This Week In React #262: React2Shell, Fate | React Native 0.83, Reanimated 4.2, State of RN | CSS, Temporal

#react #reactnative

Hi everyone!

This week, it remains important for me to raise awareness about the React Server Components vulnerability, since an exploit is now widely available. Thankfully, we also have more positive React news!

It’s even hotter on the React Native side. We were patiently waiting for 0.83 to publish 😇 and it’s now out. You can now use <Activity> in React Native 🔥. Reanimated 4.2 is also out with Shared Elements Transition support 🔥.

It’s the survey season, don’t forget to answer the 2 most important ones that are currently open:

💡 Subscribe to the official newsletter to receive an email every week!

💸 Sponsor

Learn how to build a TanStack Start project with Strapi

In this video tutorial, you'll learn how to create a fully dynamic, SEO-friendly landing page and blog website, which includes the following features:

pagination
search
authentication
comments

TanStack Start is an open source React framework built by and for the community.

⚛️ React

React2Shell - CVE-2025-55182

In case you missed my email, a 10.0-scored vulnerability affecting React Server Components was unveiled last week. And it’s a really nasty one, enabling unauthenticated remote code execution with a simple HTTP request. Many React meta-frameworks and custom setups are affected, in particular Next.js (v14-canary, v15, v16). If your app is affected, you really need to upgrade now!

Although no exploit was initially shared, infosec researchers and hackers quickly reverse-engineered the patch, and an exploit has been circulating online only ~30 hours after the initial disclosure. Hackers around the world have already been exploiting it at scale. There are even browser extensions to detect and exploit vulnerable sites. It wouldn’t be surprising to see a worm exploiting it.

I’ve found so many related links, so here’s my top selection:

🐦 Vercel CEO Guillermo Rauch explains how the exploit works: It’s quite sophisticated and shows the talent of Lachlan and Sylvie, who disclosed it after hours of research. I learned a few things about “gadgets” in JS that could be exploited.
👀 React PR - Patch FlightReplyServer with fixes from ReactFlightClient: The security patch that has been reverse-engineered.
📜 Red Herrings and AI Slop: Debunking React2Shell Misinformation: Explains the patch PR above has been deliberately misleading to buy time and let the community upgrade ASAP.
📜 Cloudflare outage on December 5, 2025: It was due to mitigation measures for the vulnerability 😅.
🔐 Next.js Security Advisory: Including a command-line tool to help you patch your Next.js app. There’s also a Vercel Security Bulletin.
📦 Original Proof-of-Concepts for React2Shell
🎥 Theo - React got hacked. It's really, really bad

💸 STRICH - Add lightning-fast barcode scanning to your app with a lean JS lib. Built-in UI, simple, predictable pricing, free trial and demo!
🐦 React Fiber explained: A fun but accurate explanation of how and why React re-implemented its own stack and scheduling system.
🗓 React Paris 2026 - 🇫🇷 Paris - 26 & 27 March. Full speaker lineup just dropped! Una Kravets, Gabriel Pichot and Kitze are part of the lineup, bringing cutting-edge React insights to the French capital. Get a 10% discount with code "TWIR".
📜 React 19.2. Further Advances INP Optimization: Focusing on Activity and the new DevTools performance tracks.
📜 Skeletons in My Codebase: Tanstack in Production: Pragmatic TanStack Router lessons learned through trial and error.
📜 Do's and Don'ts of useEffectEvent in React
📜 TanStack Start: New competitor to Next.js
📜 Bundle Size Investigation: A Step-by-Step Guide to Shrinking Your JavaScript
📜 Reatom: State Management That Grows With You
📜 React Elements, Children as Props, and Re-Renders
📜 Controlled vs Uncontrolled Components in React
💸 React Certification - Last chance to get React certified at a deep discount; Bootcamp training bundles start at 60% OFF. Offer ends soon.
📦 Fate alpha - A modern data client for React & tRPC: A new declarative data fetching and state management solution for React is now in alpha, created by former Meta employee Christoph Nakazawa. Inspired by the Relay client, it brings useful features such as state co-location, data normalization, view composition, and data masking, without needing GraphQL.
📦 TanStack AI Alpha: TanStack has unveiled its new AI package that is framework, language, and service agnostic. The official intro doesn’t share many details, but I liked this community article that compares it to the Vercel AI SDK. It should have a great integration with TanStack Start and also ship a headless chat UI library. Also watch this walkthrough video from one of its creator, Alem Tuzlak.
📦 React Grab for Agents: This lets you assign concurrent UI-related tasks to AI agents directly from your browser with a nice user experience. You automatically share the right context (file path, component stack…) to clearly communicate your intent to AI agents so that they don’t lose time figuring things out.
📦 Formisch - Modular and type-safe form library for any framework: Initially built for Solid, now includes React bindings.
📦 SVAR React DataGrid - Fast, feature-rich React datagrid with sorting, filtering, virtual scrolling, and more
📦 Base UI 1.0 rc.0
🎙️ PodRocket - Whats new in React 19.2 with Shruti Kapoor

💸 Sponsor

Make your AI code guidelines stick with CodeRabbit

You already tuned your AI agents with .cursorrules, CLAUDE.md, Agents.md, and Copilot-instructions. CodeRabbit reads those guideline files and uses them to enforce code quality in every PR review, so comments line up with the rules you have already written.

📱 React-Native

React Native 0.83

A new minor version of React Native has just been published. Without any user-facing breaking changes, it reflects the efforts to stabilize the framework, making it easier to upgrade and benefit from new, useful features.

The highlights are:

React 19.2, enabling support for <Activity> and useEffectEvent
DevTools with Network and Performance panels, and a new desktop app
Intersection Observers (Canary), another DOM API coming to React Native
Web Performance APIs are now stable
Hermes V1 performance improvements
Experimental iOS feature flags to compile out the Legacy Architecture, and debug precompiled binaries

Reanimated 4.2 - Shared Element Transitions

Software Mansion devs have finally reimplemented Shared Element Transitions – the most requested feature – on top of Reanimated 4 and the New Architecture. It makes it possible to animate views between two different screens, giving a feeling of continuity when navigating. This feature and other performance improvements are gated behind feature flags to collect feedback and finalize the implementation.