erroneo.us
Search all guides⌘K

Digest · Wednesday

Security digest: December 3, 2025

1 editorial brief, 1 known exploited (cisa kev) addition and 4 critical advisories.

All digests · RSS · Markdown

Take stock

  • Act now: React2Shell. Anyone running Next.js 15.x/16.x App Router (or 14.3 canaries), or another framework bundling react-server-dom-* 19.0.0-19.2.0, on a reachable server.
  • Do you run any of these? OpenPLC ScadaBR. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2025-12-24.
  • npm: 3 critical advisories (react-server-dom-webpack, react-server-dom-turbopack, react-server-dom-parcel, @vitejs/plugin-rsc, next). Check with npm audit (or: npm ls <package>).
  • Go: 1 critical advisory (github.com/smallstep/certificates). Check with govulncheck ./....
  • None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Act now

· Vulnerability · CVE-2025-55182

React2Shell: Unauthenticated RCE in React Server Components

If any server you run renders React Server Components and was not patched in December 2025, treat it as compromised until shown otherwise: patch, redeploy, and rotate its secrets.

Must act: Anyone running Next.js 15.x/16.x App Router (or 14.3 canaries), or another framework bundling react-server-dom-* 19.0.0-19.2.0, on a reachable server.

Can relax: Client-only React apps, Next.js Pages Router or Edge Runtime apps, Next.js 13.x/14.x stable, and React Native apps without server components.

  1. Inventory every app that ships react-server-dom-webpack/parcel/turbopack: npm ls react-server-dom-webpack react-server-dom-parcel react-server-dom-turbopack next
  2. Upgrade to the current patched line from React's advisory (for Next.js, e.g. npm install next@15.5.10 or next@16.1.5, or run npx fix-react2shell-next), rebuild and redeploy
  3. If the app was online and unpatched as of Dec 4, 2025, 1:00 PM PT, rotate every secret it can read, starting with the most critical

Read the brief →

Known exploited (CISA KEV) 1

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

CVEProduct and flawCISA due
CVE-2021-26828OpenPLC ScadaBR
OpenPLC ScadaBR Unrestricted Upload of File with Dangerous Type Vulnerability		2025-12-24

Critical advisories by ecosystem 4

GitHub-reviewed advisories rated critical, published this day (Pacific time).

npm 3

Check: npm audit (or: npm ls <package>)

Go 1

Check: govulncheck ./...