react-CVE-2025-55182-fixer

React Server Components セキュリティ PR 自動化 このリポジトリは、CVE-2025-55182 の影響を受けるリポジトリに対して、脆弱なバージョンのreact-server-dom- および関連する React パッケージを自動的にアップグレードし、プルリクエスト PR を作成するスクリプトを提供します。 このツールの機能 リポジトリの package.json から影響を受ける react-server-dom-、react、react-dom、next のバージョンをスキャンします。 必要に応じて、それらを安全で修正済みのバージョンにアップグレードします。...

React-site-CVE-2025-55182

React Site - CVE-2025-55182 README: Уязвимый Next.js проект React RSC лендинг Это репозиторий с примером многостраничного корпоративного лендинга на Next.js 15.0.0 + React 19.0.0. Сайт имитирует структуру вроде t1.ru: главная, продукты, кейсы, медиа, о компании, контакты. Используем React Server...

CVE-2025-55182

CVE-2025-55182 易受攻击的应用程序 构建并运行： docker compose build docker compose run --rm --entrypoint 'npm install' node docker compose run --rm --entrypoint 'npm run build' node docker compose up POC（来自 https://github.com/msanft/CVE-2025-55182）： node poc.js 实验（使用 unbundled）： yarn --immutable node --conditio...

React2Shell_cve-2025-55182

React Server Components RCE - CVE-2025-55182 你好！希望你今天过得愉快！😊✨ 这是什么？ React Server Components 版本 19.0.0 、19.1.0 、19.1.1 和 19.2.0 存在一个严重的安全问题。受影响的包包括 react-server-dom-parcel、react-server-dom-turbopack 和 react-server-dom-webpack。 问题在于服务器以不安全的方式读取请求中的数据。攻击者可以发送特殊数据，从而在服务器上执行他们的命令。 概念验证 - 完整攻击示例...

cve-2025-55182-checker

CVE-2025-55182 チェッカー React Server DOM および Next.js パッケージの脆弱性バージョンを検出するポータブルな Bash スクリプトです。CVE-2025-55182 の影響を受けます。 特徴 プロジェクト内のすべての package.json ファイルを再帰的にスキャンします。 以下の脆弱性のあるバージョンを検出します: react-server-dom- 19.0.0, 19.1.0, 19.1.1, 19.2.0 next =15.0.4, =15.1.8, =15.2.5, =15.3.5, =15.4.7, =15.5.6, =16.0....

React2Shell_Rce-cve-2025-55182

React Server Components RCE – README 你好，真心希望你屏幕前一切都好！😊✨ 描述 React Server Components 版本 19.0.0 、19.1.0 、19.1.1 和 19.2.0 ，包括 react-server-dom-parcel、react-server-dom-turbopack 和 react-server-dom-webpack，存在一个远程代码执行漏洞。 该问题由对发送到 Server Function 端点的攻击者控制载荷进行不安全反序列化 触发。 PoC – 完整请求（已脱敏） 以下是展示该漏洞的完整 HTTP 请...

React2Shell-CVE-2025-55182

🎯 React2Shell（CVE-2025-55182）：React Server Componentsから完全なRCEへ 難易度：中級 → 上級 カテゴリ：Web Exploitation | Deserialization | RCE 🧩 タスク1：はじめに — React2Shellがなぜ重大な問題なのか CVE-2025-55182は、React2Shell というあだ名で知られ、防御側を即座に不安にさせる脆弱性のひとつです😬。2025年12月 に発見され、CVSSスコア10.0 を記録しています。これは、単なるエッジケースのバグではないことを既に示しています。...

K000163005: react-server-dom vulnerability CVE-2026-23870

Security Advisory Description A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to server crashes, out-of-memory exceptions or excessive CPU usage; affecting the following packages: react-server-dom-webpac...

NPM: react-server-dom: Denial of Service in Server Functions

NPM: react-server-dom: Denial of Service in Server Functions vulnerability discovered by ? in WordPress Npm react-server-dom-turbopack versions = 19.0.0, 19.0.8...

NPM: react-server-dom: Denial of Service in Server Functions

NPM: react-server-dom: Denial of Service in Server Functions vulnerability discovered by ? in WordPress Npm react-server-dom-webpack versions = 19.0.0, 19.0.8...

react-server-dom: Denial of Service in Server Functions

Impact A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to out-of-memory exceptions or excessive CPU usage. We recommend updating immediately. The vulnerability exists in versions 19.0.0 through 19.0.7,...

@amazeelabs/bridge-waku (>=1.1.0, <=2.0.1), @amazeelabs/executors (>=3.0.0, <=3.1.14) +52 more potentially affected by CVE-2026-44907 via react-server-dom-webpack (>=19.0.0, <=19.0.1)

react-server-dom-webpack NPM version =19.0.0, =1.1.0, =3.0.0, =1.1.0, =1.1.0, =1.0.0-canary.12245, =0.9.1-next.19, =1.0.0-canary.12245, =0.9.1-next.19, =1.0.0-canary.12245, =1.0.0-canary.12245, =1.0.0-canary.12245, =0.9.1-next.19, =1.0.0-canary.12245, =1.0.0-canary.12245, =0.0.4, =2.0.3-next.0 an...

NPM: react-server-dom: Denial of Service in Server Functions

NPM: react-server-dom: Denial of Service in Server Functions vulnerability discovered by ? in WordPress Npm react-server-dom-parcel versions = 19.1.0, 19.1.9...

@amazeelabs/bridge-waku (>=1.1.0, <=2.0.1), @amazeelabs/executors (>=3.0.0, <=3.1.14) +52 more potentially affected by CVE-2026-44907 via react-server-dom-webpack (>=19.0.0, <=19.0.1)

react-server-dom-webpack NPM version =19.0.0, =1.1.0, =3.0.0, =1.1.0, =1.1.0, =1.0.0-canary.12245, =0.9.1-next.19, =1.0.0-canary.12245, =0.9.1-next.19, =1.0.0-canary.12245, =1.0.0-canary.12245, =1.0.0-canary.12245, =0.9.1-next.19, =1.0.0-canary.12245, =1.0.0-canary.12245, =0.0.4, =2.0.3-next.0 an...

EUVD-2026-46307

react-server-dom: Denial of Service in Server Functions...

GHSA-WX67-QW84-CM4G react-server-dom: Denial of Service in Server Functions

Impact A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to out-of-memory exceptions or excessive CPU usage. We recommend updating immediately. The vulnerability exists in versions 19.0.0 through 19.0.7,...

CVE-2026-44907

A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to excessive CPU usage; affecting the following packages: react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack versions 19.0.0...

CVE-2026-44907

A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to excessive CPU usage; affecting the following packages: react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack versions 19.0.0...

CVE-2026-44907: Undefined Security Weakness

A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to excessive CPU usage; affecting the following packages: react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack versions 19.0.0...

CVE-2026-23870

A flaw was found in the React Server DOM components, including react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack. A remote attacker could exploit this denial of service DoS vulnerability by sending specially crafted HTTP requests to server function endpoints. This...