如果你在用 React 19 / Next.js 15 / 16， 这篇就当是一个温柔但坚决的催命信： Vercel 已经出手，在它的全球 Web Application Firewall（WAF）上， 加了一层拦截规则，免费帮所有托管在上面的项目挡一波。

Critical RSC flaws in React and Next.js enable unauthenticated remote code execution; users should update to patched versions ...

IT之家 12 月 4 日消息，热门 JavaScript 框架 React 昨日发布官方公告，React Server Components 中存在一个未经身份验证的远程代码执行漏洞，建议开发者立即升级修补漏洞。11 月 29 日，Lachlan Davidson 报告了 React 中的一个安全漏洞，该漏洞允许通过利用 React 解码发送到 React Server Function 端点的 ...

A critical vulnerability has been discovered in React Server Components and frameworks like Next.js, allowing an ...

Security and developer teams are scrambling to address a highly critical security flaw in frameworks tied to the popular React JavaScript library. Not only is the vulnerability, which also is in the ...

Meta has discovered a critical vulnerability in React Server Components. The vulnerability has been given a maximum score of ...

A maximum severity vulnerability, dubbed 'React2Shell', in the React Server Components (RSC) 'Flight' protocol allows remote code execution without authentication in React and Next.js applications.

Cloudflare has blamed today's outage on the emergency patching of a critical React remote code execution vulnerability, which is now actively exploited in attacks.

A CVSS 10 rate critical vulnerability impacts React Server Components in versions 19.0–19.2.0. A patched update has been ...

A newly discovered security flaw in the React ecosystem — one of the most widely used technologies on the web — is prompting ...