source Code Exposure

React patches three RSC bugs causing DoS and code exposure, urging updates to fixed 19.x releases.

thehackernews.com

React2Shell and related RSC vulnerabilities threat brief- early exploitation activity and threat actor techniques

Early activity indicates that threat actors quickly integrated this vulnerability into their scanning and reconnaissance routines and targeted critical infrastructure including nuclear fuel, uranium and rare earth elements. We outline the tactics they appear to be using and how Cloudflare is...

blog.cloudflare.com

Explanation in this video. This is like 9/11 in terms of security vulnerabilities. Like critical level. Full Infrastructure Compromise. There goes my Sunday fixing this. Have to update everything and abstract everything out

If any of you niggas have it running on react or next.js I suggest you guys to fix it too @Glorious King @topology @HowToBasic

 

[Sprinkles]

my reaction

 

[Mogs Me]

Sorry my nigga I was trying to download a illegal movie and looks like I fucked up your system accidentally

 

[Saint]

It's like 7 am and I'm sweating after receiving this email. Scouring the internet to find a fix. I never even knew about this and got an email from vercel on one of my deployments informing me about it. Holy shit.

View attachment 4421686View attachment 4421683View attachment 4421686

New React RSC Vulnerabilities Enable DoS and Source Code Exposure

React patches three RSC bugs causing DoS and code exposure, urging updates to fixed 19.x releases.

thehackernews.com

React2Shell and related RSC vulnerabilities threat brief- early exploitation activity and threat actor techniques

Early activity indicates that threat actors quickly integrated this vulnerability into their scanning and reconnaissance routines and targeted critical infrastructure including nuclear fuel, uranium and rare earth elements. We outline the tactics they appear to be using and how Cloudflare is...

blog.cloudflare.com

Explanation in this video. This is like 9/11 in terms of security vulnerabilities. Like critical level. Full Infrastructure Compromise. There goes my morning fixing this

View attachment 4421700

If any of you niggas have it running on react or next.js I suggest you guys to fix it too @Glorious King @topology @HowToBasic

It’s over

 

[Jason Voorhees]

my reaction

If the websites running rn was the Washington. We just got hit by a nuke.

 

[topology]

It's like 7 am and I'm sweating after receiving this email. Scouring the internet to find a fix. I never even knew about this and got an email from vercel on one of my deployments informing me about it. Holy shit.

View attachment 4421686View attachment 4421683View attachment 4421686


Explanation in this video. This is like 9/11 in terms of security vulnerabilities. Like critical level. Full Infrastructure Compromise. There goes my morning fixing this

View attachment 4421700

If any of you niggas have it running on react or next.js I suggest you guys to fix it too @Glorious King @topology @HowToBasic

Idk anything about web development the only thing I have running is an api using my local host

 

[sub5mumbaifinalboss]

the video was 100% necessary

 

[Jason Voorhees]

Idk anything about web development the only thing I have running is an api using my local host

Then it isn't a problem. It's only a problem if you have prods running on a public web server using the vulnerable framework like I have

 

[Jason Voorhees]

.

 

[Jason Voorhees]

@Nexom @Swarthy Knight @BeanCelll @takethewhitepill @Lightskin Ethnic

 

[Lightskin Ethnic]

@Nexom @Swarthy Knight @BeanCelll @takethewhitepill @Lightskin Ethnic

Kuch samajh nahi aya lekin aap shayad koi boht badi zimmedari wala kam krte hoge

 

[Nexom]

If any of you niggas have it running on react or next.js I suggest you guys to fix it too

Thanks a lot, appreciate it and noted - good luck!

 

[Swarthy Knight]

"Vercel". Sounds like .org lingo

But I hope you get thru it soon bhai. Wish I was smart enough to understand this

 

[Jason Voorhees]

"Vercel". Sounds like .org lingo

But I hope you get thru it soon bhai. Wish I was smart enough to understand this

It sounds a lot more complicated than it actually is. CVE-2025-55182 starts with CVE means Common vulnerabilities Exposure followed by the year and a random number assigned assigned to that specific vulnerability for the given year. These numbers are assigned by official CNA authority.

