Two additional vulnerabilities in React Server Components have been identified: a high-severity Denial of Service (CVE-2025-55184) and a medium-severity Source Code Exposure (CVE-2025-55183). These issues were discovered while security researchers examined the patches for the original React2Shell vulnerability.
Importantly, neither of these new issues allow for Remote Code Execution. The patch for React2Shell remains fully effective.
We created new rules to address these vulnerabilities and deployed them to the Vercel WAF to automatically protect all projects hosted on Vercel at no cost. However, do not rely on the WAF for full protection. Immediate upgrades to a patched version are required.
Fixed in
-
**React: **
19.0.2,19.1.3,19.2.2. -
**Next.js: **
14.2.34,15.0.6,15.1.10,15.2.7,15.3.7,15.4.9,15.5.8,15.6.0-canary.59,16.0.9,16.1.0-canary.18.
Frameworks and bundlers using the aforementioned packages should install the latest versions provided by their respective maintainers.
Read the full changelog:
https://vercel.com/changelog/react-server-components-security-update-dos-and-source-code-exposure