From cffb6a7b7d00fbe09df5b40d1731e1055bff0900 Mon Sep 17 00:00:00 2001 From: "Sebastian \"Sebbie\" Silbermann" Date: Thu, 11 Dec 2025 07:27:20 +0100 Subject: [PATCH 1/9] Specify that Effects run on commit, not render (#8162) --- src/content/reference/react/useEffect.md | 26 +++++++++---------- .../reference/react/useLayoutEffect.md | 4 +-- 2 files changed, 15 insertions(+), 15 deletions(-) diff --git a/src/content/reference/react/useEffect.md b/src/content/reference/react/useEffect.md index da310c7625..85389c62e0 100644 --- a/src/content/reference/react/useEffect.md +++ b/src/content/reference/react/useEffect.md @@ -44,9 +44,9 @@ function ChatRoom({ roomId }) { #### Parameters {/*parameters*/} -* `setup`: The function with your Effect's logic. Your setup function may also optionally return a *cleanup* function. When your component is added to the DOM, React will run your setup function. After every re-render with changed dependencies, React will first run the cleanup function (if you provided it) with the old values, and then run your setup function with the new values. After your component is removed from the DOM, React will run your cleanup function. +* `setup`: The function with your Effect's logic. Your setup function may also optionally return a *cleanup* function. When your [component commits](/learn/render-and-commit#step-3-react-commits-changes-to-the-dom), React will run your setup function. After every commit with changed dependencies, React will first run the cleanup function (if you provided it) with the old values, and then run your setup function with the new values. After your component is removed from the DOM, React will run your cleanup function. -* **optional** `dependencies`: The list of all reactive values referenced inside of the `setup` code. Reactive values include props, state, and all the variables and functions declared directly inside your component body. If your linter is [configured for React](/learn/editor-setup#linting), it will verify that every reactive value is correctly specified as a dependency. The list of dependencies must have a constant number of items and be written inline like `[dep1, dep2, dep3]`. React will compare each dependency with its previous value using the [`Object.is`](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Object/is) comparison. If you omit this argument, your Effect will re-run after every re-render of the component. [See the difference between passing an array of dependencies, an empty array, and no dependencies at all.](#examples-dependencies) +* **optional** `dependencies`: The list of all reactive values referenced inside of the `setup` code. Reactive values include props, state, and all the variables and functions declared directly inside your component body. If your linter is [configured for React](/learn/editor-setup#linting), it will verify that every reactive value is correctly specified as a dependency. The list of dependencies must have a constant number of items and be written inline like `[dep1, dep2, dep3]`. React will compare each dependency with its previous value using the [`Object.is`](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Object/is) comparison. If you omit this argument, your Effect will re-run after every commit of the component. [See the difference between passing an array of dependencies, an empty array, and no dependencies at all.](#examples-dependencies) #### Returns {/*returns*/} @@ -107,14 +107,14 @@ You need to pass two arguments to `useEffect`: **React calls your setup and cleanup functions whenever it's necessary, which may happen multiple times:** 1. Your setup code runs when your component is added to the page *(mounts)*. -2. After every re-render of your component where the dependencies have changed: +2. After every commit of your component where the dependencies have changed: - First, your cleanup code runs with the old props and state. - Then, your setup code runs with the new props and state. 3. Your cleanup code runs one final time after your component is removed from the page *(unmounts).* **Let's illustrate this sequence for the example above.** -When the `ChatRoom` component above gets added to the page, it will connect to the chat room with the initial `serverUrl` and `roomId`. If either `serverUrl` or `roomId` change as a result of a re-render (say, if the user picks a different chat room in a dropdown), your Effect will *disconnect from the previous room, and connect to the next one.* When the `ChatRoom` component is removed from the page, your Effect will disconnect one last time. +When the `ChatRoom` component above gets added to the page, it will connect to the chat room with the initial `serverUrl` and `roomId`. If either `serverUrl` or `roomId` change as a result of a commit (say, if the user picks a different chat room in a dropdown), your Effect will *disconnect from the previous room, and connect to the next one.* When the `ChatRoom` component is removed from the page, your Effect will disconnect one last time. **To [help you find bugs,](/learn/synchronizing-with-effects#step-3-add-cleanup-if-needed) in development React runs setup and cleanup one extra time before the setup.** This is a stress-test that verifies your Effect's logic is implemented correctly. If this causes visible issues, your cleanup function is missing some logic. The cleanup function should stop or undo whatever the setup function was doing. The rule of thumb is that the user shouldn't be able to distinguish between the setup being called once (as in production) and a *setup* → *cleanup* → *setup* sequence (as in development). [See common solutions.](/learn/synchronizing-with-effects#how-to-handle-the-effect-firing-twice-in-development) @@ -1145,7 +1145,7 @@ useEffect(() => { #### Passing a dependency array {/*passing-a-dependency-array*/} -If you specify the dependencies, your Effect runs **after the initial render _and_ after re-renders with changed dependencies.** +If you specify the dependencies, your Effect runs **after the initial commit _and_ after commits with changed dependencies.** ```js {3} useEffect(() => { @@ -1242,7 +1242,7 @@ button { margin-left: 5px; } #### Passing an empty dependency array {/*passing-an-empty-dependency-array*/} -If your Effect truly doesn't use any reactive values, it will only run **after the initial render.** +If your Effect truly doesn't use any reactive values, it will only run **after the initial commit.** ```js {3} useEffect(() => { @@ -1319,7 +1319,7 @@ export function createConnection(serverUrl, roomId) { #### Passing no dependency array at all {/*passing-no-dependency-array-at-all*/} -If you pass no dependency array at all, your Effect runs **after every single render (and re-render)** of your component. +If you pass no dependency array at all, your Effect runs **after every single commit** of your component. ```js {3} useEffect(() => { @@ -1480,7 +1480,7 @@ Now that you're passing `c => c + 1` instead of `count + 1`, [your Effect no lon ### Removing unnecessary object dependencies {/*removing-unnecessary-object-dependencies*/} -If your Effect depends on an object or a function created during rendering, it might run too often. For example, this Effect re-connects after every render because the `options` object is [different for every render:](/learn/removing-effect-dependencies#does-some-reactive-value-change-unintentionally) +If your Effect depends on an object or a function created during rendering, it might run too often. For example, this Effect re-connects after every commit because the `options` object is [different for every render:](/learn/removing-effect-dependencies#does-some-reactive-value-change-unintentionally) ```js {6-9,12,15} const serverUrl = 'https://localhost:1234'; @@ -1497,7 +1497,7 @@ function ChatRoom({ roomId }) { const connection = createConnection(options); // It's used inside the Effect connection.connect(); return () => connection.disconnect(); - }, [options]); // 🚩 As a result, these dependencies are always different on a re-render + }, [options]); // 🚩 As a result, these dependencies are always different on a commit // ... ``` @@ -1583,7 +1583,7 @@ With this fix, typing into the input doesn't reconnect the chat. Unlike an objec ### Removing unnecessary function dependencies {/*removing-unnecessary-function-dependencies*/} -If your Effect depends on an object or a function created during rendering, it might run too often. For example, this Effect re-connects after every render because the `createOptions` function is [different for every render:](/learn/removing-effect-dependencies#does-some-reactive-value-change-unintentionally) +If your Effect depends on an object or a function created during rendering, it might run too often. For example, this Effect re-connects after every commit because the `createOptions` function is [different for every render:](/learn/removing-effect-dependencies#does-some-reactive-value-change-unintentionally) ```js {4-9,12,16} function ChatRoom({ roomId }) { @@ -1601,11 +1601,11 @@ function ChatRoom({ roomId }) { const connection = createConnection(); connection.connect(); return () => connection.disconnect(); - }, [createOptions]); // 🚩 As a result, these dependencies are always different on a re-render + }, [createOptions]); // 🚩 As a result, these dependencies are always different on a commit // ... ``` -By itself, creating a function from scratch on every re-render is not a problem. You don't need to optimize that. However, if you use it as a dependency of your Effect, it will cause your Effect to re-run after every re-render. +By itself, creating a function from scratch on every re-render is not a problem. You don't need to optimize that. However, if you use it as a dependency of your Effect, it will cause your Effect to re-run after every commit. Avoid using a function created during rendering as a dependency. Instead, declare it inside the Effect: @@ -1775,7 +1775,7 @@ First, check that you haven't forgotten to specify the dependency array: ```js {3} useEffect(() => { // ... -}); // 🚩 No dependency array: re-runs after every render! +}); // 🚩 No dependency array: re-runs after every commit! ``` If you've specified the dependency array but your Effect still re-runs in a loop, it's because one of your dependencies is different on every re-render. diff --git a/src/content/reference/react/useLayoutEffect.md b/src/content/reference/react/useLayoutEffect.md index 5ae152b67e..24b3604043 100644 --- a/src/content/reference/react/useLayoutEffect.md +++ b/src/content/reference/react/useLayoutEffect.md @@ -47,9 +47,9 @@ function Tooltip() { #### Parameters {/*parameters*/} -* `setup`: The function with your Effect's logic. Your setup function may also optionally return a *cleanup* function. Before your component is added to the DOM, React will run your setup function. After every re-render with changed dependencies, React will first run the cleanup function (if you provided it) with the old values, and then run your setup function with the new values. Before your component is removed from the DOM, React will run your cleanup function. +* `setup`: The function with your Effect's logic. Your setup function may also optionally return a *cleanup* function. Before your [component commits](/learn/render-and-commit#step-3-react-commits-changes-to-the-dom), React will run your setup function. After every commit with changed dependencies, React will first run the cleanup function (if you provided it) with the old values, and then run your setup function with the new values. Before your component is removed from the DOM, React will run your cleanup function. -* **optional** `dependencies`: The list of all reactive values referenced inside of the `setup` code. Reactive values include props, state, and all the variables and functions declared directly inside your component body. If your linter is [configured for React](/learn/editor-setup#linting), it will verify that every reactive value is correctly specified as a dependency. The list of dependencies must have a constant number of items and be written inline like `[dep1, dep2, dep3]`. React will compare each dependency with its previous value using the [`Object.is`](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Object/is) comparison. If you omit this argument, your Effect will re-run after every re-render of the component. +* **optional** `dependencies`: The list of all reactive values referenced inside of the `setup` code. Reactive values include props, state, and all the variables and functions declared directly inside your component body. If your linter is [configured for React](/learn/editor-setup#linting), it will verify that every reactive value is correctly specified as a dependency. The list of dependencies must have a constant number of items and be written inline like `[dep1, dep2, dep3]`. React will compare each dependency with its previous value using the [`Object.is`](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Object/is) comparison. If you omit this argument, your Effect will re-run after every commit of the component. #### Returns {/*returns*/} From 2a0fed01500bd6e7f4214824b414729918a74c20 Mon Sep 17 00:00:00 2001 From: Ricky Date: Thu, 11 Dec 2025 15:12:39 -0500 Subject: [PATCH 2/9] 12/11 blog post (#8193) --- ...ulnerability-in-react-server-components.md | 18 +- ...ode-exposure-in-react-server-components.md | 165 ++++++++++++++++++ src/content/blog/index.md | 6 + src/content/versions.md | 3 + src/sidebarBlog.json | 9 +- 5 files changed, 199 insertions(+), 2 deletions(-) create mode 100644 src/content/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components.md diff --git a/src/content/blog/2025/12/03/critical-security-vulnerability-in-react-server-components.md b/src/content/blog/2025/12/03/critical-security-vulnerability-in-react-server-components.md index 90a549bc2a..3fe7c0bd29 100644 --- a/src/content/blog/2025/12/03/critical-security-vulnerability-in-react-server-components.md +++ b/src/content/blog/2025/12/03/critical-security-vulnerability-in-react-server-components.md @@ -42,7 +42,7 @@ If your app’s React code does not use a server, your app is not affected by th Some React frameworks and bundlers depended on, had peer dependencies for, or included the vulnerable React packages. The following React frameworks & bundlers are affected: [next](https://www.npmjs.com/package/next), [react-router](https://www.npmjs.com/package/react-router), [waku](https://www.npmjs.com/package/waku), [@parcel/rsc](https://www.npmjs.com/package/@parcel/rsc), [@vitejs/plugin-rsc](https://www.npmjs.com/package/@vitejs/plugin-rsc), and [rwsdk](https://www.npmjs.com/package/rwsdk). -We will update this post with upgrade instructions on how to upgrade as they become available. +See the [update instructions below](#update-instructions) for how to upgrade to these patches. ### Hosting Provider Mitigations {/*hosting-provider-mitigations*/} @@ -156,6 +156,22 @@ Update to the latest version: npm install react@latest react-dom@latest react-server-dom-webpack@latest ``` + +### React Native {/*react-native*/} + +For React Native users not using a monorepo or `react-dom`, your `react` version should be pinned in your `package.json`, and there are no additional steps needed. + +If you are using React Native in a monorepo, you should update _only_ the impacted packages if they are installed: + +- `react-server-dom-webpack` +- `react-server-dom-parcel` +- `react-server-dom-turbopack` + +This is required to mitigate the security advisory, but you do not need to update `react` and `react-dom` so this will not cause the version mismatch error in React Native. + +See [this issue](https://github.com/facebook/react-native/issues/54772#issuecomment-3617929832) for more information. + + ## Timeline {/*timeline*/} * **November 29th**: Lachlan Davidson reported the security vulnerability via [Meta Bug Bounty](https://bugbounty.meta.com/). diff --git a/src/content/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components.md b/src/content/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components.md new file mode 100644 index 0000000000..e1360226fb --- /dev/null +++ b/src/content/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components.md @@ -0,0 +1,165 @@ +--- +title: "Denial of Service and Source Code Exposure in React Server Components" +author: The React Team +date: 2025/12/11 +description: Security researchers have found and disclosed two additional vulnerabilities in React Server Components while attempting to exploit the patches in last week’s critical vulnerability. High vulnerability Denial of Service (CVE-2025-55184), and medium vulnerability Source Code Exposure (CVE-2025-55183) + + +--- + +December 11, 2025 by [The React Team](/community/team) + +--- + + + +Security researchers have found and disclosed two additional vulnerabilities in React Server Components while attempting to exploit the patches in last week’s critical vulnerability. + +**These new vulnerabilities do not allow for Remote Code Execution.