编译 | Tina、冬梅上周刚追完 10 级补丁，以为能喘口气了？还不行。12 月 12 日，React 官方确认，研究人员在验证上周补丁时，竟又在 React Server ...

A newly discovered security flaw in the React ecosystem — one of the most widely used technologies on the web — is prompting ...

React and Next.js are urging developers to immediately patch two additional, follow-up vulnerabilities that were discovered ...

Dify 将前端核心框架 react 和 react-dom 升级到了 19.2.3，并同步更新了 Next.js 的安全补丁。这次修复的是核心依赖库中已知的 CVE ...

一年两个高危CVE，React/Next.js的问题不是SSR，是前端被逼着干后端的活 CVE年年有，今年特别多，这不稀奇。什么时候开始一个”前端框架”的漏洞，能造成这么大的攻击面了？ 2015年的React就是个View层的库，Virtual DOM diff一下完事儿。现在你点开Next.js的文档看看，Server Components、Server ...

吴说获悉，慢雾首席信息安全官 23pds 发推表示，鉴于 React/Next.js 最新远程代码执行漏洞已出现新的攻击链，相关攻击成功率将显著提升。由于目前大量 DeFi 平台使用 React，该漏洞可能影响范围广泛，各 DeFi 平台需防范相关安全风险。

Critical React vulnerability tracked as CVE-2025-55182 and React2Shell can be exploited for unauthenticated remote code execution.

As reported by Cybernews, the React vulnerability, which enables external attackers to run privileged, arbitrary code on ...

React vulnerability CVE-2025-55182 exploited by crypto-drainers to execute remote code and steal funds from affected websites ...

Learn the key concepts behind React and how to use JSX elements and components to build lean and fast web front ends React, also known as ReactJS, is an open source JavaScript library for building ...