ACTION REQUIRED: Review New vulnerability - React Server Components

Announcements Updates
1

IT Security.

A maximum severity vulnerability, dubbed ‘React2Shell’, in the React Server Components (RSC) ‘Flight’ protocol allows remote code execution without authentication in React and Next[.]js applications. The security issue stems from insecure deserialization. It received a severity score of 10/10 and has been assigned the identifiers CVE-2025-55182 for React and CVE-2025-66478 for Next[.]js.

What steps are being taken to mitigate these security vulnerabilities? Are you able to confirm these CVEs are being addressed in your environment?

3 Likes
2

Hi @Felipe2 , I will raise this internally and take a look right now.

1 Like
4

Opened an inquiry with high priority (ZSEE-189560) and waiting to hear back. Will also have updated comms here: Zoom Security Bulletins | Zoom

Thanks so much!

2 Likes
5

Hi @Felipe2 ,

Confirmed across the security teams for Zoom services that we are not impacted by these CVEs. Our web-based services mostly use Vue, but those that contain some React are unaffected. Thank you!

3 Likes