** The patch for React2Shell remains effective at mitigating the Remote Code Execution exploit. + + + +--- + +The new vulnerabilities are disclosed as: + +- **Denial of Service - High Severity**: [CVE-2025-55184](https://www.cve.org/CVERecord?id=CVE-2025-55184) (CVSS 7.5) +- **Source Code Exposure - Medium Severity**: [CVE-2025-55183](https://www.cve.org/CVERecord?id=CVE-2025-55183) (CVSS 5.3) + +These issues are present in the patches published last week. + +We recommend upgrading immediately due to the severity of the newly disclosed vulnerabilities. + + + + +#### It’s common for critical CVEs to uncover follow‑up vulnerabilities. {/*its-common-for-critical-cves-to-uncover-followup-vulnerabilities*/} + +When a critical vulnerability is disclosed, researchers scrutinize adjacent code paths looking for variant exploit techniques to test whether the initial mitigation can be bypassed. + +This pattern shows up across the industry, not just in JavaScript. For example, after [Log4Shell](https://nvd.nist.gov/vuln/detail/cve-2021-44228), additional CVEs ([1](https://nvd.nist.gov/vuln/detail/cve-2021-45046), [2](https://nvd.nist.gov/vuln/detail/cve-2021-45105)) were reported as the community probed the original fix. + +Additional disclosures can be frustrating, but they are generally a sign of a healthy response cycle. + + + +Further details of these vulnerabilities will be provided after the rollout of the fixes are complete. + +## Immediate Action Required {/*immediate-action-required*/} + +These vulnerabilities are present in the same packages and versions as [CVE-2025-55182](http://localhost:3000/blog/2025/12/03/critical-security-vulnerability-in-react-server-components). + +This includes versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1 of: + +* [react-server-dom-webpack](https://www.npmjs.com/package/react-server-dom-webpack) +* [react-server-dom-parcel](https://www.npmjs.com/package/react-server-dom-parcel) +* [react-server-dom-turbopack](https://www.npmjs.com/package/react-server-dom-turbopack?activeTab=readme) + +Fixes were backported to versions 19.0.2, 19.1.3, and 19.2.2. If you are using any of the above packages please upgrade to any of the fixed versions immediately. + +As before, if your app’s React code does not use a server, your app is not affected by these vulnerabilities. If your app does not use a framework, bundler, or bundler plugin that supports React Server Components, your app is not affected by these vulnerabilities. + + + +#### The patches published last week are vulnerable. {/*the-patches-published-last-week-are-vulnerable*/} + +If you already updated for the Critical Security Vulnerability, you will need to update again. + + + +### Affected frameworks and bundlers {/*affected-frameworks-and-bundlers*/} + +Some React frameworks and bundlers depended on, had peer dependencies for, or included the vulnerable React packages. The following React frameworks & bundlers are affected: [next](https://www.npmjs.com/package/next), [react-router](https://www.npmjs.com/package/react-router), [waku](https://www.npmjs.com/package/waku), [@parcel/rsc](https://www.npmjs.com/package/@parcel/rsc), [@vite/rsc-plugin](https://www.npmjs.com/package/@vitejs/plugin-rsc), and [rwsdk](https://www.npmjs.com/package/rwsdk). + +Please see [the instructions in the previous post](https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components#update-instructions) for upgrade steps. + +### Hosting Provider Mitigations {/*hosting-provider-mitigations*/} + +As before, we have worked with a number of hosting providers to apply temporary mitigations. + +You should not depend on these to secure your app, and still update immediately. + +### React Native {/*react-native*/} + +For React Native users not using a monorepo or `react-dom`, your `react` version should be pinned in your `package.json`, and there are no additional steps needed. + +If you are using React Native in a monorepo, you should update _only_ the impacted packages if they are installed: + +- `react-server-dom-webpack` +- `react-server-dom-parcel` +- `react-server-dom-turbopack` + +This is required to mitigate the security advisories, but you do not need to update `react` and `react-dom` so this will not cause the version mismatch error in React Native. + +See [this issue](https://github.com/facebook/react-native/issues/54772#issuecomment-3617929832) for more information. + +## High Severity: Denial of Service {/*high-severity-denial-of-service*/} + +**CVE:** [CVE-2025-55184](https://www.cve.org/CVERecord?id=CVE-2025-55184) +**Base Score:** 7.5 (High) + +Security researchers have discovered that a malicious HTTP request can be crafted and sent to any Server Functions endpoint that, when deserialized by React, can cause an infinite loop that hangs the server process and consumes CPU. Even if your app does not implement any React Server Function endpoints it may still be vulnerable if your app supports React Server Components. + +This creates a vulnerability vector where an attacker may be able to deny users from accessing the product, and potentially have a performance impact on the server environment. + +The patches published today mitigate by preventing the infinite loop. + + +## Medium Severity: Source Code Exposure {/*low-severity-source-code-exposure*/} + +**CVE:** [CVE-2025-55183](https://www.cve.org/CVERecord?id=CVE-2025-55183) +**Base Score**: 5.3 (Medium) + +A security researcher has discovered that a malicious HTTP request sent to a vulnerable Server Function may unsafely return the source code of any Server Function. Exploitation requires the existence of a Server Function which explicitly or implicitly exposes a stringified argument: + +```javascript +'use server'; + +export async function serverFunction(name) { + const conn = db.createConnection('SECRET KEY'); + const user = await conn.createUser(name); // implicitly stringified, leaked in db + + return { + id: user.id, + message: `Hello, ${name}!` // explicitly stringified, leaked in reply + }} +``` + +An attacker may be able to leak the following: + +```txt +0:{"a":"$@1","f":"","b":"Wy43RxUKdxmr5iuBzJ1pN"} +1:{"id":"tva1sfodwq","message":"Hello, async function(a){console.log(\"serverFunction\");let b=i.createConnection(\"SECRET KEY\");return{id:(await b.createUser(a)).id,message:`Hello, ${a}!`}}!"} +``` + +The patches published today prevent stringifying the Server Function source code. + + + +#### Only secrets in source code may be exposed. {/*only-secrets-in-source-code-may-be-exposed*/} + +Secrets hardcoded in source code may be exposed, but runtime secrets such as `process.env.SECRET` are not affected. + +The scope of the exposed code is limited to the code inside the Server Function, which may include other functions depending on the amount of inlining your bundler provides. + +Always verify against production bundles. + + + +--- + +## Timeline {/*timeline*/} +* **December 3rd**: Leak reported to Vercel and [Meta Bug Bounty](https://bugbounty.meta.com/) by [Andrew MacPherson](https://github.com/AndrewMohawk). +* **December 4th**: Initial DoS reported to [Meta Bug Bounty](https://bugbounty.meta.com/) by [RyotaK](https://ryotak.net). +* **December 6th**: Both issues confirmed by the React team, and the team began investigating. +* **December 7th**: Initial fixes created and the React team began verifying and planning new patch. +* **December 8th**: Affected hosting providers and open source projects notified. +* **December 10th**: Hosting provider mitigations in place and patches verified. +* **December 11th**: Additional DoS reported to [Meta Bug Bounty](https://bugbounty.meta.com/) and added to patch. +* **December 11th**: Patches published and publicly disclosed as [CVE-2025-55183](https://www.cve.org/CVERecord?id=CVE-2025-55183) and [CVE-2025-55184](https://www.cve.org/CVERecord?id=CVE-2025-55184). + +--- + +## Attribution {/*attribution*/} + +Thank you to [Andrew MacPherson (AndrewMohawk)](https://github.com/AndrewMohawk) for reporting the Source Code Exposure, [RyotaK](https://ryotak.net) from GMO Flatt Security Inc for reporting the initial Denial of Service vulnerability. diff --git a/src/content/blog/index.md b/src/content/blog/index.md index 5a2f1b7f19..30c4a3ffe3 100644 --- a/src/content/blog/index.md +++ b/src/content/blog/index.md @@ -12,6 +12,12 @@ You can also follow the [@react.dev](https://bsky.app/profile/react.dev) account
