Community

Blog Events Webinars Tutorials Forum
  1. Blog
  2. Events
  3. Webinars
  4. Tutorials
  5. Forum
Create Account
×
Community Blog Address the Critical React Vulnerability with Limited-time Free Security Products from Alibaba Cloud

Address the Critical React Vulnerability with Limited-time Free Security Products from Alibaba Cloud

Alibaba Cloud offers a limited-time free trial of vulnerability detection and exploit blocking to users without security protection, enhancing cloud security.

According to the latest observations, the impact of a high-risk vulnerability in the React framework is expanding. To maximize cloud security, Alibaba Cloud is offering users who have not enabled any security protection measures a limited-time free trial of relevant security vulnerability detection and exploit blocking products. This helps protect users during this high-risk period for the vulnerability.

Before enabling the relevant product features, you must claim the free quota for the corresponding product to avoid incurring fees.

Path to claim free products:Log on to the Alibaba Cloud International Website (www.alibabacloud.com).

On the home page, click Pricing in the navigation bar, select Free Trial, and set Product Categories to Security. Then, click the target product to claim the free quota by following the on-screen instructions.

37C1CD3D_B26E_440B_8162_8A843394231B

Observation of vulnerability exploits

Since the actual proof of concept (POC) was publicly disclosed on December 5, the Alibaba Cloud Security Team has detected that cybercriminal groups are now leveraging this vulnerability for large-scale exploitation. Attack behaviors primarily include executing commands such as id, whoami, and curl, reading environment variables, and writing trojans for mining.

In recent attack observations, large language model (LLM) application development platforms have become primary targets for malicious actors.

Vulnerability impact scope

Affected React components:

react-server-dom-parcel 19.0, 19.1.0, 19.1.1, 19.2.0
react-server-dom-turbopack 19.0, 19.1.0, 19.1.1, 19.2.0
react-server-dom-webpack 19.0, 19.1.0, 19.1.1, 19.2.0

Affected Next.js versions:

14.3.0-canary.77 ≤ Next < 15.0.5
15.1.0 ≤ Next < 15.1.9
15.2.0 ≤ Next < 15.2.6
15.3.0 ≤ Next < 15.3.6
15.4.0 ≤ Next < 15.4.8
15.5.0 ≤ Next < 15.5.7
16.0.0 ≤ Next < 16.0.7

Users are strongly advised to conduct immediate self-checks and initiate remediation.

Free protection from Alibaba Cloud security products

Alibaba Cloud has updated its security product rules to defend against CVE-2025-55182 and CVE-2025-66478 at the host, application, and network layers. We strongly recommend all affected users upgrade immediately to eliminate risk at the source.

Security Center: Infrastructure layer vulnerability detection and discovery

Quickly identify whether your cloud assets are exposed to these vulnerabilities and reduce your attack surface.

Free policy 1

• Vulnerability detection. Security Center Free Edition offers detection for the CVE-2025-66478 vulnerability. Furthermore, its agentless detection capability supports offline detection for two vulnerabilities across comprehensive host and image assets, without impacting the online runtime environment. All users are provided with a 500 GB agentless detection scanning resource package, valued at USD 15.

Procedure

  1. Log on to the Security Center console. Select Risk Governance > Vulnerabilities, then click Urgent Vulnerability. Select Next.js React Server Components Remote Code Execution Vulnerability (CVE-2025-66478) [Remote Scan] and click Detect Now to check your assets for this vulnerability threat.
  2. On the Overview page, enable Agentless Detection in the Pay-as-you-go section on the right. In the left navigation pane, select Protection Configuration > Host Protection > Agentless Detection. On the Server Check, or Custom Image Check page, click Detect Now.

Free policy 2

• Intrusion detection. The detection capabilities for four types of alerts related to the exploit behaviors of the CVE-2025-66478 and CVE-2025-55182 vulnerabilities are available for one month in the Free Edition. Users who activate the Free Edition can use these capabilities.

Procedure

Log on to the Security Center console. In the left navigation pane, click Detection and Response and then click Alert. Pay attention to the following four types of alerts: Worm Command, Suspicious Encoded Command, Suspicious Command Execution on Linux, and Abnormal Child Process Created by Web Application. This allows you to confirm whether your assets have been attacked by using this vulnerability.

Notes

• On the Assets > Host page, verify that the status of the Security Center agent on your host assets is indicated by the icon.
• For hosts that are not on Alibaba Cloud, you must first install the Security Center agent. To do this, in the left navigation pane, select System Settings > Feature Settings, click Agent, and then click Installation Command. Select the appropriate installation command and run it on the non-Alibaba Cloud host.

Web Application Firewall (WAF): Vulnerability detection and blocking in high-risk zones

Implement default protection for this vulnerability at the application layer and block the attack path.

