CVE-2025-55182 Meta React Server Components Remote Code Execution
Attackers can execute arbitrary code remotely by sending malicious payloads to Server Function endpoints in vulnerable React Server Components packages.
- Exploited in the wild
- Since 5 Dec 2025
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-55182?
CVE-2025-55182 is a critical unsafe deserialization vulnerability in Vercel Next.js, published on 3 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.
Weakness: CWE-502
Which versions are affected by CVE-2025-55182?
18 open source packages ship an affected version, including react-server-dom-parcel, react-server-dom-turbopack and react-server-dom-webpack. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
react-server-dom-parcel npm | From 19.0.0 | 19.0.1 |
react-server-dom-parcel npm | From 19.0.0 | 19.0.1 |
react-server-dom-parcel npm | From 19.1.0 | 19.1.2 |
react-server-dom-parcel npm | From 19.1.0 | 19.1.2 |
react-server-dom-parcel npm | From 19.2.0 | 19.2.1 |
react-server-dom-parcel npm | From 19.2.0 | 19.2.1 |
12 more packages
react-server-dom-turbopack npm | From 19.0.0 | 19.0.1 |
react-server-dom-turbopack npm | From 19.0.0 | 19.0.1 |
react-server-dom-turbopack npm | From 19.1.0 | 19.1.2 |
react-server-dom-turbopack npm | From 19.1.0 | 19.1.2 |
react-server-dom-turbopack npm | From 19.2.0 | 19.2.1 |
react-server-dom-turbopack npm | From 19.2.0 | 19.2.1 |
react-server-dom-webpack npm | From 19.0.0 | 19.0.1 |
react-server-dom-webpack npm | From 19.0.0 | 19.0.1 |
react-server-dom-webpack npm | From 19.1.0 | 19.1.2 |
react-server-dom-webpack npm | From 19.1.0 | 19.1.2 |
react-server-dom-webpack npm | From 19.2.0 | 19.2.1 |
react-server-dom-webpack npm | From 19.2.0 | 19.2.1 |
Products include Facebook React, Vercel Next.js.
How do I fix CVE-2025-55182?
Upgrade react-server-dom-parcel to a fixed version for your release line: 19.0.1, 19.1.2 or 19.2.1. US federal agencies must fix it by 12 Dec 2025.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2025-55182 being exploited?
Yes. Attackers have exploited CVE-2025-55182 in the wild since at least 5 Dec 2025, including in ransomware campaigns.
Public exploit code: 1 Metasploit module, 1 Exploit-DB entry, 1 Nuclei template and 461 proofs of concept on GitHub.
Other vulnerabilities in Vercel Next.js
- CVE-2026-23864 React Server Components have multiple Denial of Service Vulnerabilities
- CVE-2025-55184 Denial of Service Vulnerability in React Server Components
- CVE-2025-67779 Denial of Service Vulnerability in React Server Components
- CVE-2018-6341 Cross-Site Scripting in react-dom
- CVE-2025-55183 Source Code Exposure Vulnerability in React Server Components
Sources
Also known as CLSA-2026-1792195716, CLSA-2026-1792195717, CLSA-2026-1792195718, CLSA-2026-1792195719, CLSA-2026-1792195755, CLSA-2026-1792196702 and 63 more.