+ + +Security researchers have found and disclosed two additional vulnerabilities in React Server Components while attempting to exploit the patches in last week’s critical vulnerability... + + + There is an unauthenticated remote code execution vulnerability in React Server Components. A fix has been published in versions 19.0.1, 19.1.2, and 19.2.1. We recommend upgrading immediately. diff --git a/src/content/versions.md b/src/content/versions.md index 5b3cb2cd94..62be00cc30 100644 --- a/src/content/versions.md +++ b/src/content/versions.md @@ -54,11 +54,14 @@ For versions older than React 15, see [15.react.dev](https://15.react.dev). - [React 19 Deep Dive: Coordinating HTML](https://www.youtube.com/watch?v=IBBN-s77YSI) **Releases** +- [v19.2.1 (December, 2025)](https://github.com/facebook/react/blob/main/CHANGELOG.md#1922-dec-11-2025) - [v19.2.1 (December, 2025)](https://github.com/facebook/react/blob/main/CHANGELOG.md#1921-dec-3-2025) - [v19.2.0 (October, 2025)](https://github.com/facebook/react/blob/main/CHANGELOG.md#1920-october-1st-2025) +- [v19.1.3 (December, 2025)](https://github.com/facebook/react/blob/main/CHANGELOG.md#1913-dec-11-2025) - [v19.1.2 (December, 2025)](https://github.com/facebook/react/blob/main/CHANGELOG.md#1912-dec-3-2025) - [v19.1.1 (July, 2025)](https://github.com/facebook/react/blob/main/CHANGELOG.md#1911-july-28-2025) - [v19.1.0 (March, 2025)](https://github.com/facebook/react/blob/main/CHANGELOG.md#1910-march-28-2025) +- [v19.0.2 (December, 2025)](https://github.com/facebook/react/blob/main/CHANGELOG.md#1902-dec-11-2025) - [v19.0.1 (December, 2025)](https://github.com/facebook/react/blob/main/CHANGELOG.md#1901-dec-3-2025) - [v19.0.0 (December, 2024)](https://github.com/facebook/react/blob/main/CHANGELOG.md#1900-december-5-2024) diff --git a/src/sidebarBlog.json b/src/sidebarBlog.json index b048ba9ca9..e5da90fe94 100644 --- a/src/sidebarBlog.json +++ b/src/sidebarBlog.json @@ -11,11 +11,18 @@ "path": "/blog", "skipBreadcrumb": true, "routes": [ + { + "title": "Denial of Service and Source Code Exposure in React Server Components", + "titleForHomepage": "Additional Vulnerabilities in RSC", + "icon": "blog", + "date": "December 11, 2025", + "path": "/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components" + }, { "title": "Critical Security Vulnerability in React Server Components", "titleForHomepage": "Vulnerability in React Server Components", "icon": "blog", - "date": "December 03, 2025", + "date": "December 3, 2025", "path": "/blog/2025/12/03/critical-security-vulnerability-in-react-server-components" }, { From 1a955f0323af1beda3123dfe9cec86b9c3c82c45 Mon Sep 17 00:00:00 2001 From: Ricky Date: Thu, 11 Dec 2025 16:18:58 -0500 Subject: [PATCH 3/9] rm localhost link (#8194) --- ...rvice-and-source-code-exposure-in-react-server-components.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/content/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components.md b/src/content/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components.md index e1360226fb..ed491cddcd 100644 --- a/src/content/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components.md +++ b/src/content/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components.md @@ -47,7 +47,7 @@ Further details of these vulnerabilities will be provided after the rollout of t ## Immediate Action Required {/*immediate-action-required*/} -These vulnerabilities are present in the same packages and versions as [CVE-2025-55182](http://localhost:3000/blog/2025/12/03/critical-security-vulnerability-in-react-server-components). +These vulnerabilities are present in the same packages and versions as [CVE-2025-55182](/blog/2025/12/03/critical-security-vulnerability-in-react-server-components). This includes versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1 of: From 72f8998872ab958924a0ff1fda818fae48d5b031 Mon Sep 17 00:00:00 2001 From: Ricky Date: Thu, 11 Dec 2025 17:15:41 -0500 Subject: [PATCH 4/9] Update instructions (#8195) --- ...ulnerability-in-react-server-components.md | 31 +++++++++++++------ ...ode-exposure-in-react-server-components.md | 19 ++++++------ 2 files changed, 31 insertions(+), 19 deletions(-) diff --git a/src/content/blog/2025/12/03/critical-security-vulnerability-in-react-server-components.md b/src/content/blog/2025/12/03/critical-security-vulnerability-in-react-server-components.md index 3fe7c0bd29..d47730ecd4 100644 --- a/src/content/blog/2025/12/03/critical-security-vulnerability-in-react-server-components.md +++ b/src/content/blog/2025/12/03/critical-security-vulnerability-in-react-server-components.md @@ -58,27 +58,40 @@ An unauthenticated attacker could craft a malicious HTTP request to any Server F ## Update Instructions {/*update-instructions*/} + + +These instructions have been updated to include the new vulnerabilities: + + +- **Denial of Service - High Severity**: [CVE-2025-55184](https://www.cve.org/CVERecord?id=CVE-2025-55184) (CVSS 7.5) +- **Source Code Exposure - Medium Severity**: [CVE-2025-55183](https://www.cve.org/CVERecord?id=CVE-2025-55183) (CVSS 5.3) + +See the [follow-up blog post](/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components) for more info. + + + ### Next.js {/*update-next-js*/} All users should upgrade to the latest patched version in their release line: ```bash -npm install next@15.0.5 // for 15.0.x -npm install next@15.1.9 // for 15.1.x -npm install next@15.2.6 // for 15.2.x -npm install next@15.3.6 // for 15.3.x -npm install next@15.4.8 // for 15.4.x -npm install next@15.5.7 // for 15.5.x -npm install next@16.0.7 // for 16.0.x +npm install next@14.2.34 // for 14.x +npm install next@15.0.6 // for 15.0.x +npm install next@15.1.10 // for 15.1.x +npm install next@15.2.7 // for 15.2.x +npm install next@15.3.7 // for 15.3.x +npm install next@15.4.9 // for 15.4.x +npm install next@15.5.8 // for 15.5.x +npm install next@16.0.9 // for 16.0.x ``` -If you are on Next.js 14.3.0-canary.77 or a later canary release, downgrade to the latest stable 14.x release: +If you are on `next@14.3.0-canary.77` or a later canary release, downgrade to the latest stable 14.x release: ```bash npm install next@14 ``` -See the [Next.js changelog](https://nextjs.org/blog/CVE-2025-66478) for more info. +See the [Next.js blog](https://nextjs.org/blog/security-update-2025-12-11) for the latest update instructions and the [previous changelog](https://nextjs.org/blog/CVE-2025-66478) for more info. ### React Router {/*update-react-router*/} diff --git a/src/content/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components.md b/src/content/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components.md index ed491cddcd..54e4a87608 100644 --- a/src/content/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components.md +++ b/src/content/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components.md @@ -26,20 +26,15 @@ The new vulnerabilities are disclosed as: - **Denial of Service - High Severity**: [CVE-2025-55184](https://www.cve.org/CVERecord?id=CVE-2025-55184) (CVSS 7.5) - **Source Code Exposure - Medium Severity**: [CVE-2025-55183](https://www.cve.org/CVERecord?id=CVE-2025-55183) (CVSS 