---
title: "Security digest: December 3, 2025"
url: https://erroneo.us/security/2025-12-03/
description: "December 3, 2025 vulnerability digest: 1 brief (React2Shell); 1 CISA KEV addition (OpenPLC); 4 critical advisories (Go, npm). What to patch and who can relax."
type: security-digest-day
section: "Security Digest"
date_published: 2025-12-03
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: December 3, 2025

1 editorial brief, 1 known exploited (cisa kev) addition and 4 critical advisories.

## Take stock

- Act now: React2Shell . Anyone running Next.js 15.x/16.x App Router (or 14.3 canaries), or another framework bundling react-server-dom-* 19.0.0-19.2.0, on a reachable server.
- Do you run any of these? OpenPLC ScadaBR. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2025-12-24.
- npm: 3 critical advisories ( react-server-dom-webpack , react-server-dom-turbopack , react-server-dom-parcel , @vitejs/plugin-rsc , next ). Check with npm audit (or: npm ls <package>) .
- Go: 1 critical advisory ( github.com/smallstep/certificates ). Check with govulncheck ./... .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Editorial briefs

- **Act now** [React2Shell: Unauthenticated RCE in React Server Components](https://erroneo.us/security/briefs/react2shell-react-server-components-rce/index.md): If any server you run renders React Server Components and was not patched in December 2025, treat it as compromised until shown otherwise: patch, redeploy, and rotate its secrets.

## Known exploited (CISA KEV)

- [CVE-2021-26828](https://erroneo.us/security/cve/CVE-2021-26828/index.md) OpenPLC ScadaBR: OpenPLC ScadaBR Unrestricted Upload of File with Dangerous Type Vulnerability (CISA due 2025-12-24)

## Critical advisories

- [CVE-2025-44005](https://erroneo.us/security/cve/CVE-2025-44005/index.md) Step CA Has Authorization Bypass in ACME and SCEP Provisioners — Go github.com/smallstep/certificates <= 0.28.4 → 0.29.0
- [CVE-2025-55182](https://erroneo.us/security/cve/CVE-2025-55182/index.md) React Server Components are Vulnerable to RCE — npm react-server-dom-webpack >= 19.1.0, < 19.1.2 → 19.1.2; npm react-server-dom-webpack = 19.2.0 → 19.2.1; npm react-server-dom-turbopack >= 19.1.0, < 19.1.2 → 19.1.2
- [GHSA-fmh4-wr37-44fp](https://erroneo.us/security/ghsa/GHSA-fmh4-wr37-44fp/index.md) React Server Components are Vulnerable to RCE — npm @vitejs/plugin-rsc <= 0.5.2 → 0.5.3
- [GHSA-9qr9-h5gf-34mp](https://erroneo.us/security/ghsa/GHSA-9qr9-h5gf-34mp/index.md) Next.js is vulnerable to RCE in React flight protocol — npm next >= 14.3.0-canary.77, < 15.0.5 → 15.0.5; npm next >= 15.2.0-canary.0, < 15.2.6 → 15.2.6; npm next >= 15.3.0-canary.0, < 15.3.6 → 15.3.6

---
Source page: https://erroneo.us/security/2025-12-03/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt