CVEvulnerability

CVE-2025-55182

10.0 CRITICAL Known exploited Published 2025-12-03 Modified 2026-10-18 Official page ↗

CISA Known Exploited Vulnerability

Meta React Server Components Remote Code Execution Vulnerability — Meta React Server Components

Meta React Server Components contains a remote code execution vulnerability that could allow unauthenticated remote code execution by exploiting a flaw in how React decodes payloads sent to React Server Function endpoints. Please note CVE-2025-66478 has been rejected, but it is associated with CVE-2025- 55182.

Added to KEV
2025-12-05
Remediation due
2025-12-12
Ransomware use
Known
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Notes
Check for signs of potential compromise on all internet accessible REACT instances after applying mitigations. For more information, please see: https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components ; https://github.com/vercel-labs/fix-react2shell-next?tab=readme-ov-file ; https://nvd.nist.gov/vuln/detail/CVE-2025-55182
Status
Analyzed
Published
2025-12-03
Last modified
2026-10-18
Assigner
[email protected]
CVSS 3.1 ([email protected])
10.0 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Weaknesses
CWE-502

Description

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.

Affected configurations

• facebook react 19.0.0 • facebook react 19.1.0 • facebook react 19.1.1 • facebook react 19.2.0 • vercel next.js (>= 15.0.0 < 15.0.5) • vercel next.js (>= 15.1.0 < 15.1.9) • vercel next.js (>= 15.2.0 < 15.2.6) • vercel next.js (>= 15.3.0 < 15.3.6) • vercel next.js (>= 15.4.0 < 15.4.8) • vercel next.js (>= 15.5.0 < 15.5.7) • vercel next.js (>= 16.0.0 < 16.0.7) • vercel next.js 14.3.0 • vercel next.js 15.6.0 • vercel next.js 16.0.0

Related

Weakness · CWE (1)

  • CWE-502 Deserialization of Untrusted Data weakness

References