5.3) -These issues are present in the patches published last week. - We recommend upgrading immediately due to the severity of the newly disclosed vulnerabilities. - -#### It’s common for critical CVEs to uncover follow‑up vulnerabilities. {/*its-common-for-critical-cves-to-uncover-followup-vulnerabilities*/} - -When a critical vulnerability is disclosed, researchers scrutinize adjacent code paths looking for variant exploit techniques to test whether the initial mitigation can be bypassed. +#### The patches published last week are vulnerable. {/*the-patches-published-last-week-are-vulnerable*/} -This pattern shows up across the industry, not just in JavaScript. For example, after [Log4Shell](https://nvd.nist.gov/vuln/detail/cve-2021-44228), additional CVEs ([1](https://nvd.nist.gov/vuln/detail/cve-2021-45046), [2](https://nvd.nist.gov/vuln/detail/cve-2021-45105)) were reported as the community probed the original fix. +If you already updated for the Critical Security Vulnerability, you will need to update again. -Additional disclosures can be frustrating, but they are generally a sign of a healthy response cycle. +Please see [the instructions in the previous post](/blog/2025/12/03/critical-security-vulnerability-in-react-server-components#update-instructions) for upgrade steps. @@ -61,9 +56,13 @@ As before, if your app’s React code does not use a server, your app is not aff -#### The patches published last week are vulnerable. {/*the-patches-published-last-week-are-vulnerable*/} +#### It’s common for critical CVEs to uncover follow‑up vulnerabilities. {/*its-common-for-critical-cves-to-uncover-followup-vulnerabilities*/} -If you already updated for the Critical Security Vulnerability, you will need to update again. +When a critical vulnerability is disclosed, researchers scrutinize adjacent code paths looking for variant exploit techniques to test whether the initial mitigation can be bypassed. + +This pattern shows up across the industry, not just in JavaScript. For example, after [Log4Shell](https://nvd.nist.gov/vuln/detail/cve-2021-44228), additional CVEs ([1](https://nvd.nist.gov/vuln/detail/cve-2021-45046), [2](https://nvd.nist.gov/vuln/detail/cve-2021-45105)) were reported as the community probed the original fix. + +Additional disclosures can be frustrating, but they are generally a sign of a healthy response cycle. From e44d3b70a04e7ab23ccdc9cbd9d1dd8ece81cc0b Mon Sep 17 00:00:00 2001 From: Ricky Date: Thu, 11 Dec 2025 18:55:34 -0500 Subject: [PATCH 5/9] Add additional DoS CVE (#8196) --- ...ode-exposure-in-react-server-components.md | 30 ++++++++++++++----- 1 file changed, 22 insertions(+), 8 deletions(-) diff --git a/src/content/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components.md b/src/content/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components.md index 54e4a87608..119317edca 100644 --- a/src/content/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components.md +++ b/src/content/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components.md @@ -23,16 +23,18 @@ Security researchers have found and disclosed two additional vulnerabilities in The new vulnerabilities are disclosed as: -- **Denial of Service - High Severity**: [CVE-2025-55184](https://www.cve.org/CVERecord?id=CVE-2025-55184) (CVSS 7.5) +- **Denial of Service - High Severity**: [CVE-2025-55184](https://www.cve.org/CVERecord?id=CVE-2025-55184) and [CVE-2025-67779](https://www.cve.org/CVERecord?id=CVE-2025-67779) (CVSS 7.5) - **Source Code Exposure - Medium Severity**: [CVE-2025-55183](https://www.cve.org/CVERecord?id=CVE-2025-55183) (CVSS 5.3) We recommend upgrading immediately due to the severity of the newly disclosed vulnerabilities. -#### The patches published last week are vulnerable. {/*the-patches-published-last-week-are-vulnerable*/} +#### The patches published earlier are vulnerable. {/*the-patches-published-earlier-are-vulnerable*/} -If you already updated for the Critical Security Vulnerability, you will need to update again. +If you already updated for the Critical Security Vulnerability last week, you will need to update again. + +If you updated to 19.0.2, 19.1.3, and 19.2.2, [these are incomplete](#additional-fix-published) and you will need to update again. Please see [the instructions in the previous post](/blog/2025/12/03/critical-security-vulnerability-in-react-server-components#update-instructions) for upgrade steps. @@ -44,13 +46,13 @@ Further details of these vulnerabilities will be provided after the rollout of t These vulnerabilities are present in the same packages and versions as [CVE-2025-55182](/blog/2025/12/03/critical-security-vulnerability-in-react-server-components). -This includes versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1 of: +This includes versions 19.0.0, 19.0.1, 19.0.2, 19.1.0, 19.1.1, 19.1.2, 19.1.2, 19.2.0, 19.2.1 and 19.2.2 of: * [react-server-dom-webpack](https://www.npmjs.com/package/react-server-dom-webpack) * [react-server-dom-parcel](https://www.npmjs.com/package/react-server-dom-parcel) * [react-server-dom-turbopack](https://www.npmjs.com/package/react-server-dom-turbopack?activeTab=readme) -Fixes were backported to versions 19.0.2, 19.1.3, and 19.2.2. If you are using any of the above packages please upgrade to any of the fixed versions immediately. +Fixes were backported to versions 19.0.3, 19.1.4, and 19.2.3. If you are using any of the above packages please upgrade to any of the fixed versions immediately. As before, if your app’s React code does not use a server, your app is not affected by these vulnerabilities. If your app does not use a framework, bundler, or bundler plugin that supports React Server Components, your app is not affected by these vulnerabilities. @@ -94,7 +96,7 @@ See [this issue](https://github.com/facebook/react-native/issues/54772#issuecomm ## High Severity: Denial of Service {/*high-severity-denial-of-service*/} -**CVE:** [CVE-2025-55184](https://www.cve.org/CVERecord?id=CVE-2025-55184) +**CVEs:** [CVE-2025-55184](https://www.cve.org/CVERecord?id=CVE-2025-55184) and [CVE-2025-67779](https://www.cve.org/CVERecord?id=CVE-2025-67779) **Base Score:** 7.5 (High) Security researchers have discovered that a malicious HTTP request can be crafted and sent to any Server Functions endpoint that, when deserialized by React, can cause an infinite loop that hangs the server process and consumes CPU. Even if your app does not implement any React Server Function endpoints it may still be vulnerable if your app supports React Server Components. @@ -103,6 +105,17 @@ This creates a vulnerability vector where an attacker may be able to deny users The patches published today mitigate by preventing the infinite loop. + + +#### Additional fix published {/*additional-fix-published*/} + +The original fix addressing the DoS in [CVE-2025-55184](https://www.cve.org/CVERecord?id=CVE-2025-55184) was incomplete. + +This left versions 19.0.2, 19.1.3, 19.2.2 vulnerable. Versions 19.0.3, 19.1.4, 19.2.3 are safe. + +We've fixed the additional cases and filed [CVE-2025-67779](https://www.cve.org/CVERecord?id=CVE-2025-67779) for the vulnerable versions. + + ## Medium Severity: Source Code Exposure {/*low-severity-source-code-exposure*/} @@ -154,11 +167,12 @@ Always verify against production bundles. * **December 7th**: Initial fixes created and the React team began verifying and planning new patch. * **December 8th**: Affected hosting providers and open source projects notified. * **December 10th**: Hosting provider mitigations in place and patches verified. -* **December 11th**: Additional DoS reported to [Meta Bug Bounty](https://bugbounty.meta.com/) and added to patch. +* **December 11th**: Additional DoS reported to [Meta Bug Bounty](https://bugbounty.meta.com/) by Shinsaku Nomura. * **December 11th**: Patches published and publicly disclosed as [CVE-2025-55183](https://www.cve.org/CVERecord?id=CVE-2025-55183) and [CVE-2025-55184](https://www.cve.org/CVERecord?id=CVE-2025-55184). +* **December 11th**: Missing DoS case found internally, patched and publicly disclosed as [CVE-2025-67779](https://www.cve.org/CVERecord?id=CVE-2025-67779). --- ## Attribution {/*attribution*/} -Thank you to [Andrew MacPherson (AndrewMohawk)](https://github.com/AndrewMohawk) for reporting the Source Code Exposure, [RyotaK](https://ryotak.net) from GMO Flatt Security Inc for reporting the initial Denial of Service vulnerability. +Thank you to [Andrew MacPherson (AndrewMohawk)](https://github.com/AndrewMohawk) for reporting the Source Code Exposure, [RyotaK](https://ryotak.net) from GMO Flatt Security Inc and Shinsaku Nomura of Bitforest Co., Ltd. for reporting the Denial of Service vulnerabilities. From 9527378306f12e588c6f7db8499c96dc90cadf2b Mon Sep 17 00:00:00 2001 From: Ricky Date: Thu, 11 Dec 2025 19:18:26 -0500 Subject: [PATCH 6/9] update nextjs instructions (#8197) --- ...itical-security-vulnerability-in-react-server-components.