Docusaurus uses React... what about CVE-2025-55182? #11602
-
|
Is docusaurus exposed to CVE-2025-55182 https://nvd.nist.gov/vuln/detail/CVE-2025-55182 ? |
Beta Was this translation helpful? Give feedback.
Replies: 1 comment 3 replies
-
|
None of the vulnerable packages are ever installed by a Docusaurus site. |
Beta Was this translation helpful? Give feedback.
-
|
Agree are not affected by this React 19 vulnerability: https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components The exploit requires sending a malicious request to a Server Function endpoint, to get remote code execution access. In our case, we are a static site generator, and the "server" only exists at build time. Once built, you generally host the static files on a CDN, no Server Function endpoint is ever exposed, and there's no server runtime you could even execute malicious code on. Yes, even if we did use any of those packages (which we plan to do), the "vulnerable server" would only have existed at build time, and the attacked would need to send a malicious payload at build time through your CI, meaning that your CI is likely alredy compromised. Even if you self-host with If you are using React 19, we still think it's a good idea to upgrade to a patched version (ex: 19.2.1) I don't think it will ever make sense to add support for React Server Functions in Docusaurus (since it would become impossible to host it on popular static hosts like GitHub Pages), but we never know, it could become an opt-in extension 🤷♂️ |
Beta Was this translation helpful? Give feedback.
-
|
@slorber You wrote:
did you mean Github pages maybe? |
Beta Was this translation helpful? Give feedback.
-
|
yes 🤪 GitHub Pages |
Beta Was this translation helpful? Give feedback.
Agree are not affected by this React 19 vulnerability: https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components
The exploit requires sending a malicious request to a Server Function endpoint, to get remote code execution access.
In our case, we are a static site generator, and the "server" only exists at build time. Once built, you generally host the static files on a CDN, no Server Function endpoint is ever exposed, and there's no server runtime you could even execute malicious code on.
Yes, even if we did use any of those packages (which we plan to do), the "vulnerable server" would only have existed at build time, and the attacked would need to send …