Skip to content

v1.3.2.md

Latest commit

 

History

History
57 lines (41 loc) · 1.98 KB

v1.3.2.md

File metadata and controls

57 lines (41 loc) · 1.98 KB
Raw

v1.3.2 - Security Patch: React Server Components

Release Date: January 12, 2026 Status: Production Ready

Overview

Critical security patch addressing React Server Components vulnerabilities (DoS and source code exposure). This is a dependency-only update with no code changes.

Security Fixes

CVE-2025-55184 - Denial of Service (High Severity)

  • CVSS Score: 7.5
  • Attack vector: Malicious HTTP request to Server Functions endpoint causes infinite loop
  • Impact: Service unavailability and server performance degradation

CVE-2025-55183 - Source Code Exposure (Medium Severity)

  • CVSS Score: 5.3
  • Attack vector: Malicious HTTP request returns source code of Server Functions
  • Impact: Exposure of hardcoded secrets in source code (runtime env vars like process.env.SECRET are safe)

CVE-2025-67779 - DoS Bypass (High Severity)

  • CVSS Score: 7.5
  • Incomplete fix bypass for CVE-2025-55184
  • Required second patch after initial fix was found insufficient

Dependency Updates

Package Before After
next 15.5.7 15.5.9
react 19.2.1 19.2.3
react-dom 19.2.1 19.2.3
@types/react ^19 ^19.2.8
@types/react-dom ^19 ^19.2.3

Files Modified

package.json
package-lock.json

Technical Notes

  • This project uses React Server Actions in app/admin/login/page.tsx
  • The server action uses process.env.ADMIN_TOKEN (runtime env var) which was NOT exposed by CVE-2025-55183
  • No hardcoded secrets were at risk, but the DoS vulnerability could have caused service disruption

References

Migration Notes

No code changes required. Dependency update only.