Meta · React Server Components

CVE-2025-55182

Meta React Server Components Remote Code Execution Vulnerability

Exploited in attacks Used by ransomware Critical 10.0 Attack chance: 99.8%

What it is

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.

CISA: Meta React Server Components contains a remote code execution vulnerability that could allow unauthenticated remote code execution by exploiting a flaw in how React decodes payloads sent to React Server Function endpoints. Please note CVE-2025-66478 has been rejected, but it is associated with CVE-2025- 55182.

What to do

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Deadline for US federal agencies: December 12, 2025

Added to the CISA list: December 5, 2025
Published: December 3, 2025
Severity: Critical 10.0 CVSS 3.1
Chance of attacks in the next 30 days (EPSS): 99.8% in the top 0.1% of all known vulnerabilities
More details: NVD · CVE.org · CISA

All references (2)

Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.