starred/ntfy

Fork 0

mirror of https://github.com/binwiederhier/ntfy.git synced 2026-05-09 16:35:53 +02:00

[GH-ISSUE #1513] CVE-2025-55182 #1066

New issue

Closed

opened 2026-05-07 00:30:00 +02:00 by BreizhHardware · 5 comments

BreizhHardware commented

2026-05-07 00:30:00 +02:00

Owner

Originally created by @canuckdev on GitHub (Dec 8, 2025).
Original GitHub issue: https://github.com/binwiederhier/ntfy/issues/1513

Hi,

I'm using latest ntfy release:
ntfy 2.15.0 (b531bc9), runtime go1.24.10, built at 2025-11-16T18:48:15Z

but from the js console I see:

window.REACT_DEVTOOLS_GLOBAL_HOOK.renderers.get(1).version
< 19.2.0

and 19.2.0 is vulnerable according to CVE record https://www.cve.org/CVERecord?id=CVE-2025-55182.

What do you think?

Thanks, Jeremy

Originally created by @canuckdev on GitHub (Dec 8, 2025). Original GitHub issue: https://github.com/binwiederhier/ntfy/issues/1513 Hi, I'm using latest ntfy release: ntfy 2.15.0 (b531bc9), runtime go1.24.10, built at 2025-11-16T18:48:15Z but from the js console I see: > window.__REACT_DEVTOOLS_GLOBAL_HOOK__.renderers.get(1).version < 19.2.0 and 19.2.0 is vulnerable according to CVE record https://www.cve.org/CVERecord?id=CVE-2025-55182. What do you think? Thanks, Jeremy

BreizhHardware

2026-05-07 00:30:00 +02:00

closed this issue
added the
question
label

BreizhHardware commented

2026-05-07 00:30:00 +02:00

Author

Owner

@canuckdev commented on GitHub (Dec 8, 2025):

https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components

@canuckdev commented on GitHub (Dec 8, 2025): https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components

BreizhHardware commented

2026-05-07 00:30:01 +02:00

Author

Owner

@binwiederhier commented on GitHub (Dec 8, 2025):

My understanding is that the CVE only applies if you use React on the server side. ntfy does not run React on the server. It's 100% Go.

That makes it not vulnerable. Or am I misunderstanding the CVE?

@binwiederhier commented on GitHub (Dec 8, 2025): My understanding is that the CVE only applies if you use React on the server side. ntfy does not run React on the server. It's 100% Go. That makes it not vulnerable. Or am I misunderstanding the CVE?

BreizhHardware commented

2026-05-07 00:30:01 +02:00

Author

Owner

@canuckdev commented on GitHub (Dec 8, 2025):

I don't know enough about ntfy web app and react, but the react.dev blog post says:

Even if your app does not implement any React Server Function endpoints it may still be vulnerable if your app supports React Server Components.

@canuckdev commented on GitHub (Dec 8, 2025): I don't know enough about ntfy web app and react, but the react.dev blog post says: > Even if your app does not implement any React Server Function endpoints it may still be vulnerable if your app supports React Server Components.

BreizhHardware commented

2026-05-07 00:30:01 +02:00

Author

Owner

@itepechi commented on GitHub (Dec 10, 2025):

github.com/binwiederhier/ntfy@b531bc95ea/server/server.go (L566-L569)

As mentioned, the server is written in Go, and the frontend is a static webpage. The CVE only applies if your server is capable of running a React code (a JavaScript library).

@itepechi commented on GitHub (Dec 10, 2025): https://github.com/binwiederhier/ntfy/blob/b531bc95ea9faedf68c5b3987f2744df0960384d/server/server.go#L566-L569 As mentioned, the server is written in **Go**, and the frontend is a **static** webpage. The CVE only applies if your server is capable of **running** a React code (a **JavaScript** library).

BreizhHardware commented

2026-05-07 00:30:01 +02:00

Author

Owner

@canuckdev commented on GitHub (Dec 11, 2025):

Thank you :)

@canuckdev commented on GitHub (Dec 11, 2025): Thank you :)

BreizhHardware referenced this issue

2026-05-07 01:02:26 +02:00

[PR #1066] [MERGED] Disallow certain templates #1508