Why do I have a risk against client-side React?

you may have seen https //nvd nist gov/vuln/detail/cve 2025 55182 reported as a risk in your scan, this shows as being against react server components, which are server side only however, next js does bundle react with server components enabled by default, and therefore we can detect it hexiosec asm identifies software components and versions on discovered websites and checks them daily against the cves published in nist’s national vulnerability database, which already includes this cve you can read more about how asm detects cves https //docs hexiosec com/asm/will the latest cve be found react this vulnerability affects react server components, which run entirely on the server server components are not exposed to the browser, so no external scanner — including asm — can determine whether a website is using the vulnerable server side feature client side react (which is externally visible) does not provide any indication of whether server components are present as a result, this particular vulnerability, when found for react, cannot be externally detected and will not show in hexiosec asm scan results next js in contrast, we can identify the version of next js in use if asm detects a version affected by cve 2025 55182, we will raise the associated risk in the platform