Lately there has been a vulnerability that affected over 65M+ Websites in The World (only 5.8%). This vulnerability was extremely serious as it allowed remote access to any website used a vulnerable React Framework.
What’s the Latest Problem?
In December 2025, experts found a serious security problem in a newer part of React called React Server Components. The main issue, discovered on December 3, 2025, is nicknamed “React2Shell.” It’s a big deal because:
- Bad people (hackers) could send a tricky message to the website’s server.
- This could let them take control of the server and run their own commands, like stealing information or causing trouble.
- Remote Access to the system compromises the whole system & any additional systems or hosts
It’s rated as the most serious type of problem (a perfect 10 out of 10 for danger level). Hackers started trying to use it right away on many websites. A few days later, on December 11, more problems were found:
- One could make the website crash or slow down so much that no one can use it (like jamming the door).
- Another could accidentally show secret parts of the website’s code.
These aren’t as bad as the first one, but they’re still important to fix.
What is React?
React is a popular free tool that helps developers build websites and apps. It’s like a set of building blocks for creating interactive pages that you see on sites like Facebook, Netflix, or many online shops. Millions of websites use it because it’s fast and easy to work with.
Who Does This Affect?
Mostly websites using the newest version of React (version 19) with Server Components. A popular tool called Next.js is also affected if it uses this feature.
If your website is old or doesn’t use this new part, you’re probably safe. If you’re just visiting websites, you don’t need to do anything—the website owners handle it.
Final Thoughts
Security issues like this remind us that the internet is always changing, and keeping software updated is one of the best ways to stay protected. If you’re a developer, check your projects for updates. For everyone else, just enjoy your favorite sites—they’re getting safer!