Vercel Security Incident: What To Know
We are committed to user transparency, so this provides an account of our response to a third-party security vulnerability regarding Vercel React.
We are committed to user transparency, so this provides an account of our response to a third-party security vulnerability regarding Vercel React.
Discover why Carpathian built its entire cloud infrastructure from scratch instead of relying on AWS or Azure. Learn about our approach to ownership.
Fine-tuning teaches behavior, RAG supplies knowledge, prompting shapes both. What the published comparisons found, and how to pick without burning a GPU budget.
Why AI chat can be free, what happens to what you type, and the short checklist worth running before anything from work goes into a chat box.
When owning your hardware beats renting a virtual machine, when it does not, and the questions to ask a colocation facility before you commit to anything.
Object storage explained: how it differs from a server disk, what it is good and bad at, and the signs that tell you it is time to use a bucket.
We are committed to user transparency, so this provides an account of our response to a third-party security vulnerability. We are committed to keeping our users informed about events that may affect their trust in our platform regardless if they are affected.
On December 3, 2025, Vercel disclosed a zero-day vulnerability (CVE-2025-55182) affecting applications built on their platform. This vulnerability could allow attackers to execute arbitrary code on user machines through malformed URLs containing bash or PowerShell commands.
On December 5, 2025, our security team detected an attempted exploitation of this vulnerability targeting Carpathian infrastructure. Our layered defense systems responded effectively, and we are providing this update in the interest of transparency for our users.
Our security architecture performed as designed. While the initial perimeter firewall did not block the request, our host-based firewalls successfully blocked the malicious script from establishing communication with external command-and-control servers. This prevented any payload from being downloaded or executed.
No passwords, usernames, emails, addresses, or other personally identifiable information was accessed or exfiltrated. Carpathian services remained fully operational with zero downtime. CynosSecure continues to monitor all user environments and hypervisors around the clock.
This incident reinforces the value of our defense-in-depth approach. Each of our software products maintains strict isolation between frontend and backend systems, with additional separation across platforms. We remain committed to ensuring all systems handling user information are properly segmented and secured.
No action is required at this time. Your account remains secure, and no personal information was compromised. That said, we always recommend enabling multi-factor authentication as an added layer of protection for your account.
Was any personally identifiable information accessed?
No. Our backend services operate on isolated infrastructure. Even in a scenario where attackers could scan and exfiltrate data from the affected system, no user, company, or sensitive information resides there.
What information was exposed?
The attackers accessed system-level server user lists and SSH directories on the compromised system. These contain only internal service account information, not Carpathian customer usernames or credentials, and do not contain any information related to Carpathian infrastructure or user environments.
Do I need to reset my password?
No. Our databases are encrypted and passwords are hashed. The system that was targeted does not host any user information.
This update brings a fully redesigned website, Veritate AI, free threat intel feeds, Spark snapshots/restores, and billing.
For additional questions, please contact us at info@carpathian.ai.
Read the release here: https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components