{
  "site": "https://pwn.watch",
  "generatedAt": "2026-10-22T16:23:59.585Z",
  "tag": {
    "id": "react",
    "label": "React",
    "isStack": false,
    "url": "https://pwn.watch/t/react",
    "feed": "https://pwn.watch/t/react/feed.xml"
  },
  "counts": {
    "incidents": 4,
    "live": 0,
    "notFullyPatched": 0,
    "patched": 4
  },
  "incidents": [
    {
      "slug": "nextjs-react-may-2026-security-release",
      "title": "Next.js / React Server Components May 2026 security release",
      "url": "https://pwn.watch/i/nextjs-react-may-2026-security-release",
      "json": "https://pwn.watch/i/nextjs-react-may-2026-security-release.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Next.js; react-server-dom-webpack/parcel/turbopack",
      "tags": [
        "node",
        "nextjs",
        "react"
      ],
      "cveIds": [
        "CVE-2026-23870"
      ],
      "affectedVersions": [
        "Next.js 13.x–16.x App Router (see advisory tables); RSC packages 19.0.0–19.0.5, 19.1.0–19.1.6, 19.2.0–19.2.5"
      ],
      "fixedVersions": [
        "Next.js 15.5.18",
        "Next.js 16.2.6",
        "react-server-dom-* 19.0.6 / 19.1.7 / 19.2.6"
      ],
      "startedAt": "2026-05-06",
      "closedAt": "2026-05-07",
      "updatedAt": "2026-05-08",
      "summary": "Coordinated May 6–7 2026 security release for React Server Components (CVE-2026-23870 DoS) and multiple Next.js advisories spanning middleware/proxy bypass, XSS, SSRF, cache poisoning and DoS. Upgrade Next.js to 15.5.18 or 16.2.6; react-server-dom-* to 19.0.6 / 19.1.7 / 19.2.6. Next.js 13.x/14.x had no planned patches.",
      "xPost": null
    },
    {
      "slug": "react-rsc-dos-cve-2026-23869-april",
      "title": "React Server Components DoS CVE-2026-23869 (April Next.js advisory)",
      "url": "https://pwn.watch/i/react-rsc-dos-cve-2026-23869-april",
      "json": "https://pwn.watch/i/react-rsc-dos-cve-2026-23869-april.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Next.js App Router / React Server Components",
      "tags": [
        "node",
        "nextjs",
        "react"
      ],
      "cveIds": [
        "CVE-2026-23869"
      ],
      "affectedVersions": [
        "Next.js >=13.0.0 <15.5.15 and >=16.0 <16.2.3"
      ],
      "fixedVersions": [
        "15.5.15",
        "16.2.3"
      ],
      "startedAt": "2026-04-08",
      "closedAt": "2026-04-08",
      "updatedAt": "2026-04-08",
      "summary": "April 8 2026 Next.js advisory GHSA-q4gf-8mx6-v5v3 tracks upstream CVE-2026-23869: crafted requests to App Router Server Function endpoints can cause excessive CPU / DoS. Patched in Next.js 15.5.15 and 16.2.3.",
      "xPost": null
    },
    {
      "slug": "lexisnexis-breach-react2shell-claim",
      "title": "LexisNexis breach (FulcrumSec claims React2Shell path)",
      "url": "https://pwn.watch/i/lexisnexis-breach-react2shell-claim",
      "json": "https://pwn.watch/i/lexisnexis-breach-react2shell-claim.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "LexisNexis Legal & Professional (legacy systems / React frontend claim)",
      "tags": [
        "react",
        "aws",
        "lexisnexis",
        "data-breach"
      ],
      "cveIds": [
        "CVE-2025-55182"
      ],
      "affectedVersions": [
        "n/a (customer breach); alleged unpatched React Server Components / Next.js stack"
      ],
      "fixedVersions": [],
      "startedAt": "2026-02-24",
      "closedAt": "2026-03-31",
      "updatedAt": "2026-03-31",
      "summary": "In March 2026 LexisNexis confirmed a breach of legacy servers exposing customer business contact and related data. Threat actor FulcrumSec claimed access via an unpatched React frontend “React2Shell” (CVE-2025-55182) into AWS infrastructure. LexisNexis said the matter was contained and mostly deprecated pre-2020 data.",
