Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsSome links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
Yes—this was a real follow-up patching issue, and upgrading for React2Shell was not necessarily enough. React’s December 2025 disclosure covered a high-severity denial-of-service flaw, CVE-2025-55184, and a source-code exposure flaw, CVE-2025-55183. React later updated its advisory on January 26, 2026, adding two more denial-of-service cases: CVE-2025-67779 and CVE-2026-23864.
Applications using affected React Server Components packages should be checked again and upgraded to React’s fixed package releases: 19.0.4, 19.1.5, or 19.2.4, depending on the release line. Next.js applications must also follow the framework-specific guidance in Next.js’s advisory; updating only react and react-dom may not be sufficient.
What was disclosed?
The original December 11, 2025 announcement concerned two vulnerabilities in the React Server Components ecosystem:
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →| Issue | CVE | Severity | Impact |
|---|---|---|---|
| Denial of service | CVE-2025-55184 | High, CVSS 7.5 | A crafted request can trigger an infinite loop, excessive CPU consumption, server hangs, crashes, or resource exhaustion. |
| Source-code exposure | CVE-2025-55183 | Medium, CVSS 5.3 | A crafted request can cause a vulnerable Server Function to return compiled source code. |
According to React’s advisory, these follow-up flaws do not provide remote code execution. That is separate from the earlier React2Shell vulnerability, CVE-2025-55182, which was the remote-code-execution issue.
#1 Best Overall
- USB-C 2-in-1 storage OTG: The Lexar JumpDrive Dual Drive D40E features USB Type-A and Type-C connectors in a slim, portable form factor for easy device compatibility
- Transfer speeds up to 100MB/s: Based on internal testing, performance may vary depending upon the host device, interface, and usage conditions. 1MB=1,000,000 bytes
- Plug and Play: Widely compatible with USB Type-C smartphones, tablets, laptops, Macs, and traditional Type-A devices, no software installation required. The 360° swivel design allows for easy switching between connectors without the hassle of losing a cap
- Durable & Compact: The Lexar D40E USB memory stick features a metal enclosure, withstands temperatures from 0° to 50° C (32°F to 122°F), and is lightweight at 26g with dimensions of 70.4 x 16.9 x 11.7mm
- Security & Warranty: Securely protects files using an advanced security software solution with 256-bit AES encryption. Backed by a Lexar 3-year limited warranty
The current status is broader than the original two bugs
The “two follow-up bugs” description accurately reflects the December disclosure, but it is not the complete current picture. React updated the same advisory on January 26, 2026, with additional denial-of-service vulnerabilities identified as CVE-2025-67779 and CVE-2026-23864.
The update matters operationally because some earlier patches were incomplete. React specifically says that versions 19.0.3, 19.1.4, and 19.2.3 should not be treated as the final fix for this vulnerability sequence.
Which packages are affected?
The affected package families are:
react-server-dom-webpackreact-server-dom-parcelreact-server-dom-turbopack
React lists the affected versions as:
19.0.0through19.0.319.1.0through19.1.419.2.0through19.2.3
The fixed backports listed in the updated React advisory are:
Recommended Free Tools
19.0.419.1.519.2.4
Do not install all three packages automatically. The correct package depends on the framework and bundler used by the application.
Does every React app need patching?
No. This is not a blanket vulnerability in every React application.
Rank #2
- 2 in 1: USB C + USB 3.0, 32GB usb c flash drive has dual ports, usb 3.0 port is applied to all devices which have usb 3.0 interface and usb c port is widely used in all Android smartphones with OTG function
- High Speed USB 3.0: Read speed up to 90 MB/s, Write speed up to 30 MB/s, the speed of USB 3.0 interface is faster than USB 2.0, save time to wait, increases work productivity. Note: Speed will be limited if you use the USB key in the USB 2.0 interface
- Large Compatibility: The USB 3.0 Connector is compatible with USB 3.0 & USB 2.0 backward USB 1.1 devices, such as Laptop, Desktop, Car Audio, Tablet, TV, Speakers, Projector. USB-C port is compatible with all Android Smartphones
- Expand Storage: Good performance in storing, transferring and sharing digital data with families, friends, colleagues, customers. It can expand the capacity of smartphone, you can watch movies or share pictures when you go on vacation with your family
- Note: Make sure your smartphone is equipped with OTG function and need to open OTG function in Settings when you plug memory stick, then you can transfer easily data bewteen different devices
An application is generally outside the affected deployment model if it:
- Uses React only in the browser and has no React server.
