'Exploitation is imminent' as 39 percent of cloud environs have max-severity React hole

A maximum-severity flaw in the widely used JavaScript library React, and several React-based frameworks including Next.js allows unauthenticated, remote attackers to execute malicious code on vulnerable instances. The flaw is easy to abuse, and mass exploitation is "imminent," according to security researchers. The React team disclosed the unauthenticated remote code execution (RCE) vulnerability in React Server Components on Wednesday. It's tracked as CVE-2025-55182 and received a maximum 10.0 CVSS severity rating. This is a big deal because much of the internet is built on React – one estimate suggests 39 percent of cloud environments are vulnerable to this flaw. This issue therefore deserves a prominent place on your to-do list. The bug affects versions 19.0, 19.1.0, 19.1.1, and 19.2.0 of: It also affects the default configuration of several React frameworks and bundlers including next, react-router, waku, @parcel/rsc, @vitejs/plugin-rsc, and rwsdk. The project's maintainers say upgrading to versions 19.0.1, 19.1.2, and 19.2.1 fixes the flaw. "We recommend upgrading immediately," the React team said in a Wednesday security advisory. "CVE-2025-55182 represents a major risk to users of one of the world's most widely used web application frameworks," Benjamin Harris, founder and CEO of exposure management tools vendor watchTowr, told The Register. "Exploitation requires few prerequisites [and] there should be no doubt that in-the-wild exploitation is imminent as soon as attac...