Security advisory for React2Shell

[jacobparis]

16.0.8 contains the patch for React2Shell but there were two other vulnerabilities announced today, which is why the second update was needed. This pattern is typical as one security incident attracts a lot of attention from security researchers who then find new exploits.

You can read more about the newer CVEs here

React Server Components security update: DoS and Source Code Exposure

Two additional vulnerabilities in React Server Components have been identified: a high-severity Denial of Service (CVE-2025-55184) and a medium-severity Source Code Exposure (CVE-2025-55183). These issues were discovered while security researchers examined the patches for the original React2Shell vulnerability. Importantly, neither of these new issues allow for Remote Code Execution. The patch for React2Shell remains fully effective. We created new rules to address these vulnerabilities and depl…