React CVE score 10.0!

[posta246]

Is NPM impacted?!?!
https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components

[onelots]

I wonder as well

[magicmayu]

I recieved cloud provider's warning mail.
I think the problem is from NPM

[pollocluck]

Latest version of NPM is using Next Server 15.5.4 and according to this Reddit post, 15.5.7 has the fix. I am killing my NPM container for the time being until a quick fix is released on the NPM side.

Edit: taking a second glance it was paperlessngx with this issue. I apologize for misleading you all.

[sopex]

Latest version of NPM is using Next Server 15.5.4 and according to this Reddit post, 15.5.7 has the fix. I am killing my NPM container for the time being until a quick fix is released on the NPM side.

Where do you see 15.5.4 ??

[posta246]

Is there an easy way to replace the affected lib?

[posta246]

Hope jc21 is ok and can fix it as soon as he can.

[posta246]

apparently yes it is, from package.json it is using react ^19.2.0 which is vulnerable I believe rebuilding their image could be enough since they are using ^19.2.0 (depending on the dockerfile and the CI)

I dont understand if react is used client side or server side. The cve refers to this second case.

[pollocluck]

Latest version of NPM is using Next Server 15.5.4 and according to this Reddit post, 15.5.7 has the fix. I am killing my NPM container for the time being until a quick fix is released on the NPM side.

Where do you see 15.5.4 ??

Whoops, you are right. I updated my response to reflect that.

[sopex]

Someone actually providing proof that any of the affected packages are used...?

[ViNoS-ab]

apparently yes it is, from package.json it is using react ^19.2.0 which is vulnerable I believe rebuilding their image could be enough since they are using ^19.2.0 (depending on the dockerfile and the CI)

I dont understand if react is used client side or server side. The cve refers to this second case.

oh, yeah you are right
totally missed that part sorry

[ViNoS-ab]

it is just statically built and served by nginx

[Ed1ks]

Isn’t it only the server that’s affected when the following packages are involved?

• react-server-dom-webpack
• react-server-dom-parcel
• react-server-dom-turbopack

The package.json of NPM does not have any of these.

[krutoileshii]

Affected frameworks and bundlers
Some React frameworks and bundlers depended on, had peer dependencies for, or included the vulnerable React packages. The following React frameworks & bundlers are affected: next, react-router, waku, @parcel/rsc, @vitejs/plugin-rsc, and rwsdk.

pretty sure react router is a dependency as well

[apateluk]

Anyone know if NPM is affected or not ?

[Ed1ks]

react router is a dependency but npm does not use rsc mode as much as I can see.