Think of the internet like a high security post office, and the React Server Components (RSC) flaw is like a problem with the letter service and scanning.. imagine that due to this vulnerability anyone can blow up the post office because of issue with scanning. It's a true 10 on the CVSS scale(Common Vulnerability Scoring System). Vulnerabilities of this level are extremely rare and are the kind that causes catastrophic damage

 

[Jason Voorhees]

It sounds a lot more complicated than it actually is. CVE-2025-55182 starts with CVE means Common vulnerabilities Exposure followed by the year and a random number assigned assigned to that specific vulnerability for the given year. These numbers are assigned by official CNA authority.

Think of the internet like a high security post office, and the React Server Components (RSC) flaw is like a problem with the letter service and scanning.. imagine that due to this vulnerability anyone can blow up the post office because of issue with scanning. It's a true 10 on the CVSS scale(Common Vulnerability Scoring System). Vulnerabilities of this level are extremely rare and are the kind that causes catastrophic damage

@sub5mumbaifinalboss

 

[sub5mumbaifinalboss]

It sounds a lot more complicated than it actually is. CVE-2025-55182 starts with CVE means Common vulnerabilities Exposure followed by the year and a random number assigned assigned to that specific vulnerability for the given year. These numbers are assigned by official CNA authority.

Think of the internet like a high security post office, and the React Server Components (RSC) flaw is like a problem with the letter service and scanning.. imagine that due to this vulnerability anyone can blow up the post office because of issue with scanning. It's a true 10 on the CVSS scale(Common Vulnerability Scoring System). Vulnerabilities of this level are extremely rare and are the kind that causes catastrophic damage

i think i lowk understand it

 

[Jason Voorhees]

@SplashJuice

 

[SplashJuice]

update the versions, adjust code and deploy again .
im not surprised this was overlooked though web development is really messy, as it gets more complicated there's more potential exploits

 

[Glorious King]

It's like 7 am and I'm sweating after receiving this email. Scouring the internet to find a fix. I never even knew about this and got an email from vercel on one of my deployments informing me about it. Holy shit.

View attachment 4421686View attachment 4421683View attachment 4421686

New React RSC Vulnerabilities Enable DoS and Source Code Exposure

React patches three RSC bugs causing DoS and code exposure, urging updates to fixed 19.x releases.

thehackernews.com

React2Shell and related RSC vulnerabilities threat brief- early exploitation activity and threat actor techniques

Early activity indicates that threat actors quickly integrated this vulnerability into their scanning and reconnaissance routines and targeted critical infrastructure including nuclear fuel, uranium and rare earth elements. We outline the tactics they appear to be using and how Cloudflare is...

blog.cloudflare.com

Explanation in this video. This is like 9/11 in terms of security vulnerabilities. Like critical level. Full Infrastructure Compromise. There goes my Sunday fixing this. Have to update everything and abstract everything out

View attachment 4421700

If any of you niggas have it running on react or next.js I suggest you guys to fix it too @Glorious King @topology @HowToBasic

HOLY FUCKING SHIT

I IGNORED THIS MAIL THINKING IT MUST BE SOME SHIT

NOW IM FUCKED

THANKS FOR RUINING MY WEEKEND

 

[Jason Voorhees]

HOLY FUCKING SHIT

I IGNORED THIS MAIL THINKING IT MUST BE SOME SHIT

View attachment 4421949

NOW IM FUCKED

THANKS FOR RUINING MY WEEKEND

Fix that shit ASAP man. It's very important. CVSS level 10 needs immediate attention

 

[Glorious King]

Fix that shit ASAP man. It's very important. CVSS level 10 needs immediate attention

ALREADY ON IT

FUCK THOSE DEVELOPERS

 

[slaters]