What is CVE-2025-55182?
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.
Timeline
- 2025-12-03Published to the U.S. National Vulnerability Database (NVD)
- 2025-12-05Added to the CISA Known Exploited Vulnerabilities (KEV) catalog
- 2025-12-12CISA federal remediation deadline (BOD 22-01)
- 2026-04-03First covered in a defend.network daily briefing
- 2026-10-18NVD record last updated
CISA Known Exploited Vulnerability
Meta React Server Components Remote Code Execution Vulnerability
Affected product
Meta React Server Components
NVD also lists CPE entries for: Facebook React, Vercel Next.Js
Remediation Steps
- Identify all Next.js applications using React2Shell component
- Update React2Shell dependency to patched version immediately
- Scan application logs for credential theft exploitation attempts
- Reset all potentially exposed credentials and API keys
- Implement input validation and output encoding for component usage
- Deploy Web Application Firewall rules to block exploitation patterns
References
- http://www.openwall.com/lists/oss-security/2025/12/03/4
- https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components
- https://www.facebook.com/security/advisories/cve-2025-55182
- https://cisa.gov/known-exploited-vulnerabilities-catalog
- https://github.com/advisories
- https://nvd.nist.gov/vuln/detail/CVE-2025-55182
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog
Referenced in our briefings & reports
Related vulnerabilities
- CVE-2026-63077 – JetBrains TeamCity (same weakness: CWE-502)
- CVE-2026-50522 – Microsoft SharePoint (same weakness: CWE-502)
- CVE-2026-58644 – Microsoft SharePoint (same weakness: CWE-502)
- CVE-2026-44963 (same weakness: CWE-502)
- CVE-2026-45247 – Mirasvit Full Page Cache Warmer (same weakness: CWE-502)
- CVE-2026-45659 – Microsoft SharePoint Server (same weakness: CWE-502)
Browse all tracked CVEs in the defend.network CVE database →
🤖 This CVE page is generated by defend.network from NVD, CISA KEV, EPSS, and our verified daily briefings. Severity and exploitation data come from official sources; always verify remediation steps against the official vendor advisory before acting in production.