CVE-2025-55182
About
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.
Rainforest analyst review
React Server Components expose Server Function endpoints that accept and deserialize payloads from HTTP requests, and in the affected 19.x releases of react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack that deserialization is unsafe. An unauthenticated attacker crafts a request to a Server Function endpoint whose deserialized contents are reconstructed into attacker-controlled objects and behavior, yielding remote code execution on the server before any authentication takes place.
This lives in the framework layer of modern React and Next.js applications, so it is reachable on the public front end of any app that shipped a vulnerable RSC bundle — exposure is effectively universal for affected builds, and the endpoint needs no credentials. Deserialization flaws of this kind are trivially weaponized once the sink is known, so treat it as urgent: upgrade the react-server-dom-* packages and Next.js to fixed versions immediately, and because exploitation runs code server-side, review affected hosts for anomalous process activity and outbound connections rather than assuming the upgrade closes an already-open door.
References
- https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components
- https://www.facebook.com/security/advisories/cve-2025-55182
- http://www.openwall.com/lists/oss-security/2025/12/03/4
- https://news.ycombinator.com/item?id=46136026
- https://aws.amazon.com/blogs/security/china-nexus-cyber-threat-groups-rapidly-exploit-react2shell-vulnerability-cve-2025-55182/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-55182
Related CVEs
Frequently asked questions
What is CVE-2025-55182?
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.
How severe is CVE-2025-55182?
CVE-2025-55182 carries a CVSS 3.1 base score of 10, rated critical. On the Rainforest Risk Index — which weighs the severity alongside how easy the flaw is to reach and how broad its impact is — it scores 100 out of 100, in the critical band.
How is CVE-2025-55182 exploited?
According to the CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H): attack vector Network, attack complexity Low, privileges required None, user interaction None. Impact on confidentiality High, integrity High and availability High.
Which products are affected by CVE-2025-55182?
Public advisories list the following as affected: next.js, react. Check the references on this page for the exact versions each vendor confirms.
How do I fix CVE-2025-55182?
Apply the fix the vendor published — the references on this page link to the primary advisories and patches. When patching can't happen right away, reduce the exposure of the affected component and watch it for exploitation attempts. Rainforest customers see this vulnerability correlated to their own assets and prioritized by real exposure, not by score alone.
Empower Your Security Strategy with Rainforest
Discover vulnerabilities early, prioritize critical threats, and protect what truly matters. Rainforest streamlines your security operations, saving you time and reducing costs, so you can focus on what drives your business forward.