NetSight
IP …
critical10.0Known exploitedPublic exploit code

CVE-2025-55182

Meta React Server Components Remote Code Execution Vulnerability

Exploited in the wild

This vulnerability is on the CISA Known Exploited Vulnerabilities list, added 2025-12-05. Federal due date: 2025-12-12.

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

Meta React Server Components contains a remote code execution vulnerability that could allow unauthenticated remote code execution by exploiting a flaw in how React decodes payloads sent to React Server Function endpoints. Please note CVE-2025-66478 has been rejected, but it is associated with CVE-2025- 55182.

Affected packages

EcosystemPackageAffectedFixed in
npmreact-server-dom-webpack>= 19.1.0, < 19.1.219.1.2
npmreact-server-dom-turbopack>= 19.1.0, < 19.1.219.1.2
npmreact-server-dom-parcel>= 19.1.0, < 19.1.219.1.2

Affected products

VendorProductAffected versions
FacebookReact
Versions 19.0.0, 19.1.0, 19.1.1, 19.2.0
VercelNext.Js
from 15.0.0 before 15.0.5
from 15.1.0 before 15.1.9
from 15.2.0 before 15.2.6
from 15.3.0 before 15.3.6
from 15.4.0 before 15.4.8
from 15.5.0 before 15.5.7

Weakness classification

CWE-502

References