December 3, 2025 by The React Team There is an unauthenticated remote code execution vulnerability in React Server Components.We recommend upgrading immediately. On November 29th, Lachlan Davidson reported a security vulnerability in React that allows unauthenticated remote code execution by exploiting a flaw in how React decodes payloads sent to React Server Function endpoints. Even if your app does not implement any React Server Function endpoints it may still be vulnerable if your app support...