React.js shell shocked by 10.0 critical vulnerability…

The JavaScript world just got shell-shocked after a 10.0 maximum pwnage critical vulnerability was discovered in the React.js framework, specifically in its server components flight protocol code. This is really bad, because it's not some random plugin used by three people, but it's used extensively in millions of modern React apps and frameworks like Next.js. Most of the vibe engineers who've been polluting the internet with useless slop for the last few years default to Next.js, but now that slop is not only useless, but also extremely dangerous. You might remember log4shell back in 2021, an exploit in the log4j java library that allowed hackers to launch millions of attacks on servers and nearly took down the global economy. Well in 2025, log4shell has a new sister called react2shell, aka cve-2025-55182, an exploit that allows an attacker to go from HTTP request to shell access without logging in, without abusing some weird edge case, and in many cases, on default configs. In today's video, we'll break down the latest reason not to use React, and find out how this exploit actually works. It is December 9th, 2025, and you're watching The Code Report. If you're a React developer, let's first find out how screwed you are right now. You can find out by running this command to see if you're using any of these server components packages with the following versions. If any of these bad versions pop up, your kids might not be getting any presents for Hanukkah this year. That's because you basically just did npm install malware, and there's a good chance you'll need to pay some Chinese guy a bitcoin or two to get your website back. But that's just the cost of being a React developer. The vulnerability is found specifically in the React flight protocol implementation. But wait a minute, I have a React dev expert on my resume, and have never even heard of this flight protocol thingy. Well, it's actually pretty simple. React flight is like the blueprint server components use to pass data from the server to a client-facing browser. For example, when I was 17 years old, I got my first real job working for Tuftshed. At that job, we would first prefab certain parts of a shed in a factory, load them on a truck, then drive them out to the build location to construct the final shed. React works in the same basic way. Some components are built on the server, then they get serialized into a format that can be passed over the network, and finally rendered or built as a website in a browser. That's all good in theory, but unfortunately React made a mistake we've seen many times before. The classic deserialize untrusted input, then treat it like it came from your best friend, then get devastating remote code execution as the result. Attackers can craft malicious flight payloads that when deserialized on the server, produce object graphs that never should exist in normal code paths. From there they can manipulate the runtime environment, like calling dangerous APIs indirectly, or run arbitrary code on the server. No authentication, no valid session, just a single poisoned request to an endpoint that handles React server components that can transform your server into a very expensive crypto miner. Within hours of public disclosure, multiple security companies saw real attack traffic, like Amazon observed attack attempts tied to Chinese hacking groups almost immediately. There's estimated to be over 2 million vulnerable servers out there, and hackers are currently scanning and trying to exploit them as we speak. And that's why you need to update your code as ASAP as possible, and one tool that can help you do that is GenSpark, the sponsor of today's video. It's an all-in-one AI workspace that orchestrates multiple AI models to get work done faster. So instead of manually bouncing around Gemini 3, Nano Banana, Sonnet 4.5, or whatever new model just dropped, you can just tell GenSpark what you want, and it'll automatically use a mixture of agents to give you a highly polished output in one shot. As a developer, you can use their browser-based dev environment to build anything from landing pages to full-stack web apps that you can just as easily deploy on Cloudflare. And if you want, you can connect your account to external services like Slack and Google Drive so GenSpark can take actions on your behalf and become a single hub for all of your work. Use the link below to try out GenSpark for free today. This has been The Code Report. Thanks for watching, and I will see you in the next one.