--- title: React Server Components, One Year After React2Shell: The... description: React Server Components have had a rough year of security patches since the critical 'React2Shell' flaw, CVE-2025-55182, which scored a maximum CVSS of 10.0... canonical: https://daily.dev/posts/react-server-components-one-year-after-react2shell-the-patch-you-probably-missed-and-how-to-harden-nkgadmxwv twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: React Server Components, One Year After React2Shell: The Patch You Probably Missed and How to Harden Your App | daily.dev og:description: React Server Components have had a rough year of security patches since the critical 'React2Shell' flaw, CVE-2025-55182, which scored a maximum CVSS of 10.0... og:url: https://daily.dev/posts/react-server-components-one-year-after-react2shell-the-patch-you-probably-missed-and-how-to-harden-nkgadmxwv og:image: https://api.daily.dev/og/posts/NKGaDmxwv.png og:image:alt: React Server Components, One Year After React2Shell: The Patch You Probably Missed and How to Harden Your App og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # React Server Components, One Year After React2Shell: The Patch You Probably Missed and How to Harden Your App **[Medium](https://daily.dev/sources/medium_js)** · 6 min read · 2 upvotes · 1 comments ## Summary React Server Components have had a rough year of security patches since the critical 'React2Shell' flaw, CVE-2025-55182, which scored a maximum CVSS of 10.0 for unauthenticated remote code execution. More issues followed: a source code exposure bug and a denial-of-service bug in December 2025, then further denial-of-service CVEs 2026-23869 and 2026-23870 rated 7.5, and on October 14, 2026 React shipped patches 19.3.1, 19.2.9, 19.1.10, and 19.0.9 across every React 19 line. Next.js ships its own copy of the RSC packages, so updating react and react-dom alone won't patch it; Next.js itself must be updated. Next.js 15 reached end of life on October 21, 2026. Recommended hardening includes treating Server Actions as public endpoints, validating input, rate limiting, and monitoring CPU and memory. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What was the React2Shell vulnerability, CVE-2025-55182? React2Shell was a flaw in how React decoded Flight payloads sent to React Server Components endpoints, letting an attacker send a specially crafted HTTP request to run code on the server without logging in. It scored the maximum CVSS of 10.0, worked in default configurations, and affected react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack, impacting Next.js, React Router, Waku, and other RSC frameworks. _Teams hardening RSC apps against future advisories can track patch history like this on daily.dev._ ### Does updating the react and react-dom npm packages patch Next.js against RSC vulnerabilities? No, updating react and react-dom alone does not patch Next.js. Next.js ships its own copy of the React Server Components packages, so you must update Next.js itself to a release containing the latest fixes, then redeploy for the fix to take effect. _Developers untangling framework-bundled dependencies can keep upgrade gotchas like this on their radar via daily.dev._ ### What denial-of-service bugs were found in React Server Components after the initial React2Shell patch? Two follow-up denial-of-service vulnerabilities, CVE-2026-23869 and CVE-2026-23870, both rated 7.5, let crafted requests to Server Function endpoints cause excessive CPU use, out-of-memory errors, or server crashes. The second was found in the very versions released to fix the first, and for Next.js apps using Server Actions a single crafted POST request could freeze the server. _Anyone patching RSC-based apps can follow unfolding CVEs like these on daily.dev to avoid repeat exposure._ ## Community discussion Top comments from developers on daily.dev. **@dodolaunch** · 0 upvotes > Good reminder that Next.js bundles its own copy of the RSC packages, so bumping react and react-dom alone doesn't close the hole. I'd guess a lot of teams miss that when they only check their package.json. Do you know if there's a simple way to verify which RSC version a deployed Next.js app is actually running? ## Similar posts on daily.dev - [Critical RSC Bugs in React and Next.js Allow Unauthenticated Remote Code Execution](https://daily.dev/posts/critical-rsc-bugs-in-react-and-next-js-allow-unauthenticated-remote-code-execution-rzvbskftj) · The Hacker News · 0 upvotes · 0 comments - [React2Shell: Anatomy of a max-severity flaw that sent shockwaves through the web](https://daily.dev/posts/react2shell-anatomy-of-a-max-severity-flaw-that-sent-shockwaves-through-the-web-6dlrkicmf) · InfoWorld · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#react](https://daily.dev/tags/react), [#nextjs](https://daily.dev/tags/nextjs), [#web-security](https://daily.dev/tags/web-security) [View