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/content/blog/2025/12/03/critical-security-vulnerability-in-react-server-components.md b/src/content/blog/2025/12/03/critical-security-vulnerability-in-react-server-components.md index d47730ecd4..aa6f8f1ada 100644 --- a/src/content/blog/2025/12/03/critical-security-vulnerability-in-react-server-components.md +++ b/src/content/blog/2025/12/03/critical-security-vulnerability-in-react-server-components.md @@ -62,10 +62,11 @@ An unauthenticated attacker could craft a malicious HTTP request to any Server F These instructions have been updated to include the new vulnerabilities: - - **Denial of Service - High Severity**: [CVE-2025-55184](https://www.cve.org/CVERecord?id=CVE-2025-55184) (CVSS 7.5) - **Source Code Exposure - Medium Severity**: [CVE-2025-55183](https://www.cve.org/CVERecord?id=CVE-2025-55183) (CVSS 5.3) +They also include the additional case found, patched, and disclosed as [CVE-2025-67779](https://www.cve.org/CVERecord?id=CVE-2025-67779). + See the [follow-up blog post](/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components) for more info. From 1e74023dd276f15530bf7c3e3bb4f7420291c8b0 Mon Sep 17 00:00:00 2001 From: Matt Carroll <7158882+mattcarrollcode@users.noreply.github.com> Date: Thu, 11 Dec 2025 17:01:10 -0800 Subject: [PATCH 7/9] [Blog] Update safe Next.js versions (#8199) --- ...ulnerability-in-react-server-components.md | 27 +++++++++++-------- 1 file changed, 16 insertions(+), 11 deletions(-) diff --git a/src/content/blog/2025/12/03/critical-security-vulnerability-in-react-server-components.md b/src/content/blog/2025/12/03/critical-security-vulnerability-in-react-server-components.md index aa6f8f1ada..ffef6119d0 100644 --- a/src/content/blog/2025/12/03/critical-security-vulnerability-in-react-server-components.md +++ b/src/content/blog/2025/12/03/critical-security-vulnerability-in-react-server-components.md @@ -20,9 +20,9 @@ We recommend upgrading immediately. --- -On November 29th, Lachlan Davidson reported a security vulnerability in React that allows unauthenticated remote code execution by exploiting a flaw in how React decodes payloads sent to React Server Function endpoints. +On November 29th, Lachlan Davidson reported a security vulnerability in React that allows unauthenticated remote code execution by exploiting a flaw in how React decodes payloads sent to React Server Function endpoints. -Even if your app does not implement any React Server Function endpoints it may still be vulnerable if your app supports React Server Components. +Even if your app does not implement any React Server Function endpoints it may still be vulnerable if your app supports React Server Components. This vulnerability was disclosed as [CVE-2025-55182](https://www.cve.org/CVERecord?id=CVE-2025-55182) and is rated CVSS 10.0. @@ -40,7 +40,7 @@ If your app’s React code does not use a server, your app is not affected by th ### Affected frameworks and bundlers {/*affected-frameworks-and-bundlers*/} -Some React frameworks and bundlers depended on, had peer dependencies for, or included the vulnerable React packages. The following React frameworks & bundlers are affected: [next](https://www.npmjs.com/package/next), [react-router](https://www.npmjs.com/package/react-router), [waku](https://www.npmjs.com/package/waku), [@parcel/rsc](https://www.npmjs.com/package/@parcel/rsc), [@vitejs/plugin-rsc](https://www.npmjs.com/package/@vitejs/plugin-rsc), and [rwsdk](https://www.npmjs.com/package/rwsdk). +Some React frameworks and bundlers depended on, had peer dependencies for, or included the vulnerable React packages. The following React frameworks & bundlers are affected: [next](https://www.npmjs.com/package/next), [react-router](https://www.npmjs.com/package/react-router), [waku](https://www.npmjs.com/package/waku), [@parcel/rsc](https://www.npmjs.com/package/@parcel/rsc), [@vitejs/plugin-rsc](https://www.npmjs.com/package/@vitejs/plugin-rsc), and [rwsdk](https://www.npmjs.com/package/rwsdk). See the [update instructions below](#update-instructions) for how to upgrade to these patches. @@ -76,16 +76,21 @@ See the [follow-up blog post](/blog/2025/12/11/denial-of-service-and-source-code All users should upgrade to the latest patched version in their release line: ```bash -npm install next@14.2.34 // for 14.x -npm install next@15.0.6 // for 15.0.x -npm install next@15.1.10 // for 15.1.x -npm install next@15.2.7 // for 15.2.x -npm install next@15.3.7 // for 15.3.x -npm install next@15.4.9 // for 15.4.x -npm install next@15.5.8 // for 15.5.x -npm install next@16.0.9 // for 16.0.x +npm install next@14.2.35 // for 13.3.x, 13.4.x, 13.5.x, 14.x +npm install next@15.0.7 // for 15.0.x +npm install next@15.1.11 // for 15.1.x +npm install next@15.2.8 // for 15.2.x +npm install next@15.3.8 // for 15.3.x +npm install next@15.4.10 // for 15.4.x +npm install next@15.5.9 // for 15.5.x +npm install next@16.0.10 // for 16.0.x + +npm install next@15.6.0-canary.60 // for 15.x canary releases +npm install next@16.1.0-canary.19 // for 16.x canary releases ``` +If you are on version `13.3` or later version of Next.js 13 (`13.3.x`, `13.4.x`, or `13.5.x`) please upgrade to version `14.2.35`. + If you are on `next@14.3.0-canary.77` or a later canary release, downgrade to the latest stable 14.x release: ```bash From 2da4f7fbd90ddc09835c9f85d61fd5644a271abc Mon Sep 17 00:00:00 2001 From: Matt Carroll <7158882+mattcarrollcode@users.noreply.github.com> Date: Thu, 11 Dec 2025 17:06:56 -0800 Subject: [PATCH 8/9] Update to Next.js 15.1.11 (#8200) --- package.json | 2 +- yarn.lock | 18 +++++++++--------- 2 files changed, 10 insertions(+), 10 deletions(-) diff --git a/package.json b/package.json index 657be88775..55fcc0a5b7 100644 --- a/package.json +++ b/package.json @@ -35,7 +35,7 @@ "classnames": "^2.2.6", "debounce": "^1.2.1", "github-slugger": "^1.3.0", - "next": "15.1.9", + "next": "15.1.11", "next-remote-watch": "^1.0.0", "parse-numeric-range": "^1.2.0", "react": "^19.0.0", diff --git a/yarn.lock b/yarn.lock index a07b2f2800..a1ce77d117 100644 --- a/yarn.lock +++ b/yarn.lock @@ -1225,10 +1225,10 @@ unist-util-visit "^4.0.0" vfile "^5.0.0" -"@next/env@15.1.9": - version "15.1.9" - resolved "https://registry.yarnpkg.com/@next/env/-/env-15.1.9.tgz#3569b6dd6a9b0af998fc6e4902da6b9ed2fc36c9" - integrity sha512-Te1wbiJ//I40T7UePOUG8QBwh+VVMCc0OTuqesOcD3849TVOVOyX4Hdrkx7wcpLpy/LOABIcGyLX5P/SzzXhFA== +"@next/env@15.1.11": + version "15.1.11" + resolved "https://registry.yarnpkg.com/@next/env/-/env-15.1.11.tgz#599a126f7ce56decc39cea46668cb60d96b66bc6" + integrity sha512-yp++FVldfLglEG5LoS2rXhGypPyoSOyY0kxZQJ2vnlYJeP8o318t5DrDu5Tqzr03qAhDWllAID/kOCsXNLcwKw== "@next/eslint-plugin-next@12.0.3": version "12.0.3" @@ -5797,12 +5797,12 @@ next-tick@^1.1.0: resolved "https://registry.npmjs.org/next-tick/-/next-tick-1.1.0.tgz" integrity sha512-CXdUiJembsNjuToQvxayPZF9Vqht7hewsvy2sOWafLvi2awflj9mOC6bHIg50orX8IJvWKY9wYQ/zB2kogPslQ== -next@15.1.9: - version "15.1.9" - resolved "https://registry.yarnpkg.com/next/-/next-15.1.9.tgz#eaab46d7a57c881fadf748d8ba2a8c65ec27ad8f" - integrity sha512-OoQpDPV2i3o5Hnn46nz2x6fzdFxFO+JsU4ZES12z65/feMjPHKKHLDVQ2NuEvTaXTRisix/G5+6hyTkwK329kA== +next@15.1.11: + version "15.1.11" + resolved "https://registry.yarnpkg.com/next/-/next-15.1.11.tgz#8a70a236e02d8dd62fb0569bedfd5e4290e7af55" + integrity sha512-UiVJaOGhKST58AadwbFUZThlNBmYhKqaCs8bVtm4plTxsgKq0mJ0zTsp7t7j/rzsbAEj9WcAMdZCztjByi4EoQ== dependencies: - "@next/env" "15.1.9" + "@next/env" "15.1.11" "@swc/counter" "0.1.3" "@swc/helpers" "0.5.15" busboy "1.6.0" From edc6ba6a1c633d2fb5002589488f325b551ca79b Mon Sep 17 00:00:00 2001 From: Xleine Date: Wed, 14 Jan 2026 11:35:50 +0800 Subject: [PATCH 9/9] fix conflict --- src/content/blog/index.md | 10 +-- src/content/reference/react/useEffect.md | 78 +++---------------- .../reference/react/useLayoutEffect.md | 10 +-- src/content/versions.md | 4 - src/sidebarBlog.json | 10 +-- 5 files changed, 22 insertions(+), 90 deletions(-) diff --git a/src/content/blog/index.md b/src/content/blog/index.md index 922c010c4c..3d68154ad6 100644 --- a/src/content/blog/index.md +++ b/src/content/blog/index.md @@ -11,17 +11,13 @@ title: React Blog
