Barracuda Application Protection safeguards against critical React and Next.js flaws

Home / QSOL IT News / AI / Barracuda Application Protection safeguards against critical React and Next.js flaws

Two newly disclosed critical remote code execution (RCE) vulnerabilities—CVE-2025-55182 and CVE-2025-66478—pose a serious threat to applications built on React and Next.js. These flaws allow attackers to execute arbitrary code on vulnerable systems, which can lead to application compromise, unauthorized access and potential data loss.

Why these matter

Exploitation requires no authentication, giving threat actors a fast track to take control of applications, steal sensitive data or disrupt critical services. With React and Next.js powering countless customer-facing and internal apps, the attack surface is substantial—and the risk is immediate. Organizations without robust protections are highly exposed.

Barracuda Application Protection—Recommendations

As part of Barracuda Application Protection, Barracuda Web Application Firewall (WAF) and Barracuda WAF-as-a-Service provide automatic protection against remote code execution attacks such as the ones presented by these vulnerabilities. Security updates are regularly pushed for all customers running versions 12.1, 12.2 and GA supported by Barracuda’s cloud-based threat intelligence, which delivers real-time defense through signature updates and active detection.

For customers who have react-server-dom* (19.0.0, 19.1.0, 19.1.1, and 19.2.0) or Next.js (16.0.7, 15.5.7 and 15.4.8) present in their environment, we strongly recommend following the guidance in these Barracuda Campus articles, which will be updated as new information becomes available:

All customers should review their application inventory to identify any use of React or Next.js with React Server Components. Along with that, update to the latest versions of React (19.2.1) and Next.js (16.0.7, 15.5.7 and 15.4.8).

For environments not using the vulnerable React or Next.js versions, no further action is needed at this time.

Our commitment

Barracuda remains committed to helping organizations stay resilient against evolving threats.

Barracuda Application Protection provides:

  • Automatic safeguards: Instantly blocks malicious payloads designed to exploit React and Next.js vulnerabilities.
  • Layered defenses: Combines signature-based detection, behavioral analysis and AI-driven threat intelligence to stop RCE attempts.
  • Continuous updates: Real-time signature updates through Barracuda’s global threat intelligence network—no manual intervention required.
  • Ease of use: Centralized visibility and control through the BarracudaONE cybersecurity platform, ensuring strong defenses without added complexity.

Whether it’s email, network or application security, our unified platform approach ensures customers and partners can operate with confidence—even as attackers target new vulnerabilities.

Photo: babar ali 1233 / Shutterstock

This post originally appeared on Smarter MSP.

Related Post

Cybersecurity Threat Advisory: Critical Microsoft Outlook vulnerability

A newly disclosed Microsoft Outlook vulnerability, tracked as CVE-2025-62562, could allow for remote code execution (RCE). Read this Cybersecurity Threat

critical vulnerability, cybersecurity, Cybersecurity Threat Advisory, Featured, Microsoft Outlook, phishing, RCE, Security, social engineering, Syndicated, Threat Advisory, vulnerability

Cybersecurity Threat Advisory: Critical ArrayOS VPN flaw

Attackers are exploiting a command injection vulnerability in ArrayOS AG VPN devices to plant PHP webshells and create rogue users.

ArrayOS, ArrayOS AG Series, Command Injection, critical vulnerability, cybersecurity, Cybersecurity Threat Advisory, Featured, flaw, Security, Syndicated, Threat Advisory, vulnerability

Cybersecurity Threat Advisory: Apache Tika vulnerability

A maximum-severity Extensible Markup Language (XML) External Entity (XXE) injection vulnerability has been disclosed in Apache Tika, tracked as CVE-2025-66516

Apache Tika, cybersecurity, Cybersecurity Threat Advisory, Featured, Security, Syndicated, Threat Advisory, vulnerability, XDR

Q&A: How MSPs can strengthen municipal cyber defenses

Cities and municipalities continue to be under siege from hackers. In the past three months alone, several cities have been

Cities, cyber attacks, cybercriminals, cybersecurity, Featured, hackers, MSP, municipal cybersecurity, municipalities, phishing, Security, Syndicated, Technology