--- title: "React gets a security update for RSC-supporting apps" publication: "React Status" issue: 454 published_at: "2025-12-03" canonical_url: "https://react.statuscode.com/issues/454" --- Plus Vite 8 beta, the State of TanStack, and a Franco-German React app collaboration. | #​454 — December 3, 2025 [Read on the Web](https://react.statuscode.com/issues/454) Together with [![Frontend Masters logo\](https://res.cloudinary.com/cpress/image/upload/c_fill,g_auto,w_300,h_70/e_make_transparent/co_white,e_outline:5/nk0tfdvalivacz8rw7rt.png)](https://frontendmasters.com/courses/react-performance-v2/?utm_source=email&utm_medium=reactstatus&utm_content=reactperfv2) React Status [![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60,q_auto/j4aqhczxofbpzujgfssv.jpg)](https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components) ⚠️ [A Critical Security Vulnerability in React Server Components](https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components) — Breaking news from the React team for anyone whose app supports RSCs, even if it’s not using them. v19.0, 19.1.0, 19.1.1, and 19.2.0 of `react-server-dom-webpack`, `react-server-dom-parcel` and `react-server-dom-turbopack` are susceptible to a remote code execution vulnerability and you need to upgrade. However, **"if your app’s React code does not use a server, your app is not affected by this vulnerability."** The React Team 💡 [React 19.0.1](https://github.com/facebook/react/releases/tag/v19.0.1), [19.1.2](https://github.com/facebook/react/releases/tag/v19.1.2) and [19.2.1](https://github.com/facebook/react/releases/tag/v19.2.1) have just been released as part of this. [![\](https://res.cloudinary.com/cpress/image/upload/c_limit,w_480,h_480,q_auto/copm/bffc4917.png)](https://frontendmasters.com/courses/react-performance-v2/?utm_source=email&utm_medium=reactstatus&utm_content=reactperfv2) [Ship High-Performance React Apps](https://frontendmasters.com/courses/react-performance-v2/?utm_source=email&utm_medium=reactstatus&utm_content=reactperfv2) — Join Steve Kinney for this detailed video course on React performance. You'll cover hydration, suspense, resource loading, server actions and more, coming away with the know-how to build apps that look and feel fast. Frontend Masters sponsor [Vite 8 Beta: The Rolldown-Powered Vite](https://vite.dev/blog/announcing-vite8-beta) — The first beta of Vite 8, powered by Rolldown, is now available promising significantly faster production builds and a better platform for extending Vite into the future. VoidZero Inc. [React Router's Take on React Server Components](https://www.epicreact.dev/react-routers-take-on-react-server-components-4bj7q) — _“Did you know React Router is adding React Server Components support? It’s still experimental, but it’s very close to landing, and I think React Router’s take on RSC is really great. Here’s what you need to know.”_ Kent C. Dodds 📄 [The State of TanStack, Two Years of Full-Time OSS](https://tanstack.com/blog/tanstack-2-years) – Telling the story of building one of the most successful families of open source libraries in our community right now. Tanner Linsley 📺 [It's Not New: How 'The New Architecture' Unlocks React Native's Future](https://www.callstack.com/podcasts/its-not-new-how-the-architecture-unlocks-react-natives-future) – It’s no longer new, it’s _the_ way, a React Native core team member explains. Cipolleschi and Chludziński 📄 [Taking Down Next.js Servers for 0.0001 Cents a Pop](https://www.harmonyintelligence.com/taking-down-next-js-servers) – Explains an attack that has since been patched; upgrading to Next.js 15.5.5 or 16+ addresses the issue. Alex Browne 📄 [Next.js 16: What’s New for Authentication and Authorization](https://auth0.com/blog/whats-new-nextjs-16/) Will Johnson (Auth0) 📄 [Designing Design Systems](https://www.reddit.com/r/reactjs/comments/1pbh3c0/designing_design_systems/) Dominik Dorfmeister 🛠 Code, Tools & Libraries 🔒 [Better Auth: A Comprehensive Authentication Framework](https://www.better-auth.com/) — An authentication and authorization framework that provides email and password-based auth, OAuth and social sign-in, account and session management, 2FA, and more. [v1.4](https://www.better-auth.com/blog/1-4) was just released with stateless/database-free session management support. Better Auth [react-native-quick-crypto 1.0: Node's `crypto` But for React Native](https://github.com/margelo/react-native-quick-crypto) — A