-<<<<<<< HEAD - -======= - + -Security researchers have found and disclosed two additional vulnerabilities in React Server Components while attempting to exploit the patches in last week’s critical vulnerability... +安全研究员在尝试利用上周公布的严重漏洞补丁时，又发现了 React 服务器组件中的两个漏洞并进行披露…… - ->>>>>>> 2da4f7fbd90ddc09835c9f85d61fd5644a271abc + 服务器组件中存在未经身份验证的远程代码执行漏洞。版本 19.0.1、19.1.2 和 19.2.1 已经修复该漏洞。我们建议立即升级。 diff --git a/src/content/reference/react/useEffect.md b/src/content/reference/react/useEffect.md index 8a689c5165..9c6492a0eb 100644 --- a/src/content/reference/react/useEffect.md +++ b/src/content/reference/react/useEffect.md @@ -44,15 +44,9 @@ function ChatRoom({ roomId }) { #### 参数 {/*parameters*/} -<<<<<<< HEAD -* `setup`：处理 Effect 的函数。setup 函数选择性返回一个 **清理（cleanup）** 函数。当组件被添加到 DOM 的时候，React 将运行 setup 函数。在每次依赖项变更重新渲染后，React 将首先使用旧值运行 cleanup 函数（如果你提供了该函数），然后使用新值运行 setup 函数。在组件从 DOM 中移除后，React 将最后一次运行 cleanup 函数。 +* `setup`：处理 Effect 的函数。setup 函数选择性返回一个 **清理（cleanup）** 函数。当 [组件提交的时候](/learn/render-and-commit#step-3-react-commits-changes-to-the-dom)，React 会运行 setup 函数。在每次提交导致依赖项变更后，React 将首先使用旧值运行 cleanup 函数（如果你提供了该函数），然后使用新值运行 setup 函数。在组件从 DOM 中移除后，React 将最后一次运行 cleanup 函数。 -* **可选** `dependencies`：`setup` 代码中引用的所有响应式值的列表。响应式值包括 props、state 以及所有直接在组件内部声明的变量和函数。如果你的代码检查工具 [配置了 React](/learn/editor-setup#linting)，那么它将验证是否每个响应式值都被正确地指定为一个依赖项。依赖项列表的元素数量必须是固定的，并且必须像 `[dep1, dep2, dep3]` 这样内联编写。React 将使用 [`Object.is`](https://developer.mozilla.org/zh-CN/docs/Web/JavaScript/Reference/Global_Objects/Object/is) 来比较每个依赖项和它先前的值。如果省略此参数，则在每次重新渲染组件之后，将重新运行 Effect 函数。如果你想了解更多，请参见 [传递依赖数组、空数组和不传递依赖项之间的区别](#examples-dependencies)。 -======= -* `setup`: The function with your Effect's logic. Your setup function may also optionally return a *cleanup* function. When your [component commits](/learn/render-and-commit#step-3-react-commits-changes-to-the-dom), React will run your setup function. After every commit with changed dependencies, React will first run the cleanup function (if you provided it) with the old values, and then run your setup function with the new values. After your component is removed from the DOM, React will run your cleanup function. - -* **optional** `dependencies`: The list of all reactive values referenced inside of the `setup` code. Reactive values include props, state, and all the variables and functions declared directly inside your component body. If your linter is [configured for React](/learn/editor-setup#linting), it will verify that every reactive value is correctly specified as a dependency. The list of dependencies must have a constant number of items and be written inline like `[dep1, dep2, dep3]`. React will compare each dependency with its previous value using the [`Object.is`](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Object/is) comparison. If you omit this argument, your Effect will re-run after every commit of the component. [See the difference between passing an array of dependencies, an empty array, and no dependencies at all.](#examples-dependencies) ->>>>>>> 2da4f7fbd90ddc09835c9f85d61fd5644a271abc +* **可选** `dependencies`：`setup` 代码中引用的所有响应式值的列表。响应式值包括 props、state 以及所有直接在组件内部声明的变量和函数。如果你的代码检查工具 [配置了 React](/learn/editor-setup#linting)，那么它将验证是否每个响应式值都被正确地指定为一个依赖项。依赖项列表的元素数量必须是固定的，并且必须像 `[dep1, dep2, dep3]` 这样内联编写。React 将使用 [`Object.is`](https://developer.mozilla.org/zh-CN/docs/Web/JavaScript/Reference/Global_Objects/Object/is) 来比较每个依赖项和它先前的值。如果省略此参数，则在每次组件提交更改之后，将重新运行 Effect 函数。如果你想了解更多，请参见 [传递依赖数组、空数组和不传递依赖项之间的区别](#examples-dependencies)。 #### 返回值 {/*returns*/} @@ -112,27 +106,15 @@ function ChatRoom({ roomId }) { **React 在必要时会调用 setup 和 cleanup，这可能会发生多次**： -<<<<<<< HEAD 1. 将组件挂载到页面时，将运行 setup 代码。 -2. 重新渲染 依赖项 变更的组件后： +2. 如果组件提交导致 依赖项 被改变： - 首先，使用旧的 props 和 state 运行 cleanup 代码。 - 然后，使用新的 props 和 state 运行 setup 代码。 3. 当组件从页面卸载后，cleanup 代码 将运行最后一次。 -======= -1. Your setup code runs when your component is added to the page *(mounts)*. -2. After every commit of your component where the dependencies have changed: - - First, your cleanup code runs with the old props and state. - - Then, your setup code runs with the new props and state. -3. Your cleanup code runs one final time after your component is removed from the page *(unmounts).* ->>>>>>> 2da4f7fbd90ddc09835c9f85d61fd5644a271abc **用上面的代码作为例子来解释这个顺序**。 -<<<<<<< HEAD -当 `ChatRoom` 组件添加到页面中时，它将使用 `serverUrl` 和 `roomId` 初始值连接到聊天室。如果 `serverUrl` 或者 `roomId` 发生改变并导致重新渲染（比如用户在下拉列表中选择了一个不同的聊天室），那么 Effect 就会 **断开与前一个聊天室的连接，并连接到下一个聊天室**。当 `ChatRoom` 组件从页面中卸载时，你的 Effect 将最后一次断开连接。 -======= -When the `ChatRoom` component above gets added to the page, it will connect to the chat room with the initial `serverUrl` and `roomId`. If either `serverUrl` or `roomId` change as a result of a commit (say, if the user picks a different chat room in a dropdown), your Effect will *disconnect from the previous room, and connect to the next one.* When the `ChatRoom` component is removed from the page, your Effect will disconnect one last time. ->>>>>>> 2da4f7fbd90ddc09835c9f85d61fd5644a271abc +当 `ChatRoom` 组件添加到页面中时，它将使用 `serverUrl` 和 `roomId` 初始值连接到聊天室。如果 `serverUrl` 或者 `roomId` 发生改变并导致提交（比如用户在下拉列表中选择了一个不同的聊天室），那么 Effect 就会 **断开与前一个聊天室的连接，并连接到下一个聊天室**。当 `ChatRoom` 组件从页面中卸载时，你的 Effect 将最后一次断开连接。 **为了 [帮助你发现 bug](/learn/synchronizing-with-effects#step-3-add-cleanup-if-needed)，在开发环境下，React 在运行 setup 之前会额外运行一次setup 和 cleanup**。这是一个压力测试，用于验证 Effect 逻辑是否正确实现。如果这会导致可见的问题，那么你的 cleanup 函数就缺少一些逻辑。cleanup 函数应该停止或撤消 setup 函数正在执行的任何操作。一般来说，用户不应该能够区分只调用一次 setup（在生产环境中）与调用 *setup* → *cleanup* → *setup* 序列（在开发环境中）。[查看常见解决方案](/learn/synchronizing-with-effects#how-to-handle-the-effect-firing-twice-in-development)。 @@ -1163,11 +1145,7 @@ useEffect(() => { #### 传递依赖项数组 {/*passing-a-dependency-array*/} -<<<<<<< HEAD -如果指定了依赖项，则 Effect 在 **初始渲染后以及依赖项变更的重新渲染后** 运行。 -======= -If you specify the dependencies, your Effect runs **after the initial commit _and_ after commits with changed dependencies.** ->>>>>>> 2da4f7fbd90ddc09835c9f85d61fd5644a271abc +如果指定了依赖项，则 Effect 在 **初始提交后以及提交导致了依赖项变更后** 运行。 ```js {3} useEffect(() => { @@ -1264,11 +1242,7 @@ button { margin-left: 5px; } #### 传递空依赖项数组 {/*passing-an-empty-dependency-array*/} -<<<<<<< HEAD -如果你的 Effect 确实没有使用任何响应式值，则它仅在 **初始渲染后** 运行。 -======= -If your Effect truly doesn't use any reactive values, it will only run **after the initial commit.** ->>>>>>> 2da4f7fbd90ddc09835c9f85d61fd5644a271abc +如果你的 Effect 确实没有使用任何响应式值，则它仅在 **初始提交后** 运行。 ```js {3} useEffect(() => { @@ -1345,11 +1319,7 @@ export function createConnection(serverUrl, roomId) { #### 不传递依赖项数组 {/*passing-no-dependency-array-at-all*/} -<<<<<<< HEAD -如果完全不传递依赖数组，则 Effect 会在组件的 **每次单独渲染（和重新渲染）之后** 运行。 -======= -If you pass no dependency array at all, your Effect runs **after every single commit** of your component. ->>>>>>> 2da4f7fbd90ddc09835c9f85d61fd5644a271abc +如果完全不传递依赖数组，则 Effect 会在组件的 **每次单独提交之后** 运行。 ```js {3} useEffect(() => { @@ -1510,11 +1480,7 @@ body { ### 删除不必要的对象依赖项 {/*removing-unnecessary-object-dependencies*/} -<<<<<<< HEAD -如果你的 Effect 依赖于在渲染期间创建的对象或函数，则它可能会频繁运行。例如，此 Effect 在每次渲染后都重新连接，因为 `options` 对象 [每次渲染都不同](/learn/removing-effect-dependencies#does-some-reactive-value-change-unintentionally)： -======= -If your Effect depends on an object or a function created during rendering, it might run too often. For example, this Effect re-connects after every commit because the `options` object is [different for every render:](/learn/removing-effect-dependencies#does-some-reactive-value-change-unintentionally) ->>>>>>> 2da4f7fbd90ddc09835c9f85d61fd5644a271abc +如果你的 Effect 依赖于在渲染期间创建的对象或函数，则它可能会频繁运行。