←back to thread

Denial of service and source code exposure in React Server Components

(react.dev)
298 points sangeeth96 | 1 comments | 11 Dec 25 20:46 UTC | HN request time: 0s | source
Show context
rikafurude21 ◴[11 Dec 25 21:23 UTC] No.46237343[source]▶
Im confused, did the update from last week for the RCE bug also include fixes for these new CVEs or will I need to update again? npm audit says theres no issues
replies(3): >>46237389 #>>46238088 #>>46238360 #
1. billywhizz ◴[11 Dec 25 21:27 UTC] No.46237389[source]▶
is it not obvious?

> These issues are present in the patches published last week.

> The patches published last week are vulnerable.

> If you already updated for the Critical Security Vulnerability, you will need to update again.