Which platforms patched React CVE?

TLDR

React maintainers patched CVE?2025?55182 and key web stacks rolled out fixes shortly after disclosure.

1. React core: patched react?server?dom packages in 19.0.1, 19.1.2, 19.2.1 %%CKPROTECTED0%%.
2. Next.js: patched across release lines 14.2.35 through 16.0.10 %%CKPROTECTED0%%.
3. Vercel: deployed WAF rules to auto?protect hosted projects, while urging immediate upgrades security bulletin.

Deep Dive

1. React Core Fix

Reacts team patched CVE?2025?55182 on 3 Dec after a private report, issuing fixes for react?server?dom?webpack, ?parcel, and ?turbopack in 19.0.1, 19.1.2, and 19.2.1 %%CKPROTECTED0%%. The flaw allowed unauthenticated remote code execution, rated at the highest severity market coverage.

2. Framework and Hosting

Next.js shipped patched releases across multiple lines, with required upgrades from 14.2.35 to 16.0.10 to address the React RCE vector update notes. Vercel added Web Application Firewall rules to automatically protect projects but emphasized that WAF alone is insufficient without upgrading dependencies security bulletin.

3. Impact on Crypto Sites

Security groups observed wallet?draining campaigns exploiting the bug, injecting malicious scripts into legitimate sites. The patched React versions and urgent upgrades are highlighted across advisories market coverage, with additional reporting on exploitation and mitigations risk analysis.

Conclusion

The CVE was fixed upstream in React, and major ecosystem providers moved quickly. Practical protection requires both upgrading to patched React and framework versions and enabling platform safeguards. For crypto?facing apps, harden wallet flows and verify your supply chain to reduce exposure to future exploits.