CVE-2025-55182
CVE-2025-55182
This page contains facts from public vulnerability sources. Check the original advisory before updating.
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.
CVSS 10.0 · Critical · EPSS 99.8% · In KEV · Public exploit · Fix available
- Published
- Updated
Stack: node
Affected products and versions
react-server-dom-webpack
- Versions
- ≥ 19.0.0, ≤ 19.0.0: Affected (semver)
- ≥ 19.1.0, ≤ 19.1.1: Affected (semver)
- ≥ 19.2.0, ≤ 19.2.0: Affected (semver)
No fix published
react-server-dom-turbopack
- Versions
- ≥ 19.0.0, ≤ 19.0.0: Affected (semver)
- ≥ 19.1.0, ≤ 19.1.1: Affected (semver)
- ≥ 19.2.0, ≤ 19.2.0: Affected (semver)
No fix published
react-server-dom-parcel
- Versions
- ≥ 19.0.0, ≤ 19.0.0: Affected (semver)
- ≥ 19.1.0, ≤ 19.1.1: Affected (semver)
- ≥ 19.2.0, ≤ 19.2.0: Affected (semver)
No fix published
react-server-dom-webpack npm
- Versions
- 19.0.0
- Affected ranges
- SEMVER: ≥ 19.0.0, < 19.0.1
Update to 19.0.1
react-server-dom-webpack npm
- Affected ranges
- SEMVER: ≥ 19.1.0, < 19.1.2
Update to 19.1.2
react-server-dom-webpack npm
- Versions
- 19.2.0
- Affected ranges
- SEMVER: ≥ 19.2.0, < 19.2.1
Update to 19.2.1
react-server-dom-turbopack npm
- Versions
- 19.0.0
- Affected ranges
- SEMVER: ≥ 19.0.0, < 19.0.1
Update to 19.0.1
react-server-dom-turbopack npm
- Affected ranges
- SEMVER: ≥ 19.1.0, < 19.1.2
Update to 19.1.2
react-server-dom-turbopack npm
- Versions
- 19.2.0
- Affected ranges
- SEMVER: ≥ 19.2.0, < 19.2.1
Update to 19.2.1
react-server-dom-parcel npm
- Versions
- 19.0.0
- Affected ranges
- SEMVER: ≥ 19.0.0, < 19.0.1
Update to 19.0.1
react-server-dom-parcel npm
- Affected ranges
- SEMVER: ≥ 19.1.0, < 19.1.2
Update to 19.1.2
react-server-dom-parcel npm
- Versions
- 19.2.0
- Affected ranges
- SEMVER: ≥ 19.2.0, < 19.2.1
Update to 19.2.1
Original sources
- https://www.facebook.com/security/advisories/cve-2025-55182
- https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components
- https://aws.amazon.com/blogs/security/china-nexus-cyber-threat-groups-rapidly-exploit-react2shell-vulnerability-cve-2025-55182/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-55182
- http://www.openwall.com/lists/oss-security/2025/12/03/4
- https://news.ycombinator.com/item?id=46136026
- https://nvd.nist.gov/vuln/detail/CVE-2025-55182