      "xPost": null
    },
    {
      "slug": "react2shell-react-server-components-cve-2025-55182",
      "title": "React2Shell: CVSS 10 unauthenticated RCE in React Server Components and Next.js",
      "url": "https://pwn.watch/i/react2shell-react-server-components-cve-2025-55182",
      "json": "https://pwn.watch/i/react2shell-react-server-components-cve-2025-55182.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "React Server Components (react-server-dom-*), Next.js",
      "tags": [
        "node",
        "react2shell",
        "react",
        "nextjs",
        "vercel",
        "rce",
        "zero-day",
        "cisa-kev",
        "ransomware"
      ],
      "cveIds": [
        "CVE-2025-55182"
      ],
      "affectedVersions": [
        "React 19.0.0, 19.1.0-19.1.1, 19.2.0 (react-server-dom-webpack / -parcel / -turbopack)",
        "Next.js App Router releases using affected React (see advisory)"
      ],
      "fixedVersions": [
        "React 19.0.1",
        "React 19.1.2",
        "React 19.2.1",
        "Next.js: patched release lines per the React/Next.js advisory"
      ],
      "startedAt": "2025-12-03",
      "closedAt": "2025-12-12",
      "updatedAt": "2025-12-12",
      "summary": "A flaw in how React Server Components deserialize Flight payloads let an unauthenticated request run code on the server. Next.js App Router apps were affected by default. China-nexus groups including Earth Lamia and Jackpot Panda exploited it within hours of disclosure. CVE-2025-66478 (the Next.js id) was rejected as a duplicate.",
      "xPost": null
    }
  ],
  "posts": [],
  "changes": [
    {
      "incident": "react2shell-react-server-components-cve-2025-55182",
      "incidentTitle": "React2Shell: CVSS 10 unauthenticated RCE in React Server Components and Next.js",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-12-12",
      "title": "Unit 42 updates its threat brief on ongoing exploitation",
      "body": null,
      "sourceUrl": "https://unit42.paloaltonetworks.com/cve-2025-55182-react-and-cve-2025-66478-next/",
      "url": "https://pwn.watch/i/react2shell-react-server-components-cve-2025-55182"
    },
    {
      "incident": "react2shell-react-server-components-cve-2025-55182",
      "incidentTitle": "React2Shell: CVSS 10 unauthenticated RCE in React Server Components and Next.js",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-12-05",
      "title": "CISA adds CVE-2025-55182 to KEV",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/react2shell-react-server-components-cve-2025-55182"
    },
    {
      "incident": "react2shell-react-server-components-cve-2025-55182",
      "incidentTitle": "React2Shell: CVSS 10 unauthenticated RCE in React Server Components and Next.js",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-12-03",
      "title": "React discloses a critical vulnerability in React Server Components and ships fixes",
      "body": null,
      "sourceUrl": "https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components",
      "url": "https://pwn.watch/i/react2shell-react-server-components-cve-2025-55182"
    },
    {
      "incident": "react2shell-react-server-components-cve-2025-55182",
      "incidentTitle": "React2Shell: CVSS 10 unauthenticated RCE in React Server Components and Next.js",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-12-03",
      "title": "AWS sees China-nexus groups exploiting it within hours",
      "body": "Including Earth Lamia and Jackpot Panda.",
      "sourceUrl": "https://aws.amazon.com/blogs/security/china-nexus-cyber-threat-groups-rapidly-exploit-react2shell-vulnerability-cve-2025-55182/",
      "url": "https://pwn.watch/i/react2shell-react-server-components-cve-2025-55182"
    }
  ]
}