Admins and defenders gird themselves against maximum-severity server vuln

“I usually don’t say this, but patch right freakin’ now,” one researcher wrote. “The React CVE listing (CVE-2025-55182) is a perfect 10.”

React versions 19.0.1, 19.1.2, or 19.2.1 contain the vulnerable code. Third-party components known to be affected include:

• Vite RSC plugin
• Parcel RSC plugin
• React Router RSC preview
• RedwoodSDK
• Waku
• Next.js

According to Wiz and fellow security firm Aikido, the vulnerability, tracked as CVE-2025-55182, resides in Flight, a protocol…