CRITICAL Actively exploited Used in ransomware CWE-502
CVE-2025-55182
Meta React Server Components Remote Code Execution Vulnerability
Meta·React Server Components
10.0/ 10
CVSS 3.1
Critical severity
100%
EPSS exploit odds
Chance of exploitation in the next 30 days
Among the very highest of all CVEs
Listed
CISA KEV catalog
- Added
- Dec 5, 2025
- Fix due
- Dec 12, 2025
- Ransomware
- Known use
Timeline
- Published
- Dec 3, 2025
- Updated
- Oct 7, 2026
- First covered
- Jul 2, 2026
- Latest story
- 4 months ago
Summary
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.
CWE-502Deserialization of Untrusted Data
Attack profile
Attack vectorNetwork
ComplexityLow
PrivilegesNone
User interactionNone
ScopeChanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HCISA required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Affected products
- Meta react-server-dom-webpack19.0.0 to 19.0.019.1.0 to 19.1.119.2.0 to 19.2.0
- Meta react-server-dom-turbopack19.0.0 to 19.0.019.1.0 to 19.1.119.2.0 to 19.2.0
- Meta react-server-dom-parcel19.0.0 to 19.0.019.1.0 to 19.1.119.2.0 to 19.2.0