CVE 10.0 is bonkers for a project this widely used

It's almost like trying to magically wire up your frontend to the backend through magical functions is a bad idea.

The CVE says the that flaw is in React Server Components, which implies strongly that this is a RCE on the backend (!!), not the client.

More detail in the React Blog post here https://react.dev/blog/2025/12/03/critical-security-vulnerab...

From Facebook/Meta: https://www.facebook.com/security/advisories/cve-2025-55182

> A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.

React's own words: https://react.dev/blog/2025/12/03/critical-security-vulnerab...

> React Server Functions allow a client to call a function on a server. React provides integration points and tools that frameworks and bundlers use to help React code run on both the client and the server. React translates requests on the client into HTTP requests which are forwarded to a server. On the server, React translates the HTTP request into a function call and returns the needed data to the client.

> An unauthenticated attacker could craft a malicious HTTP request to any Server Function endpoint that, when deserialized by React, achieves remote code execution on the server. Further details of the vulnerability will be provided after the rollout of the fix is complete.

dupe: https://news.ycombinator.com/item?id=46136067

I suspect the commit to fix is:

https://github.com/facebook/react/commit/bbed0b0ee64b89353a4...

and it looks like its been squashed with some other stuff to hide it or maybe there are other problems as well.

this pattern appears 4 times and looks like it is reducing the functions that are exposed to the 'whitelist'. i presume the modules have dangerous functions in the prototype chain and clients were able to invoke them.

      -  return moduleExports[metadata.name];
      +  if (hasOwnProperty.call(moduleExports, metadata.name)) {
      +    return moduleExports[metadata.name];
      +  }
      +  return (undefined: any);

AHAHAHAHAHA, I'm sorry but we all knew this would happen.

I'm just laughing because I called it when they were in the "random idea x posts" about use server.

They'll fix it, but this was what we were warning about.