IMPORTANT SECURITY NOTICE

⚠️ For users who upgraded to version 1.10.1-fix.1, please ensure you are now running langgenius/dify-web:1.11.1 and related services on the latest release.

This update is strongly recommended to fully mitigate multiple security vulnerabilities affecting React Server Components.

Background

React has disclosed multiple critical vulnerabilities affecting React Server Components, including but not limited to:

🔴 CVE-2025-55182

A critical vulnerability in React Server Components that may allow unexpected server-side behavior and potential data exposure under specific rendering conditions.

🔴 CVE-2025-55184

Another React Server Components–related vulnerability that could lead to improper isolation between server-rendered components, increasing the risk of cross-boundary data leakage.

🔴 CVE-2025-67779

A security issue affecting the React rendering pipeline that may result in unintended execution paths or unsafe state reuse in server environments.

These vulnerabilities primarily affect self-hosted deployments that bundle vulnerable React versions.

Affected Scope

• ✅ Dify SaaS: Not affected
• ⚠️ Self-hosted Dify: Affected if running outdated images

All React dependencies have been upgraded to patched versions in the latest release.

Required Action ✅

Self-hosted users must upgrade immediately to:

👉 Release v1.11.1
https://github.com/langgenius/dify/releases/tag/1.11.1

Please also verify that your docker-compose.yml (or equivalent) references the correct images, for example:

image: langgenius/dify-web:1.11.1

References

• 🔐 Security Policy
  https://github.com/langgenius/dify?tab=readme-ov-file#security-disclosure

• 🛡️ GitHub Advisory Database

  • GHSA-fv66-9v8q-g76r (CVE-2025-55182)

For security issues, please use GitHub Security Advisories:
https://github.com/langgenius/dify/security/advisories/new

⚠️ We have already received many reports.
Please do not submit duplicate issues for these CVEs.

Duplicate Issues (Closed)

• CVE-2025-55182 on http://114.55.151.34 #29233
• [Security] CVE-2025-55182 (React2Shell RCE) - Fix for version 2.0-beta? #29244
• After the upgrade, the CPU usage is extremely high. Could you please check if this is the latest version with vulnerability fixes? #29276
• systemd-devd process on host can be misinterpreted as malicious #29275
• Next.js React Server Components Remote Code Execution Vulnerability (CVE-2025-66478) #29219
• [Security vulnerabilities need to be fixed.] React/Next.js #29202
• The components used by dify contain a remote code execution vulnerability. #29167
• Latest cve- 2025-55184 and CVE- 2025-67779 Will it have a re-impact? #29565