4 ms·

React (a frontend JS framework) can now bring down critical Internet infrastructure. I will repeat it because it's so surreal: React (a frontend JS framework)

React (a frontend JS framework) can now bring down critical Internet infrastructure. I will repeat it because it's so surreal: React (a frontend JS framework) can now bring down critical Internet infrastructure.

phplovesong 10mo ago
[flagged]
- mvandermeulen 10mo ago
  What was the AI slop part?
  - GaryBluto 10mo ago
    When something goes wrong, people are starting to immediately assume it's because of the thing they don't like.
cryptonym 10mo ago
That's Next.js, not React. Mentioning React Server Components in the status page can be seen as a bad way to shift the blame. Would have been better to not specify which CVE they were trying to patch. The issue is their rollout management, not the Vendor and CVE.
- philipwhiuk 10mo ago
  I think the "argument" is that it's a critical vuln so they can't "go slow". So now a vuln check for a component deployed on, being generous, 1% of servers causes an outage for 30% of the internet. The argument is dumb.
- JimDabell 10mo ago
  > That's Next.js, not React. React seems to think that it was React: https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components https://react.dev/blog/2025/12/03/critical-security-vulnerab...
  - cryptonym 10mo ago
    True, thanks for sharing. Worth mentioning that's on the "full-stack" part of the framework. It doesn't impact most React website while it impacts most next.js websites.
    - tempaccount420 10mo ago
      It was React. Code in React's repository had to be patched to fix this. Next.JS just happens to be the biggest user of this part of React, but blaming Next.JS is weird...
      - cryptonym 10mo ago
        Thanks, that's what I acknowledged in the message you just replied to. I'm not blaming anyone. Mostly outlining who was impacted as it's not really related to the front-end parts of the framework that the initial comment was referring to.
spiffytech 10mo ago
To be accurate: React developed server-side capabilities, and that's where the vulnerability exists. It's feels noteworthy because React started out frontend-only, but pedantically it's just another backend with a vulnerability.

phplovesong 10mo ago

[flagged]

mvandermeulen 10mo ago
What was the AI slop part?
- GaryBluto 10mo ago
  When something goes wrong, people are starting to immediately assume it's because of the thing they don't like.

cryptonym 10mo ago

That's Next.js, not React. Mentioning React Server Components in the status page can be seen as a bad way to shift the blame. Would have been better to not specify which CVE they were trying to patch. The issue is their rollout management, not the Vendor and CVE.

philipwhiuk 10mo ago
I think the "argument" is that it's a critical vuln so they can't "go slow". So now a vuln check for a component deployed on, being generous, 1% of servers causes an outage for 30% of the internet. The argument is dumb.
JimDabell 10mo ago
> That's Next.js, not React. React seems to think that it was React: https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components https://react.dev/blog/2025/12/03/critical-security-vulnerab...
- cryptonym 10mo ago
  True, thanks for sharing. Worth mentioning that's on the "full-stack" part of the framework. It doesn't impact most React website while it impacts most next.js websites.
  - tempaccount420 10mo ago
    It was React. Code in React's repository had to be patched to fix this. Next.JS just happens to be the biggest user of this part of React, but blaming Next.JS is weird...
    - cryptonym 10mo ago
      Thanks, that's what I acknowledged in the message you just replied to. I'm not blaming anyone. Mostly outlining who was impacted as it's not really related to the front-end parts of the framework that the initial comment was referring to.

spiffytech 10mo ago

To be accurate: React developed server-side capabilities, and that's where the vulnerability exists. It's feels noteworthy because React started out frontend-only, but pedantically it's just another backend with a vulnerability.