this post on daily.dev](https://daily.dev/posts/react-server-components-one-year-after-react2shell-the-patch-you-probably-missed-and-how-to-harden-nkgadmxwv) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"React Server Components, One Year After React2Shell: The Patch You Probably Missed and How to Harden Your App","url":"https://daily.dev/posts/react-server-components-one-year-after-react2shell-the-patch-you-probably-missed-and-how-to-harden-nkgadmxwv","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/react-server-components-one-year-after-react2shell-the-patch-you-probably-missed-and-how-to-harden-nkgadmxwv"},"datePublished":"2026-11-01T03:18:53.501Z","dateModified":"2026-11-01T03:19:44.639Z","description":"React Server Components have had a rough year of security patches since the critical 'React2Shell' flaw, CVE-2025-55182, which scored a maximum CVSS of 10.0...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/339a2bcfa2c30710f58ea7d1390c1a0c?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/339a2bcfa2c30710f58ea7d1390c1a0c?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Medium","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Medium","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/medium","url":"https://daily.dev/sources/medium_js"},"commentCount":1,"discussionUrl":"https://daily.dev/posts/react-server-components-one-year-after-react2shell-the-patch-you-probably-missed-and-how-to-harden-nkgadmxwv","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":2},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":1}],"keywords":"security,react,nextjs,web-security","timeRequired":"PT6M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Medium","item":"https://daily.dev/sources/medium_js"},{"@type":"ListItem","position":3,"name":"React Server Components, One Year After React2Shell: The Patch You Probably Missed and How to Harden Your App"}]} {"@context":"https://schema.org","@type":"WebPage","@id":"https://daily.dev/posts/react-server-components-one-year-after-react2shell-the-patch-you-probably-missed-and-how-to-harden-nkgadmxwv","comment":[{"@type":"Comment","text":"Good reminder that Next.js bundles its own copy of the RSC packages, so bumping react and react-dom alone doesn’t close the hole. I’d guess a lot of teams miss that when they only check their package.json. Do you know if there’s a simple way to verify which RSC version a deployed Next.js app is actually running?","datePublished":"2026-11-02T12:36:34.787Z","url":"https://daily.dev/posts/NKGaDmxwv#c-IizQwuia8","author":{"@type":"Person","name":"Almas Malik","url":"https://daily.dev/dodolaunch","image":"https://media.daily.dev/image/upload/s--U1QL6K2x--/f_auto,pg_1/v1793362044/avatars/avatar_sz1N8EZitdQ0K1a2CfLyN?_a=BAMAMiiw0"}}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/react-server-components-one-year-after-react2shell-the-patch-you-probably-missed-and-how-to-harden-nkgadmxwv#faq","mainEntity":[{"@type":"Question","name":"What was the React2Shell vulnerability, CVE-2025-55182?","acceptedAnswer":{"@type":"Answer","text":"React2Shell was a flaw in how React decoded Flight payloads sent to React Server Components endpoints, letting an attacker send a specially crafted HTTP request to run code on the server without logging in. It scored the maximum CVSS of 10.0, worked in default configurations, and affected react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack, impacting Next.js, React Router, Waku, and other RSC frameworks. Teams hardening RSC apps against future advisories can track patch history like this on daily.dev."}},{"@type":"Question","name":"Does updating the react and react-dom npm packages patch Next.js against RSC vulnerabilities?","acceptedAnswer":{"@type":"Answer","text":"No, updating react and react-dom alone does not patch Next.js. Next.js ships its own copy of the React Server Components packages, so you must update Next.js itself to a release containing the latest fixes, then redeploy for the fix to take effect. Developers untangling framework-bundled dependencies can keep upgrade gotchas like this on their radar via daily.dev."}},{"@type":"Question","name":"What denial-of-service bugs were found in React Server Components after the initial React2Shell patch?","acceptedAnswer":{"@type":"Answer","text":"Two follow-up denial-of-service vulnerabilities, CVE-2026-23869 and CVE-2026-23870, both rated 7.5, let crafted requests to Server Function endpoints cause excessive CPU use, out-of-memory errors, or server crashes. The second was found in the very versions released to fix the first, and for Next.js apps using Server Actions a single crafted POST request could freeze the server. Anyone patching RSC-based apps can follow unfolding CVEs like these on daily.dev to avoid repeat exposure."}}]} ```