例如，此 Effect 在每次提交后都重新连接，因为 `options` 对象 [每次渲染都不同](/learn/removing-effect-dependencies#does-some-reactive-value-change-unintentionally)： ```js {6-9,12,15} const serverUrl = 'https://localhost:1234'; @@ -1531,11 +1497,7 @@ function ChatRoom({ roomId }) { const connection = createConnection(options); // 它在 Effect 内部使用 connection.connect(); return () => connection.disconnect(); -<<<<<<< HEAD - }, [options]); // 🚩 因此，这些依赖在重新渲染时总是不同的 -======= - }, [options]); // 🚩 As a result, these dependencies are always different on a commit ->>>>>>> 2da4f7fbd90ddc09835c9f85d61fd5644a271abc + }, [options]); // 🚩 因此，这些依赖在每次提交时总是不同的 // ... ``` @@ -1621,11 +1583,7 @@ button { margin-left: 10px; } ### 删除不必要的函数依赖项 {/*removing-unnecessary-function-dependencies*/} -<<<<<<< HEAD -如果你的 Effect 依赖于在渲染期间创建的对象或函数，则它可能会频繁运行。例如，此 Effect 在每次渲染后重新连接，因为 `createOptions` 函数 [在每次渲染时都不同](/learn/removing-effect-dependencies#does-some-reactive-value-change-unintentionally)： -======= -If your Effect depends on an object or a function created during rendering, it might run too often. For example, this Effect re-connects after every commit because the `createOptions` function is [different for every render:](/learn/removing-effect-dependencies#does-some-reactive-value-change-unintentionally) ->>>>>>> 2da4f7fbd90ddc09835c9f85d61fd5644a271abc +如果你的 Effect 依赖于在渲染期间创建的对象或函数，则它可能会频繁运行。例如，此 Effect 在每次提交后重新连接，因为 `createOptions` 函数 [在每次渲染时都不同](/learn/removing-effect-dependencies#does-some-reactive-value-change-unintentionally)： ```js {4-9,12,16} function ChatRoom({ roomId }) { @@ -1643,19 +1601,11 @@ function ChatRoom({ roomId }) { const connection = createConnection(); connection.connect(); return () => connection.disconnect(); -<<<<<<< HEAD - }, [createOptions]); // 🚩 因此，此依赖项在每次重新渲染都是不同的 + }, [createOptions]); // 🚩 因此，此依赖项在每次提交时都是不同的 // ... ``` 就其本身而言，在每次重新渲染时从头新建一个函数不是问题。你不需要优化它。但是，如果你将其用作 Effect 的依赖项，则会导致 Effect 在每次重新渲染后重新运行。 -======= - }, [createOptions]); // 🚩 As a result, these dependencies are always different on a commit - // ... -``` - -By itself, creating a function from scratch on every re-render is not a problem. You don't need to optimize that. However, if you use it as a dependency of your Effect, it will cause your Effect to re-run after every commit. ->>>>>>> 2da4f7fbd90ddc09835c9f85d61fd5644a271abc 避免使用在渲染期间创建的函数作为依赖项，请在 Effect 内部声明它： @@ -1825,11 +1775,7 @@ function MyComponent() { ```js {3} useEffect(() => { // ... -<<<<<<< HEAD -}); // 🚩 没有依赖项数组：每次重新渲染后重新运行！ -======= -}); // 🚩 No dependency array: re-runs after every commit! ->>>>>>> 2da4f7fbd90ddc09835c9f85d61fd5644a271abc +}); // 🚩 没有依赖项数组：每次提交后重新运行！ ``` 如果你已经指定了依赖项数组，你的 Effect 仍循环地重新运行，那是因为你的某个依赖项在每次重新渲染时都是不同的。 diff --git a/src/content/reference/react/useLayoutEffect.md b/src/content/reference/react/useLayoutEffect.md index f4ae8c27d4..43a3818368 100644 --- a/src/content/reference/react/useLayoutEffect.md +++ b/src/content/reference/react/useLayoutEffect.md @@ -47,15 +47,9 @@ function Tooltip() { #### 参数 {/*parameters*/} -<<<<<<< HEAD -* `setup`：处理副作用的函数。setup 函数选择性返回一个*清理*（cleanup）函数。在将组件首次添加到 DOM 之前，React 将运行 setup 函数。在每次因为依赖项变更而重新渲染后，React 将首先使用旧值运行 cleanup 函数（如果你提供了该函数），然后使用新值运行 setup 函数。在组件从 DOM 中移除之前，React 将最后一次运行 cleanup 函数。 +* `setup`：处理副作用的函数。setup 函数选择性返回一个*清理*（cleanup）函数。在 [组件提交](/learn/render-and-commit#step-3-react-commits-changes-to-the-dom) 之前，React 会运行 setup 函数。在每次因为提交导致依赖项变更后，React 将首先使用旧值运行 cleanup 函数（如果你提供了该函数），然后使用新值运行 setup 函数。在组件从 DOM 中移除之前，React 将最后一次运行 cleanup 函数。 -* **可选** `dependencies`：`setup` 代码中引用的所有响应式值的列表。响应式值包括 props、state 以及所有直接在组件内部声明的变量和函数。如果你的代码检查工具 [配置了 React](/learn/editor-setup#linting)，那么它将验证每个响应式值都被正确地指定为一个依赖项。依赖项列表必须具有固定数量的项，并且必须像 `[dep1, dep2, dep3]` 这样内联编写。React 将使用 [`Object.is`](https://developer.mozilla.org/zh-CN/docs/Web/JavaScript/Reference/Global_Objects/Object/is) 来比较每个依赖项和它先前的值。如果省略此参数，则在每次重新渲染组件之后，将重新运行副作用函数。 -======= -* `setup`: The function with your Effect's logic. Your setup function may also optionally return a *cleanup* function. Before your [component commits](/learn/render-and-commit#step-3-react-commits-changes-to-the-dom), React will run your setup function. After every commit with changed dependencies, React will first run the cleanup function (if you provided it) with the old values, and then run your setup function with the new values. Before your component is removed from the DOM, React will run your cleanup function. - -* **optional** `dependencies`: The list of all reactive values referenced inside of the `setup` code. Reactive values include props, state, and all the variables and functions declared directly inside your component body. If your linter is [configured for React](/learn/editor-setup#linting), it will verify that every reactive value is correctly specified as a dependency. The list of dependencies must have a constant number of items and be written inline like `[dep1, dep2, dep3]`. React will compare each dependency with its previous value using the [`Object.is`](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Object/is) comparison. If you omit this argument, your Effect will re-run after every commit of the component. ->>>>>>> 2da4f7fbd90ddc09835c9f85d61fd5644a271abc +* **可选** `dependencies`：`setup` 代码中引用的所有响应式值的列表。响应式值包括 props、state 以及所有直接在组件内部声明的变量和函数。如果你的代码检查工具 [配置了 React](/learn/editor-setup#linting)，那么它将验证每个响应式值都被正确地指定为一个依赖项。依赖项列表必须具有固定数量的项，并且必须像 `[dep1, dep2, dep3]` 这样内联编写。React 将使用 [`Object.is`](https://developer.mozilla.org/zh-CN/docs/Web/JavaScript/Reference/Global_Objects/Object/is) 来比较每个依赖项和它先前的值。如果省略此参数，则在每次组件提交之后，会重新运行副作用函数。 #### 返回值 {/*returns*/} diff --git a/src/content/versions.md b/src/content/versions.md index 7cb1574285..6ca70a158b 100644 --- a/src/content/versions.md +++ b/src/content/versions.md @@ -52,12 +52,8 @@ React 文档位于 [react.dev](https://react.dev)，提供最新版本 React 的 - [React Compiler Case Studies](https://www.youtube.com/watch?v=lvhPq5chokM) - [React 19 Deep Dive: Coordinating HTML](https://www.youtube.com/watch?v=IBBN-s77YSI) -<<<<<<< HEAD **发布版本** -======= -**Releases** - [v19.2.1 (December, 2025)](https://github.com/facebook/react/blob/main/CHANGELOG.md#1922-dec-11-2025) ->>>>>>> 2da4f7fbd90ddc09835c9f85d61fd5644a271abc - [v19.2.1 (December, 2025)](https://github.com/facebook/react/blob/main/CHANGELOG.md#1921-dec-3-2025) - [v19.2.0 (October, 2025)](https://github.com/facebook/react/blob/main/CHANGELOG.md#1920-october-1st-2025) - [v19.1.3 (December, 2025)](https://github.com/facebook/react/blob/main/CHANGELOG.md#1913-dec-11-2025) diff --git a/src/sidebarBlog.json b/src/sidebarBlog.json index a0a26b82ef..02cf94be57 100644 --- a/src/sidebarBlog.json +++ b/src/sidebarBlog.json @@ -12,21 +12,21 @@ "skipBreadcrumb": true, "routes": [ { - "title": "Denial of Service and Source Code Exposure in React Server Components", + "title": "React 服务器组件中的拒绝服务和源代码泄露", "titleForHomepage": "Additional Vulnerabilities in RSC", "icon": "blog", "date": "December 11, 2025", "path": "/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components" }, { - "title": "Critical Security Vulnerability in React Server Components", + "title": "React 服务器组件中的严重安全漏洞", "titleForHomepage": "Vulnerability in React Server Components", "icon": "blog", "date": "December 3, 2025", "path": "/blog/2025/12/03/critical-security-vulnerability-in-react-server-components" }, { - "title": "React Conf 2025 Recap", + "title": "2025 年 React 大会回顾", "titleForHomepage": "React Conf 2025 Recap", "icon": "blog", "date": "October 16, 2025", @@ -40,7 +40,7 @@ "path": "/blog/2025/10/07/react-compiler-1" }, { - "title": "Introducing the React Foundation", + "title": "介绍 React 基金会", "titleForHomepage": "Introducing the React Foundation", "icon": "blog", "date": "October 7, 2025", @@ -61,7 +61,7 @@ "path": "/blog/2025/04/23/react-labs-view-transitions-activity-and-more" }, { - "title": "Sunsetting Create React App", + "title": "停止使用 Create React App", "titleForHomepage": "Sunsetting Create React App", "icon": "blog", "date": "February 14, 2025",