.dev sign in

← Exploited CVEs

CVE-2025-55182

Meta React Server Components Remote Code Execution Vulnerability

Severity
critical
CVSS v3
10
EPSS percentile
100%
Known exploited
yes (CISA KEV)
Vendor
Meta
Product
React Server Components
Published
2025-12-05
Modified
2026-10-18

Description

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.

NVD record

Informational only. Not a warranty of security, completeness or fitness for any purpose. Derived from NVD, CISA KEV, FIRST.org EPSS and vendor advisories (CVE Program List v5); those sources change continuously and may be incomplete or incorrect. Verify every remediation against the vendor advisory before acting. Absence of a finding is not evidence that no vulnerability exists. Not endorsed by NVD, CISA, FIRST or any vendor named.

Raw record
{
  "id": "CVE-2025-55182",
  "title": "Meta React Server Components Remote Code Execution Vulnerability",
  "description": "A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.",
  "severity": "critical",
  "cvss": 10,
  "epss": 100,
  "kev": 1,
  "vendor": "Meta",
  "product": "React Server Components",
  "published": "2025-12-05",
  "modified": "2026-10-18T17:10:00.110",
  "source": "nvd",
  "remediation": [],
  "disclaimer": "Informational only. Not a warranty of security, completeness or fitness for any purpose. Derived from NVD, CISA KEV, FIRST.org EPSS and vendor advisories (CVE Program List v5); those sources change continuously and may be incomplete or incorrect. Verify every remediation against the vendor advisory before acting. Absence of a finding is not evidence that no vulnerability exists. Not endorsed by NVD, CISA, FIRST or any vendor named."
}