{"id":417,"date":"2025-12-15T19:06:48","date_gmt":"2025-12-16T02:06:48","guid":{"rendered":"https:\/\/www.businesstechnologyassociates.com\/blog\/?p=417"},"modified":"2025-12-15T19:06:48","modified_gmt":"2025-12-16T02:06:48","slug":"big-bad-bug","status":"publish","type":"post","link":"https:\/\/www.businesstechnologyassociates.com\/blog\/2025\/12\/big-bad-bug\/","title":{"rendered":"Big Bad Bug!"},"content":{"rendered":"<p>A really serious bug exists in the <a href=\"https:\/\/en.wikipedia.org\/wiki\/React_(software)\" target=\"_blank\" rel=\"noopener\">React<\/a> Server Components, a popular JavaScript library and the <a href=\"https:\/\/en.wikipedia.org\/wiki\/Next.js\" target=\"_blank\" rel=\"noopener\">Next.js framework<\/a> that has reached a imperfect\u00a0 CVSS score of 10.0!<\/p>\n<p><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2025-55182\" target=\"_blank\" rel=\"noopener\">CVE-2025-55182<\/a> is a critical remote code execution vulnerability in React Server Components that allows attackers to execute arbitrary code without authentication by exploiting improper input deserialization. This vulnerability has been actively exploited in the wild, particularly targeting applications using the Next.js framework.<\/p>\n<p>This vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.<\/p>\n<p><strong>Anyone using these components on their web server should upgrade the packages immediately! <\/strong>The libraries are often included in other projects, so you need to search requirements or include files.\u00a0 On Linux systems, you can use the following commands to search for their inclusion:<\/p>\n<pre>find ~\/project -name 'package.json' -type f -exec grep -Hin 'react' {} \\;\r\n# or\r\nfind ~\/project -name 'package.json' -type f -exec grep -Hin 'node.js' {} \\;<\/pre>\n","protected":false},"excerpt":{"rendered":"<p>A really serious bug exists in the React Server Components, a popular JavaScript library and the Next.js framework that has reached a imperfect\u00a0 CVSS score of 10.0! CVE-2025-55182 is a critical remote code execution vulnerability in React Server Components that allows attackers to execute arbitrary code without authentication by exploiting improper input deserialization. This vulnerability &hellip; <\/p>\n<p class=\"link-more\"><a href=\"https:\/\/www.businesstechnologyassociates.com\/blog\/2025\/12\/big-bad-bug\/\" class=\"more-link\">Continue reading<span class=\"screen-reader-text\"> &#8220;Big Bad Bug!&#8221;<\/span><\/a><\/p>\n","protected":false},"author":2,"featured_media":419,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5,17,3],"tags":[],"class_list":["post-417","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-internet","category-security","category-technology"],"_links":{"self":[{"href":"https:\/\/www.businesstechnologyassociates.com\/blog\/wp-json\/wp\/v2\/posts\/417","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.businesstechnologyassociates.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.businesstechnologyassociates.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.businesstechnologyassociates.com\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.businesstechnologyassociates.com\/blog\/wp-json\/wp\/v2\/comments?post=417"}],"version-history":[{"count":6,"href":"https:\/\/www.businesstechnologyassociates.com\/blog\/wp-json\/wp\/v2\/posts\/417\/revisions"}],"predecessor-version":[{"id":424,"href":"https:\/\/www.businesstechnologyassociates.com\/blog\/wp-json\/wp\/v2\/posts\/417\/revisions\/424"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.businesstechnologyassociates.com\/blog\/wp-json\/wp\/v2\/media\/419"}],"wp:attachment":[{"href":"https:\/\/www.businesstechnologyassociates.com\/blog\/wp-json\/wp\/v2\/media?parent=417"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.businesstechnologyassociates.com\/blog\/wp-json\/wp\/v2\/categories?post=417"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.businesstechnologyassociates.com\/blog\/wp-json\/wp\/v2\/tags?post=417"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}