fast implementation of Node’s [Crypto](https://nodejs.org/api/crypto.html) module written in C/C++ JSI for fast cryptography functions in React Native apps. Margelo GmbH [Tuple - The Fastest Way to Review AI Slop](https://tuple.app/l/pair-programming?utm_source=cooperpress&utm_medium=newsletter&utm_campaign=react_status_sponsored_20251203) — Wasting hours debugging AI code? Tuple brings your team together to figure it out, clean it up, and ship. Tuple sponsor 📸 [React Web Camera: A Component for Capturing Multiple Photos Directly from the Browser](https://github.com/shivantra/react-web-camera) — Improves on the experience of similar solutions by allowing multiple captures without the need to reopen the camera. You can integrate it seamlessly with your app via custom styling. There is, of course, [a demo.](https://shivantra.com/react-web-camera/) shivantra [Docs: A React-Powered Collaborative Writing Environment](https://docs.numerique.gouv.fr/home/) — Built by a collaboration between the French and German governments, _Docs_ is a full-featured collaborative note-taking, wiki, and documentation app built on top of React, Django, and [BlockNote.](https://www.blocknotejs.org/) – [GitHub repo.](https://github.com/suitenumerique/docs) The Government of France 🗓️ [FullCalendar: A Full Sized JavaScript Calendar Control](https://fullcalendar.io/) — Get a Google Calendar-style experience in your own apps. Has connectors [for React](https://github.com/fullcalendar/fullcalendar-react), Vue and Angular, but can be used with plain JavaScript too. The base version is MIT licensed, but there’s a commercial version too with extra features. Adam Shaw [Custom React Directives (a.k.a. `use nemo`)](https://github.com/Ademking/use-nemo) — Custom directives are increasingly popping up all over the place, so why not join the party and create your own? 😅 Adem Kouki - 📊 [React Spectrum Charts v1.22.0](https://github.com/adobe/react-spectrum-charts) – Adobe's declarative charting library for composing accessible, [Spectrum](https://opensource.adobe.com/react-spectrum-charts/)-styled data visualizations. - [React Markdown Editor v4.0.10](https://github.com/uiwjs/react-md-editor) – Simple Markdown editor component with preview and syntax highlighting support. ([Demos.](https://uiwjs.github.io/react-md-editor/)) - [markdown-to-jsx v9.3.0](https://github.com/quantizor/markdown-to-jsx) – Customizable toolchain for converting Markdown to JSX. - [React Uploady 1.13](https://github.com/rpldy/react-uploady) – Components and hooks for file uploading. - [Berry v51.0](https://github.com/codedthemes/berry-free-react-admin-template) – Material UI admin dashboard template for React. - [Reactylon 3.5](https://github.com/simonedevit/reactylon) – Babylon.js-powered XR framework for React. - [React Three Fiber 9.4.2](https://github.com/pmndrs/react-three-fiber) – React renderer for Three.js. - [Prettier 3.7](https://prettier.io/blog/2025/11/27/3.7.0) – The popular opinionated code formatter. - [Preact 10.28.0](https://github.com/preactjs/preact/releases/tag/10.28.0) – The fast, tiny alternative to React. 📢 Elsewhere in the ecosystem Some other interesting stories in the broader landscape: - Anthropic, best known for its line of _Claude_ large language models, [has acquired the company behind Bun](https://bun.com/blog/bun-joins-anthropic), the server-side JavaScript runtime. Jarred Sumner, the creator of Bun, tells the story really well, and stresses that Bun remains as open as ever. - The Electron project has [entered a 'quiet month'](https://www.electronjs.org/blog/dec-quiet-period-25) to give the maintainers a rest before getting back to full steam in January. They also use the post to review what happened with Electron in 2025. - Node 24 LTS is now available [for builds and functions on Vercel.](https://vercel.com/changelog/node-js-24-lts-is-now-generally-available-for-builds-and-functions) - [DepX's badge generator](https://depx.co/badge) gives you a graphical badge you can include in your README or on your project site to show how many (or how few!) dependencies your npm package has. Curated by Peter Cooper and Terence C. Gannon. A **[Cooperpress](https://cooperpress.com/)** publication. [Change your email address](https://react.statuscode.com/edit_subscription/*|UID|*) or[Stop getting this newsletter](https://react.statuscode.com/leave/*|UID|*) © Cooper Press Ltd · Fairfield Enterprise Centre, Louth, LN11 0LS, United Kingdom