Build1 publisher2 min readPublished
React Compiler 1.0 skips any component that breaks the Rules of React
React Compiler 1.0 checks each component against the Rules of React and leaves the failures unoptimized, so lint debt is now a performance question. The December Server Function advisories only reach apps that run a server.
The Engineer · Build desk
What happened
- React Compiler reached 1.0 on 7 October 2025, automatically memoizing components and hooks in both React and React Native, with documented installs for Babel, Vite and Rsbuild.
- On 3 December 2025 React disclosed CVE-2025-55182 at CVSS 10.0, in which an unauthenticated HTTP request to a Server Function endpoint reached remote code execution during deserialization.
- Eight days later came three denial-of-service CVEs at 7.5, where malicious Server Function requests caused infinite loops that hang the process, plus a source-exposure CVE at 5.3.
- The release dated 9 September 2026 added ViewTransition, which animates elements entering, leaving, moving or resizing through the browser's View Transition API, and refs on Fragment.
Compiled by The EngineerSomething wrong?How this is made
Why it matters
- constraint Hook lint warnings now bound how much of a codebase the compiler will touch, so the memoization win a team gets is limited by its oldest unfixed rule violation.
- cost Anyone who answered the 3 December remote code execution flaw has a second upgrade to schedule, because the 19.1 line still has to reach 19.1.5.
- exposure The reachable surface is the Server Function endpoint, so the December risk sits with teams running next, react-router, waku or the RSC plugins, and not with a client-only bundle.
- decision Adopting automatic memoization on a Create React App project means choosing a build integration first, since the compiler ships for Babel, Vite and Rsbuild.
The check runs at compile time. The compiler validates a component against the Rules of React, and when it finds a violation it skips that component instead of optimizing it wrongly [5]. The component is left as written. Nothing breaks and nothing gets faster, so the only signal that a file was skipped is the lint warning that was already sitting in the queue [5].
For a codebase with a backlog of hook warnings, the payoff arrives unevenly. Files that pass get their `useMemo` and `useCallback` work done by the compiler [3]. Files that do not keep whatever render behaviour they had.
The December advisories cover five CVE identifiers across three classes [22]. The 10.0 applies to `react-server-dom-webpack`, `react-server-dom-parcel` and `react-server-dom-turbopack` at 19.0, 19.1.0, 19.1.1 and 19.2.0 [8], and the affected frameworks are `next`, `react-router`, `waku`, `@parcel/rsc`, `@vitejs/plugin-rsc` and `rwsdk` [9]. An app that uses neither RSC nor a server is not touched by any of them [17].
The patch path has two steps. The remote code execution fix shipped in 19.0.1, 19.1.2 and 19.2.1 [10]; the 11 December denial-of-service and source-exposure fixes shipped in 19.0.4, 19.1.5 and 19.2.4 [13]. A team that answered the 10.0 by moving to 19.1.2 is three patch releases short of 19.1.5 [20]. The two waves shipped eight days apart [19].
Triage for the source-exposure bug is narrow. Only secrets hand-written into the file are returned; values read from `process.env` are not [14]. The thing to grep for is a key someone pasted into a `'use server'` file to test something.
The lint swap is the install detail with a config line behind it. `eslint-plugin-react-compiler` is retired, and the compiler's rules now travel inside `eslint-plugin-react-hooks` under the `recommended` and `recommended-latest` presets [4].
So the Create React App question is a build tooling question. The compiler's documented installs are Babel, Vite and Rsbuild [2], and Create React App is none of the three [21]. The author of the dev.to post writes that he pulled Create React App out of one 2022 project this week and wrote the plan for a 2023 one, and that both still worked [18].
What to watch
- Whether further Server Function advisories land on the 19.2.x line after 19.2.4.
- Whether React documents a compiler integration for webpack-based setups, which would remove the build-tool migration from the adoption path.
- Whether next, react-router, waku, @parcel/rsc, @vitejs/plugin-rsc and rwsdk publish pinned minimum React versions rather than ranges.