Developers scramble as critical React flaw threatens major apps

Security researchers disclosed a critical deserialization vulnerability in React Server Components (CVE-2025-55182) that can allow unauthenticated remote code execution in default configurations. The flaw affects React and many dependent frameworks and bundlers (including Next.js and others), prompting coordinated patches and mitigations from Meta, Vercel and security vendors; no active exploitation has been observed yet, but analysts warn exploitation is likely imminent given the library's widespread use.