Sign in Subscribe

Security / vulnerabilities

CVSS 10 bug in React, Next.js triggers security klaxons

Pre-auth RCE, trivial exploitation, a massive blast radius...

By Edward Targett

Updated Dec 4, 2025 5:07 PM / Published Dec 3, 2025 7:49 PM 3 min read

CVSS 10 bug in React, Next.js triggers security klaxons

This content is for members only

Subscribe

Already have an account? Sign in

Add The Stack on Google

Edward Targett

Ed is a co-founder of The Stack. He previously edited Computer Business Review. He has also covered energy markets. He started his journalism career on local papers. He left school at 15 and has made a living asking "but why?" ever since.