Skip to content

The December 2025 React Server Components advisories

If your app supports Server Components, the advisory is yours: upgrade to the fixed version, redeploy, rotate secrets, and expect to do it again.

Predict first

Before you read: predict

3 December 2025, exam week. ExamHall's candidate app runs Next.js 16.0.6 with the App Router; its pages and layouts are Server Components. A search of the repository finds no file that starts with 'use server' and no form with an action. That morning the React team publishes a CVSS 10.0 advisory for React Server Components, and the app's host posts that a firewall rule for the flaw is live.

What should the team conclude?

Pick one

The 30-second version

On 3 December 2025 React disclosed a remote code execution flaw in its Server Components packages, rated CVSS 10.0. Apps that supported Server Components could be exposed, Server Functions or not. There was no workaround: upgrade, redeploy, rotate secrets. More fixes followed on 11 December and 26 January.

If your app supports Server Components, the advisory is yours: upgrade to the fixed version, redeploy, rotate secrets, and expect to do it again.

How it works

Step 1 of 13

The flaw. CVE-2025-55182, CVSS 10.0: unauthenticated remote code execution in React Server Components. Next.js tracks its App Router impact as CVE-2025-66478.

Analogy: A pushchair maker's safety recall

At the pushchair recall In the advisories
the notice lists hinge batches; a parent reads the stamp under the seat, not the model name on the box affected versions, read from the lockfile (steps 2, 6)
a parent who never folds it on the go still has the hinge no Server Function needed (step 3)
only the maker's replacement hinge fixes it; a strap round the frame does not no workaround; a host's rule is temporary (step 5)
a second notice: the first replacement hinges need replacing too, though the first repair still holds the follow-ups; patch forward (steps 8, 10)
a shop that knows who owns which model calls them the same day patch speed (step 13)

In real terms: check which version each app runs, move every exposed app to the current fixed version today, and repeat when the next notice comes.

Breaks down when: a cracked hinge shows. A server can be entered without a visible sign, so the advice is to rotate every secret, not to look for damage first (step 11).

Contrasting case: a pushchair from another maker, with a different hinge, is outside the recall, however alike the two look.

Examples, run for real

It asserts every line it prints.

4.1 ExamHall: EXH-3360 and MR !3660

EXH-3360: in exam week ExamHall's candidate app runs next 16.0.6. MR !3660 bumps it to the version the January table gives for 16.0.x:

4.1 EXH-3360 lockfile: next 16.0.6
4.1 EXH-3360 3 December table  upgrade · next 16.0.6 < 16.0.7
4.1 EXH-3360 26 January table  upgrade · next 16.0.6 < 16.0.11
4.1 MR !3660 lockfile: next 16.0.11
4.1 MR !3660 3 December table  ok      · next 16.0.11 >= 16.0.7
4.1 MR !3660 26 January table  ok      · next 16.0.11 >= 16.0.11

The merge is not the end: redeploy, then rotate every secret the app uses (step 11).

4.2 Media streaming: a waku app

A streaming service's live-events app runs on waku, which installs react-server-dom-webpack:

4.2 before lockfile: react-server-dom-webpack 19.1.1
4.2 before 3 December table  upgrade · react-server-dom-webpack 19.1.1 listed (fix 19.1.2)
4.2 before 26 January table  upgrade · react-server-dom-webpack 19.1.1 listed (fix 19.1.5)
4.2 after lockfile: react-server-dom-webpack 19.1.5
4.2 after 3 December table  ok      · react-server-dom-webpack 19.1.5 not listed
4.2 after 26 January table  ok      · react-server-dom-webpack 19.1.5 not listed

The framework's name is not what the advisory lists; the server package it installs is (steps 2, 6).

Try it

Answer first, then check. Nothing is saved.

Question 1 of 7

A ticketing company runs five React services. On 27 January 2026 an engineer reads each one's lockfile (resolved versions):

box-office    next 16.0.7 · react 19.2.1        Next.js App Router, bumped on 4 December
seat-map      next 15.5.10 · react 19.2.4       Next.js App Router
venue-admin   next 14.2.30 · react 18.3.1       Next.js App Router
kiosk-ui      vite 7.1.0 · react 19.2.0         browser-only React, no server code
resale        react-router 7.9.0 · react-server-dom-webpack 19.2.3 · react 19.2.3   React Router with Server Components

She checks them against the react.dev advisories as updated on 26 January 2026.

Which services must still upgrade?

Pick one

Question 2 of 7

A live-sports streaming service runs two Next.js App Router apps, schedule and subscriptions, both on next 16.0.6 when the first advisory came out. The team moved schedule to 16.0.7, the patched release for its line, and redeployed it on 3 December 2025; subscriptions followed on 8 December. Both read their secrets from process.env. On 15 December the team rereads the advisory's note of 6 December on rotating secrets.

Which app does that note tell to rotate every secret it uses, starting with the most critical?

Pick one

Question 3 of 7

A chat company's web app runs next 16.0.7, installed on 4 December 2025. Its one Server Function, sendInvite, signs invite links with a key written as a string in its own code, and opens a database connection with process.env.DATABASE_URL.

On 12 December, which of these could the source code exposure flaw (CVE-2025-55183) reveal from this app?

Pick one

Question 4 of 7

A video service's catalogue app moved to next 16.0.7 on 4 December 2025, the day after the first advisory. On 11 December the React team publishes two more advisories for Server Components: denial of service (CVSS 7.5) and source code exposure (CVSS 5.3).

What should the team do?

Pick one

Question 5 of 7

ExamHall's product manager writes: "We never wrote a Server Action, so I don't see why the team dropped everything for this advisory, or why we are upgrading again a week later".

Write three sentences that answer the product manager.

Question 6 of 7

After the December advisories, a ticketing company reviews its response. Its Next.js apps reached production nine days after the 3 December fix.

Which change should the review adopt?

Pick one

Question 7 of 7

A payments company runs four React apps. On 27 January 2026 an engineer lists each one's lockfile (resolved versions) and how many files in its code start with 'use server':

checkout     next 16.0.10 · react 19.2.3      Next.js App Router · 'use server' files: 3
statements   next 16.0.9 · react 19.2.3       Next.js App Router · 'use server' files: 0
payouts      react-router 7.9.0 · react-server-dom-webpack 19.2.0 · react 19.2.0   React Router with Server Components · 'use server' files: 2
docs         next 16.1.5 · react 19.2.3       Next.js App Router · 'use server' files: 0

She checks them against the react.dev advisories as updated on 26 January 2026.

How many of the four must upgrade?

Pick one

Go deeper

Pro tip
  1. Check every copy of a server package in the lockfile, nested ones too: a framework can bring its own. When: a framework pins its own react-server-dom-* under its folder, beside a fixed top-level copy (step 6). Verify (RAN, tips.mjs):
    tip 1 lockfile copies: node_modules/react-server-dom-webpack 19.2.4 · node_modules/waku/node_modules/react-server-dom-webpack 19.2.3
tip 1 top-level copy only: ok · every copy: upgrade (react-server-dom-webpack 19.2.3 listed (fix 19.2.4))
Sources

All three pages have been updated since publication, so every claim here is valid as of 2026-10-09.

Related lessons

Checked against the tools and docs as of 2026-10-09.