[PR #5084] [MERGED] security: bump react to 19.2.3 to fix CVE-2025-55182 (#5020) #4053

New issue

Closed

opened 2026-02-26 08:32:57 +03:00 by kerem · 0 comments

kerem commented

2026-02-26 08:32:57 +03:00

Owner

📋 Pull Request Information

Original PR: https://github.com/NginxProxyManager/nginx-proxy-manager/pull/5084
Author: @lacamera
Created: 12/15/2025
Status: ✅ Merged
Merged: 1/13/2026
Merged by: @jc21

Base: develop ← Head: security/CVE-2025-55182

📝 Commits (1)

5e6ead1 security: bump react to 19.2.3 to fix CVE-2025-55182 (#5020)

📊 Changes

2 files changed (+455 additions, -830 deletions)

View changed files

📝 frontend/package.json (+5 -5)
📝 frontend/yarn.lock (+450 -825)

📄 Description

This updates react and react-dom (and related packages) to
19.2.3 to mitigate a critical RCE vulnerability in RCS.

As far as I can tell this project is currently not affected by the vulnerability, but I think it would be best to update the versions anyway.

References:

CVE-2025-55182
Fixes #5020

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/NginxProxyManager/nginx-proxy-manager/pull/5084 **Author:** [@lacamera](https://github.com/lacamera) **Created:** 12/15/2025 **Status:** ✅ Merged **Merged:** 1/13/2026 **Merged by:** [@jc21](https://github.com/jc21) **Base:** `develop` ← **Head:** `security/CVE-2025-55182` --- ### 📝 Commits (1) - [`5e6ead1`](https://github.com/NginxProxyManager/nginx-proxy-manager/commit/5e6ead1eeecf0c175ff37bfd4578818f19a88e6e) security: bump react to 19.2.3 to fix CVE-2025-55182 (#5020) ### 📊 Changes **2 files changed** (+455 additions, -830 deletions) <details> <summary>View changed files</summary> 📝 `frontend/package.json` (+5 -5) 📝 `frontend/yarn.lock` (+450 -825) </details> ### 📄 Description This updates `react` and `react-dom` (and related packages) to 19.2.3 to mitigate a critical RCE vulnerability in RCS. As far as I can tell this project is currently not affected by the vulnerability, but I think it would be best to update the versions anyway. References: - [CVE-2025-55182](https://nvd.nist.gov/vuln/detail/CVE-2025-55182) - Fixes #5020 --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

kerem

2026-02-26 08:32:57 +03:00

closed this issue
added the
pull-request
label

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

starred/nginx-proxy-manager-NginxProxyManager#4053

No description provided.

Rows
Columns