- Does not use a framework, bundler, or plugin that supports React Server Components.
- Does not use the affected server-side package families.
React Native applications also have a special case. A React Native application that does not use a monorepo or react-dom generally does not require additional action. Monorepo users should check whether an affected react-server-dom-* package is installed.
Do not infer safety solely from the absence of a direct dependency. Frameworks can install React Server Components packages transitively.
Why Next.js users need separate guidance
Next.js is affected because it integrates with React Server Components and Server Functions. React lists Next.js among the affected frameworks and bundler ecosystems, alongside React Router, Waku, Parcel RSC, Vite’s RSC plugin, and RedwoodSDK.
For Next.js, use the version matrix in the official Next.js advisory. The appropriate fix depends on the application’s supported Next.js release line. Do not infer a patched Next.js version from the React package table, and do not assume that upgrading only react and react-dom removes a vulnerable transitive react-server-dom-* dependency.
Rank #3
- USB-C 2-in-1 storage OTG: The Lexar JumpDrive Dual Drive D40E features USB Type-A and Type-C connectors in a slim, portable form factor for easy device compatibility
- Transfer speeds up to 100MB/s: Based on internal testing, performance may vary depending upon the host device, interface, and usage conditions. 1MB=1,000,000 bytes
- Plug and Play: Widely compatible with USB Type-C smartphones, tablets, laptops, Macs, and traditional Type-A devices, no software installation required. The 360° swivel design allows for easy switching between connectors without the hassle of losing a cap
- Durable & Compact: The Lexar D40E USB memory stick features a metal enclosure, withstands temperatures from 0° to 50° C (32°F to 122°F), and is lightweight at 26g with dimensions of 70.4 x 16.9 x 11.7mm
- Security & Warranty: Securely protects files using an advanced security software solution with 256-bit AES encryption. Backed by a Lexar 3-year limited warranty
What can an attacker do?
Denial of service
A malicious HTTP request sent to a Server Function or App Router endpoint can pass through a vulnerable deserialization path. The result may be an infinite loop, excessive CPU use, a hung process, out-of-memory conditions, crashes, or degraded availability.
Free tools Windows power users keep installed
One-click scans. No signup required.
React says the denial-of-service issue can affect an application that supports React Server Components even if the application does not explicitly implement React Server Function endpoints. Publicly reachable applications with limited CPU or memory headroom should therefore treat remediation as urgent.
Source-code exposure
The source-code vulnerability can expose compiled source from a Server Function when the relevant function explicitly or implicitly exposes a stringified argument. Depending on the code and bundler output, exposed material could include business logic, internal function behavior, hardcoded credentials, or keys inlined into the compiled function.
This does not mean that every runtime environment variable was automatically leaked. React says values accessed at runtime, such as process.env.SECRET, are not exposed by this specific source-code vulnerability. Hardcoded secrets and build-time-substituted values are a different matter, so production bundles should be inspected.
How to check a repository
Start by checking both direct and transitive dependencies.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #4
- 2-in-1 Dual Design: Features both USB-C and USB-A connectors, making it compatible with phones, tablets, MacBooks, PCs, and laptops-no adapter needed
- Wide Compatibility: Works seamlessly with USB A and USB C devices, ensuring reliable file transfers across smartphones, computers, and more
- Ample Storage Options: Available in 16GB/32GB/64GB/128GB providing plenty of space for photos, videos, music, and documents
- Portable & Lightweight: Compact and durable design for travel, school, or daily use-take your files anywhere
- Plug-and-Play Convenience: No software or drivers required; simply insert into USB-C or USB-A ports and start transferring files instantly
npm
npm ls next react react-dom
react-server-dom-webpack
react-server-dom-parcel
react-server-dom-turbopackpnpm
pnpm why react-server-dom-webpack
pnpm why react-server-dom-parcel
pnpm why react-server-dom-turbopack
pnpm list next react react-dom --depth 10Yarn
yarn why react-server-dom-webpack
yarn why react-server-dom-parcel
yarn why react-server-dom-turbopack
yarn why nextRepeat the review for every workspace in a monorepo. Inspect the lockfile, not just package.json, because a framework upgrade can leave an old transitive package resolved elsewhere.
