腾讯网

10级漏洞刚补完，React又炸了！现代Web“默认底座”因一行代码缺失 ...

编译 | Tina、冬梅上周刚追完 10 级补丁，以为能喘口气了？还不行。12 月 12 日，React 官方确认，研究人员在验证上周补丁时，竟又在 React Server Components（RSC）里发现了两处新漏洞。过去一周，React2Shell 漏洞的余威仍在：服务器被劫持挖矿、云厂商紧急封禁、甚至引发 Cloudflare ...

RondoDox botnet exploits React2Shell flaw to breach Next.js servers

The RondoDox botnet has been observed exploiting the critical React2Shell flaw (CVE-2025-55182) to infect vulnerable Next.js ...
新浪网

React 警告关键高危漏洞：可未经身份验证远程执行代码，快快升级

IT之家 12 月 4 日消息，热门 JavaScript 框架 React 昨日发布官方公告，React Server Components 中存在一个未经身份验证的远程代码执行漏洞，建议开发者立即升级修补漏洞。 11 月 29 日，Lachlan Davidson 报告了 React 中的一个安全漏洞，该漏洞允许通过利用 React 解码发送到 ...
Fireship on MSN

React developers are in a civil war and Next.js is watching

React used to be simple, fun, and mostly predictable. Somewhere along the way, it grew server components, suspense, and a ...
InfoWorld

Hands-on with React Server Components

Unlike server-side rendering, React Server Components aim to fully replace client-side functionality with work done on the server. Let’s see how this works. React remains a flagship among front-end ...