1. Home
  2. Reference documentation
  3. Changelog
  4. 2025
  5. December 2025

Added virtual patch for CVE-2025-55183 (React Leaking Server Functions)

December 12, 2025
ngwaf-announcementsadded

A Leak of Server Functions has been found in React and has been assigned CVE-2025-55183. Fastly has created a virtual patch and it is now enabled by default with immediate blocking for all Next-Gen WAF customers. To deactivate it and remove this protection from your services, follow the steps for your control panel below.

Next-Gen WAF control panel

  1. Professional or Premier platform
  2. Essentials platform

  1. Log in to the Next-Gen WAF control panel.

  2. From the Sites menu, select a site if you have more than one site.

  3. From the Rules menu, select Templated Rules.
  4. In the search bar, enter CVE-2025-55183 and then click View for the CVE-2025-55183 templated rule.
  5. Click Configure and then deselect the “Enabled” box under the "Configure thresholds and actions” section.
  6. Click Update rule.

Fastly control panel

  1. Log in to the Fastly control panel.

  2. Go to Security > Next-Gen WAF > Workspaces.

  3. Click Virtual Patches.
  4. In the search bar, enter CVE-2025-55183 and then click the pencil to the right of the CVE-2025-55183 virtual patch.
  5. From the Status menu, select Disabled.
  6. Click Update virtual patch.

Prior change: CVE-2025-55182 virtual patch enabled by default

Following change: Added virtual patch for CVE-2025-55184 (React DoS)

Fastly
© Fastly 2025