How to upgrade
Direct React Server Components dependencies
If the project directly depends on one of the affected packages, update the package actually used by its bundler to the fixed release line identified by React. For example:
npm install [email protected]
npm install
npm run buildUse 19.1.5 or 19.2.4 instead when that matches the project’s React release line. Do not blindly install react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack together.
Next.js applications
Upgrade Next.js to the patched version specified for your release line in the Next.js advisory, then reinstall dependencies and rebuild:
npm install next@<patched-version>
npm install
npm run build
npm run startAfter the upgrade, verify what is actually resolved:
Best Value
- USB-C STORAGE ON THE GO: This sleek drive is supported by Samsung NAND flash and is incredibly compact to fit in the palm of your hand; Count on reliable performance and fast transfer speeds while staying compact
- PERFORMANCE WITH SPEED: No need to choose between performance and reliability; Experience a fast, powerful flash drive that transfers 4GB files in just 11 seconds with up to 400MB/s USB 3.2 Gen 1 read speeds and is backward compatible with USB 3.0/2.0
- MODERN MEETS ICONIC: The ultra-sleek USB-C drive looks as good as it performs; Featuring a reversible plug, the Type-C inserts into your devices seamlessly every time; Transfer large files with style and ease
- ALWAYS CONNECTED: USB-C is compatible across devices, including laptops, tablets, phones and cameras, with enough space for 63,730 photos or maximum 12 hours of 4K video; With up to 256GB of storage space, this pocket-sized thumb drive comes in handy wherever you go
- TOUGH & TRUSTED: Files stay secure, no matter the terrain; Samsung's flash memory technology makes the Type-C a trustworthy drive to store your valuable data; It's waterproof, shock-proof, magnet-proof, temperature-proof, and X-ray-proof body, plus it's backed by a 5-year limited warranty
npm ls next react-server-dom-webpack react-server-dom-parcel react-server-dom-turbopack
npm auditA successful top-level upgrade is not enough if the lockfile or another workspace still resolves a vulnerable package.
Redeploy every affected environment
Patch the deployed artifact, not just the repository. Redeploy production, regional instances, preview environments, canaries, containers, and any separately managed worker or API deployment that includes the affected packages.
Invalidate stale build artifacts and old container images where applicable. Confirm the running application reports the intended dependency versions after deployment.
If the application may have been exposed
- Record the deployed commit, lockfile, dependency versions, and affected environments.
- Upgrade to the appropriate fixed React and/or Next.js release.
- Redeploy all instances and invalidate stale artifacts.
- Review web-server, CDN, WAF, and application logs for unusual requests to RSC or Server Function endpoints.
- Check for CPU spikes, memory exhaustion, worker restarts, and repeated crashes.
- Search repositories, build logs, and compiled production artifacts for hardcoded credentials.
- Rotate credentials that may have been embedded in a Server Function or exposed through another path.
- If compromise is suspected, check for unexpected files, processes, outbound connections, cryptocurrency miners, and modified deployment configuration.
- Preserve relevant logs before changing retention settings or redeploying again.
These steps do not establish that exploitation occurred. They provide a way to distinguish a dependency exposure from evidence of an availability attack or secret disclosure.
Why a WAF or hosting mitigation is not the final fix
React worked with hosting providers on temporary mitigations, but those controls should not replace upgrading the application.
- A patch removes or corrects the vulnerable code path.
- A WAF or edge rule may block known request patterns but can miss variants.
- Rate limiting and isolation can reduce availability impact without fixing the dependency.
- Credential rotation limits the consequences of a possible secret exposure but does not remediate the vulnerability.
- Incident response determines whether suspicious activity occurred.
Use compensating controls while preparing the upgrade, but treat the fixed dependency and a complete redeployment as the remediation.
Quick Recap
Patch-and-verify checklist
- Determine whether the application uses RSC, Server Functions, Next.js App Router, or another RSC-capable framework or bundler.
- Check direct and transitive
react-server-dom-*packages. - Do not stop at incomplete versions
19.0.3,19.1.4, or19.2.3. - Use React’s fixed versions:
19.0.4,19.1.5, or19.2.4, as appropriate. - For Next.js, follow the current patched-version matrix in Next.js’s advisory.
- Update the lockfile, rebuild, and inspect the production dependency tree.
- Redeploy every environment and invalidate stale artifacts.
- Review logs and production bundles if the deployment was publicly reachable.
- Rotate hardcoded or otherwise potentially exposed credentials.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
