Wasp•2w ago

Vulnerability React2Shell

Are we vulnerable to this?

I heard it’s a pretty big exploit.

https://react2shell.com

https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components

Looks like it might just be react 19 tho?

Critical Security Vulnerability in React Server Components – React

The library for web and native user interfaces

kapa.ai•12/8/25, 11:28 PM

Hi @Zuck. I'm kapa.ai, your friendly support bot. I will try to answer your question by searching through the knowledge base. :wave:

kapa.ai•12/8/25, 11:28 PM

----------------------
Based on the information in the issues you provided, Wasp has not yet completed an upgrade to React 19. React 19 support is currently tracked as planned work, not something that’s already shipped:

There is an open issue “Update to React 19” whose purpose is specifically to bump Wasp’s React dependency to 19 and “make everything work with it.” [Update to React 19]
A separate issue tracks using React 19 features after that upgrade. [Update dependencies]

Because of that, the knowledge sources indicate that current Wasp projects are still on React 18 (or earlier) and do not use React 19 / RSC features yet, and there is no mention anywhere of React2Shell or any related security incident.

So, from what’s in the docs you shared, Wasp itself is not on React 19 yet, and there is no documented impact of a React 19 / RSC-specific vulnerability such as React2Shell on Wasp.

However:

If you have manually overridden Wasp’s internal dependencies to force React 19 (for example via an “unsupportedOverrides”-style mechanism once it exists), that would be outside what the current issues describe and isn’t covered by these sources. [Allow override deps]
The Wasp team is actively thinking about dependency pinning, overrides, and security vs. stability, but there’s no explicit security advisory or mitigation in these materials regarding React 19 / RSC. [Pin npm versions; More control over deps]

kapa.ai•12/8/25, 11:28 PM

Given the limits of the provided information, I can’t definitively confirm vulnerability status with respect to React2Shell, but the sources you’ve shared strongly suggest that stock Wasp apps haven’t adopted React 19 / RSC yet and therefore are not in the directly affected set.

If you want to be certain for your specific app, you should:

Check
```
package.json
```
```
package.json
```
in your Wasp project and the generated client to see if
```
react
```
```
react
```
(and react-domreact-dom) are actually at 19.x19.x.
Verify you’re not manually overriding Wasp’s React version via any custom mechanism like the proposed wasp.unsupportedOverrideswasp.unsupportedOverrides. [Allow override deps]
Follow any official Wasp release notes or advisories once the React 19 migration work item lands. [Update to React 19; Update dependencies]
----------------------
Note: you can ask me a follow up question by @ mentioning me again :speech_balloon:
----------------------

kapa.ai•12/8/25, 11:28 PM

Sorry @Zuck, I seem to be having a bit of trouble. Don't worry though, I've pinged my support and they will try to fix me up! :technologist:

Perhaps try again in 15mins?

martinsos•12/8/25, 11:33 PM

No, because we are also not using React Server Components! We use React only on the frontend (SPA).

Gwaggli•12/10/25, 1:10 PM

Eventho we are using react-router?

Filip•12/10/25, 2:23 PM

Yes, we're safe - To be vulnerable, we'd have to execute react on the server with react server components, which we don't. And even if we did, Wasp is still on React 18 and only React 19 is vulnerable.

They only mention React router and others to say "Hey, even if you don't explicitly list the vulnerable React version in your package.json, you might still be using it because React router depends on it." But:

We do list React explicitly, so this wouldn't expose us to anything new anyway.
We use React 18 which isn't vulnerable.
Even if we did use the vulnerable version of React, we aren't using the vulnerable feature.

Verdict: You're safe

matijash•12/10/25, 3:28 PM

https://tenor.com/view/youre-safe-forehead-kiss-dont-worry-cliff-curtis-emilio-gif-15650343

Tenor

Vulnerability React2Shell

Similar Threads

Similar Threads

Similar Threads