TMiR 2025-12: Year in review, React2Shell (RCE, DOS, SCE, oh my)

About this episode

The episode reviews significant events and updates in the React ecosystem and React Native over the past year, including vulnerabilities and new features.

Full transcript at Reactiflux Main Content React2Shell vulnerability Initial announcement Followup denial-of-service CVE and source code exposure CVE Vercel bulletin Cloudflare Cloudflare report on exploit attempts Cloudflare outage on December 5, 2025 Tech analysis: “Flight Protocol” Vuln is carefully crafted Promise deserialization + `new Function` eval PRs: Initial fixes , Promise cycles / function toString , more Promise cycles Guillermo’s breakdown Shruti’s breakdown Comms critique “React is rainbow colored (function types)” What does this mean for React and RSC adoption going forward? When I go back and look at react.dev now \[…\] it feels half-finished React Native year in review More CSS support Expo EAS hosting RN 0.78: React 19 support Lynx launched RN 0.79: JSC moving to Community Package RN 0.80: Freezing the legacy architecture RN 0.81: Android 16 support for edge to edge 1.0 on the horizon Vega OS launched RN 0.82: Only new architecture Expo App Awards RN 0.83: New Devtools - no breaking changes React year in review CRA deprecation , new install docs (Vite\!) Styled Components Deprecated Releases: 19.2 (Activity, useEffectEvent), Compiler 1.0 Research: View…

People in this episode

Hosts: Mark Erikson, Mo Khazali, Carl Vitullo

Topics covered

• React vulnerabilities
• React Native updates
• Year in review
• Tech analysis
• Promise deserialization
• React ecosystem growth

Keywords

• React2Shell
• CVE
• Promise cycles
• React Native
• Expo
• React Router
• RSC
• Cloudflare
• Vercel
• Jam recap

Mentioned in this episode

Organizations: Reactiflux, Vercel, Cloudflare, Expo, React Foundation, React Router, TanStack, Remix

More episodes of This Month in React

• TMiR 2026-05: Who even is on the Core team anymore, TanStack got pwn'd bad · June 6, 2026 · 1h 10m
• Mark & Carl talk with Swizec Teller about using AI at work · May 7, 2026 · 1h 4m
• TMiR 2026-02: CloudFlare remakes Next with AI; Vercel big mad. We talk too much about AI Agents · March 3, 2026 · 1h 6m
• TMiR 2026-01: Oops more CVEs. AI has React "skills", Astro exits and Tailwind struggles · February 5, 2026 · 1h 6m
• TMiR 2025-11: Cloudflare outage, ongoing npm hacks, React Router is getting RSCs · November 30, 2025 · 1h 3m
• TMiR 2025-10: Post-conf; React 19.2, React Foundation, React Native removing old architecture. Next.js has too many directives · October 31, 2025 · 1h 14m