Possible false positive: React Server Components vulnerability

[realAP]

Possible false positive: React Server Components vulnerability

Hi team,

I’m opening this issue as a heads-up / clarification request, not as a confirmed vulnerability report.

I ran react2shell-guard locally against the current main branch and it reports multiple deps as as potentially affected.

I also ran the same scanner against my own deployed Twenty instance, where no vulnerability was reported.

So at this point I’m unsure whether:

• this is a false positive, or
• the local setup still references a version mentioned in a recent upstream advisory, or
• the project is already effectively mitigated in another way.

Relevant upstream advisory:
https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components

I could not find an existing issue about this, so I wanted to ask openly:
Is this a known false positive, or should the dependency version be updated?

I have not attempted to exploit anything and did not find an actual vulnerability in a running Twenty instance.

Here is the full scanner output or details about the commands I used if that helps.

command:
npx react2shell-guard@latest

output:

react2shell-guard - CVE-2025-55182 Scanner
──────────────────────────────────────────────────

Scanned 14 project(s)

✗ twenty [VULNERABLE]
  Path: home/twenty
  Framework: react-client-only

  Vulnerabilities found:
    - next @ 15.2.4
      Upgrade to: 15.2.6
      Advisory: https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components

✗ twenty-front [VULNERABLE]
  Path: home/twenty/packages/twenty-front
  Framework: unknown

  Vulnerabilities found:
    - next @ 15.2.4
      Upgrade to: 15.2.6
      Advisory: https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components

✗ twenty-server [VULNERABLE]
  Path: home/twenty/packages/twenty-server
  Framework: react-client-only

  Vulnerabilities found:
    - next @ 15.2.4
      Upgrade to: 15.2.6
      Advisory: https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components

✗ twenty-emails [VULNERABLE]
  Path: home/twenty/packages/twenty-emails
  Framework: unknown

  Vulnerabilities found:
    - next @ 15.2.4
      Upgrade to: 15.2.6
      Advisory: https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components

✗ twenty-ui [VULNERABLE]
  Path: home/twenty/packages/twenty-ui
  Framework: react-client-only

  Vulnerabilities found:
    - next @ 15.2.4
      Upgrade to: 15.2.6
      Advisory: https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components

✗ twenty-utils [VULNERABLE]
  Path: home/twenty/packages/twenty-utils
  Framework: unknown

  Vulnerabilities found:
    - next @ 15.2.4
      Upgrade to: 15.2.6
      Advisory: https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components

✗ twenty-zapier [VULNERABLE]
  Path: home/twenty/packages/twenty-zapier
  Framework: unknown

  Vulnerabilities found:
    - next @ 15.2.4
      Upgrade to: 15.2.6
      Advisory: https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components

✗ twenty-website [VULNERABLE]
  Path: home/twenty/packages/twenty-website
  Framework: nextjs v15.2.4
  App Router: Yes (RSC enabled)

  Vulnerabilities found:
    - next @ 15.2.4
      Upgrade to: 15.2.6
      Advisory: https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components

✗ twenty-docs [VULNERABLE]
  Path: home/twenty/packages/twenty-docs
  Framework: unknown

  Vulnerabilities found:
    - next @ 15.2.4
      Upgrade to: 15.2.6
      Advisory: https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components

✗ twenty-e2e-testing [VULNERABLE]
  Path: home/twenty/packages/twenty-e2e-testing
  Framework: unknown

  Vulnerabilities found:
    - next @ 15.2.4
      Upgrade to: 15.2.6
      Advisory: https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components

✗ twenty-shared [VULNERABLE]
  Path: home/twenty/packages/twenty-shared
  Framework: unknown

  Vulnerabilities found:
    - next @ 15.2.4
      Upgrade to: 15.2.6
      Advisory: https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components

✗ twenty-sdk [VULNERABLE]
  Path: home/twenty/packages/twenty-sdk
  Framework: unknown

  Vulnerabilities found:
    - next @ 15.2.4
      Upgrade to: 15.2.6
      Advisory: https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components

✗ twenty-cli [VULNERABLE]
  Path: home/twenty/packages/twenty-cli
  Framework: unknown

  Vulnerabilities found:
    - next @ 15.2.4
      Upgrade to: 15.2.6
      Advisory: https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components

✗ create-twenty-app [VULNERABLE]
  Path: home/twenty/packages/create-twenty-app
  Framework: unknown

  Vulnerabilities found:
    - next @ 15.2.4
      Upgrade to: 15.2.6
      Advisory: https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components

──────────────────────────────────────────────────
VULNERABLE - Action required!
Upgrade affected packages to patched versions immediately.

[QuantumFlux21]

Thanks for the heads-up.

Twenty does have a backend service in the stack (local setup docs show the server running on :3000 with /graphql and /rest), so there is a Node “server” component.

For the React2Shell / RSC advisory, upstream guidance currently says Next 15.2.x should upgrade to next@15.2.8 (rather than 15.2.6). Even if a deployed instance scans clean, it still seems prudent to bump Next anywhere it’s built/shipped (e.g., twenty-website / docs tooling) and re-run the scanner to confirm.

[FelixMalfait]

Hey, thanks! We had looked into this when it came out.
We only use Next for our marketing website but that's being deprecated (only secondary pages remains, the main pages have been migrated). The vast majority of Twenty (i.e. twenty-server / twenty-front / twenty-shared which are the repo powering the app) are not using Next.js.
We also do not use RSC which are at the root of this vulnerability, it's a good old "SPA" with the frontend and server being completely separated.

That being said we should still update the website at least to get rid of the warning, even if it's a not high risk and is being deprecated. @mabdullahabaid could you please look into it? Thanks a lot

[mabdullahabaid]

@FelixMalfait certainly.