Free policy

Alibaba Cloud users who are using this product for the first time are provided with a free trial quota of a 10,000 SeCU resource plan valued at USD 99.

Procedure

Activate the pay-as-you-go edition of WAF 3.0. Then, on the Onboarding page, onboard the assets that require protection, such as domain names and cloud product instances (such as ALB), to WAF for protection.

Notes

  1. After assets are onboarded to WAF, protection against this vulnerability and automatic rule updates will be enabled by default.
  2. If you have previously modified the default configurations of WAF, confirm that the Web Core Protection Rule 901017, 901019, 901021, 901022, 901023, 901036, and 901037 are enabled and set to Block.

Cloud Firewall: Network layer protection

Block and protect against this vulnerability at the network layer.

Free Policy

For Alibaba Cloud users who are using this product for the first time, a free trial quota of USD 70 is provided.

Procedure

Activate the pay-as-you-go 2.0 edition of Cloud Firewall. On the Firewall Settings page, onboard the assets that require protection, such as elastic IP addresses (EIPs), to Cloud Firewall for protection. It is recommended that you also enable the Automatic Protection for New Assets feature.

Notes

  1. After assets are onboarded to Cloud Firewall, protection against this vulnerability and automatic rule updates will be enabled by default.
  2. If you have previously modified the default configurations of Cloud Firewall, in the IPS Configuration > Internet Border/VPC Border > Virtual Patching module, search for CVE-2025-55182 and CVE-2025-66478, and ensure that the resulting rule IDs are enabled and set to Block.
  3. Cloud Firewall does not support the detection of inbound encrypted traffic, such as HTTPS. If the traffic that you need to protect is HTTPS traffic, onboard the corresponding assets to WAF for protection.

Note: After your free benefits are used up, if you have no further need for the product, please release the product instances promptly to avoid incurring fees.

Alibaba Cloud security recommendations

Remediation solutions

Check your applications for the affected React components and related frameworks (such as Next.js). If found, it is strongly recommended that you upgrade to a secure version. For example, Next.js framework users run the appropriate upgrade commands based on their current version.

npm install next@15.0.5 # for 15.0.xnpm install next@15.1.9 # for 15.1.xnpm install next@15.2.6 # for 15.2.xnpm install next@15.3.6 # for 15.3.xnpm install next@15.4.8 # for 15.4.xnpm install next@15.5.7 # for 15.5.xnpm install next@16.0.7 # for 16.0.x

If you are using Next.js 14.3.0-canary.77 or a later canary version, we recommend downgrading to a stable version of Next.js 14.

npm install next@14

Users of other frameworks can refer to https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components to perform the relevant checks and upgrades.

Mitigation measures

Use various security products, such as WAF and Cloud Firewall, to block related scans and attacks. (Note: This is only a temporary mitigation. To completely eliminate the vulnerability, please perform the upgrade as described in the Remediation solutions section.)

References

  1. https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components
  2. https://nextjs.org/blog/CVE-2025-66478
  3. https://github.com/vercel/next.js/security/advisories/GHSA-9qr9-h5gf-34mp
  4. https://github.com/facebook/react/security/advisories/GHSA-fv66-9v8q-g76r
  5. https://avd.aliyun.com/detail?id=AVD-2025-66478
  6. https://avd.aliyun.com/detail?id=AVD-2025-55182

Finally, to reiterate, Alibaba Cloud Security strongly recommends that all affected users immediately upgrade from the vulnerable version to the latest version.

WAF Security Compliance Cloud Security Data security Mobile Security Server Guard Web Application Firewall Database security Cybersecurity Application Security Server Security Security Center Cloud Firewall security services Secure Access Service Edge
0 1 0
Share on

Read previous post:

Sole vendor headquartered in APEC to be recognized: Alibaba Cloud Named in the 2025 Gartner® Magic Quadrant™ for Access Management for Its IDaaS

CloudSecurity

6 posts | 0 followers

You may also like

Comments

CloudSecurity

6 posts | 0 followers

Related Products

  • Security Center

    A unified security management system that identifies, analyzes, and notifies you of security threats in real time

    Learn More

  • Security Solution

    Alibaba Cloud is committed to safeguarding the cloud security for every business.

    Learn More

  • Data Security on the Cloud Solution

    This solution helps you easily build a robust data security framework to safeguard your data assets throughout the data security lifecycle with ensured confidentiality, integrity, and availability of your data.

    Learn More

  • ActionTrail

    A service that monitors and records the actions of your Alibaba Cloud account, including the access to and use of Alibaba Cloud services using the Alibaba Cloud Management console, calling API operations, or SDKs.

    Learn More

More Posts by CloudSecurity

See All