Security Update — qz‑l.com patched against React / Next.js Server‑Component Vulnerability (CVE‑2025‑55182)

Date: December 4, 2025

⚠ What Happened

On December 3, 2025, the React team disclosed a critical remote code execution (RCE) vulnerability affecting React Server Components (RSC), tracked as CVE-2025-55182. :contentReference[oaicite:3]{index=3}

The vulnerability arises from unsafe deserialization in the RSC “Flight” protocol. Even applications that don’t explicitly use Server Functions — but support server components — could be vulnerable. :contentReference[oaicite:4]{index=4}

The community quickly adopted the fix: patched versions of the RSC packages were released — namely 19.0.1, 19.1.2, 19.2.1, etc. :contentReference[oaicite:5]{index=5}

✅ What We Did: qz‑l.com Is Already Protected

• We audited our dependencies immediately after the disclosure.
• We confirmed that our app does not use any of the vulnerable versions (19.0.0, 19.1.0, 19.1.1, 19.2.0) of react-server-dom-*.
• All relevant packages have been upgraded to the safe versions (19.0.1 / 19.1.2 / 19.2.1 or later).
• In addition, we reviewed our deployment environment to ensure no stale dependencies remain, and re‑deployed to propagate the updates.

Therefore, qz‑l.com is not vulnerable to CVE‑2025‑55182 and remains secure.

🔐 Our Security Commitment

We take security seriously. In light of this incident, we will:

• Monitor security advisories for React, Next.js, and all related dependencies.
• Update dependencies proactively, especially after major disclosures.
• Review our CI/CD pipelines to ensure dependency updates are fast and traceable.
• Conduct periodic audits of our dependency tree.

If you have any questions, or want to report a concern, please contact us.

---

Thank you for trusting qz‑l.com. We’re committed to keeping your experience safe and reliable.