Vercel disclosed CVE-2025-55184 (DoS) and CVE-2025-55183 (source code leak) in React Server Components. Plus token scope changes and Supapool RLS risks. Patch now.
Alpha Score of 60 reflects moderate overall profile with strong momentum, weak value, weak quality, moderate sentiment.
Two vulnerabilities landed in React Server Components this week. Vercel disclosed CVE-2025-55184, a high-severity denial-of-service bug, and CVE-2025-55183, a medium-severity issue that can leak server-side source code. Neither is a five-alarm event. Both touch the stack that Lovable, v0, and most Next.js-based AI builders ship on top of.
Source code exposure means parts of your server logic could become readable to an attacker who knows how to trigger the bug. Denial of service means your app could go down under the right request pattern. Neither requires you to have done anything wrong – the problem lives at the framework level. The fix is a framework update, not a code rewrite. Vercel said the patches are rolling out now.
Vercel also shipped two changes that shrink what a stolen credential can do. Project-scoped tokens can now be limited to a single project. A leaked token can't touch your other apps or team resources. Turborepo Remote Cache now accepts OIDC tokens from CI/CD pipelines instead of long-lived personal access tokens. Short-lived, narrowly-scoped credentials are boring, and that's the point – they limit damage when something leaks. If you are still using a single all-access API token across every automation and CI job, this is your nudge to scope it down.
Supapool, posted on Hacker News this week, provisions a fresh Supabase instance for each coding agent in roughly 400 milliseconds. That is a real convenience for teams running multiple AI agents against isolated backends. Every new instance inherits the same responsibility as your production database. A Supabase project's anon key being public is normal – it ships in every client bundle by design. The actual risk is whether Row Level Security is turned on and configured correctly on every table, in every instance you spin up, including the ones an agent created for you overnight. Spinning up databases fast does not make that check optional.
Prized, a Y Combinator S26 company, launched on Hacker News with a pitch aimed at a real gap: letting non-engineer staff build internal tools that are secure by default. That is the vibe-coding world in miniature. More people than ever are shipping software without a security background, and the tools around them are starting to compensate. It is a sign the market has noticed the gap between an app that works and an app that is safe.
If your app runs on Next.js, check what version you are on. Most AI builders that deploy to Vercel or use Next.js under the hood will need a framework update to pick up the fix. This is not something you caused by prompting badly. It is a framework-level bug.
Tools like Supapool make per-agent database isolation fast and cheap, which is a good practice for keeping agents from stepping on each other's data. Isolation only helps if each new database gets the same access control review as your main one. A fast provisioning step is not a substitute for checking RLS.
Patch your Next.js version for the RSC CVEs. Scope down any long-lived tokens you are still using. If you are spinning up new backends fast, check RLS on each one before you trust it with real data.
Drafted by a large language model from the source reporting linked above, then screened by automated publishing checks. It is not read by a journalist before publication. Some articles cite our Alpha Score. Verify prices and figures against the original source. Educational coverage, not personalized advice.