akvo / agriconnect / #294

92%

push

github

security: fix CVE-2025-55182 RCE vulnerability in React Server Components

Update React and React DOM to patched versions to address critical
remote code execution vulnerability in React Server Components.

Changes:
- React: 19.1.0 → 19.1.2 (security patch)
- React DOM: 19.1.0 → 19.1.2 (security patch)
- Next.js: already at 15.5.7 (patched version)

CVE Details:
- CVE-2025-55182: Critical RCE in RSC protocol (CVSS 10.0)
- Affects React 19.0, 19.1.0, 19.1.1, 19.2.0
- Fixed in React 19.0.1, 19.1.2, 19.2.1
- Next.js fixed in 15.5.7 and later

The vulnerability allows unauthenticated attackers to execute arbitrary
code on the server through crafted HTTP requests to React Server Function
endpoints. This project uses App Router with async server components,
making it a target for this vulnerability.

Impact: High - Project was vulnerable to remote code execution
Resolution: Applied security patches from React and Next.js teams

Reference: https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components

1165 of 1602 branches covered (72.72%)

Branch coverage included in aggregate %.

14150 of 15145 relevant lines covered (93.43%)

0.93 hits per line