# CVE-2025-55182: Meta React Server Components Remote Code Execution > Attackers can execute arbitrary code remotely by sending malicious payloads to Server Function endpoints in vulnerable React Server Components packages. - **Severity:** Critical 10.0 (`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H`) - **Exploited in the wild:** Yes, since 5 Dec 2025 (CISA KEV), used in ransomware - **Login needed:** Not needed - **Attackable:** Over the internet - **Victim action needed:** Not needed - **Fix available:** Yes - **Published:** 3 Dec 2025 - **Updated:** 7 Oct 2026 - **Also known as:** CLSA-2026-1792195716, CLSA-2026-1792195717, CLSA-2026-1792195718, CLSA-2026-1792195719, CLSA-2026-1792195755, CLSA-2026-1792196702, CLSA-2026-1792196704, CLSA-2026-1792196706, CLSA-2026-1792196707, CLSA-2026-1792196895, CLSA-2026-1792206276, CLSA-2026-1792206277, CLSA-2026-1792206278, CLSA-2026-1792206279, CLSA-2026-1792206328, CLSA-2026-1792256955, CLSA-2026-1792256956, CLSA-2026-1792256957, CLSA-2026-1792256958, CLSA-2026-1792256967, CLSA-2026-1792272210, CLSA-2026-1792272211, CLSA-2026-1792272212, CLSA-2026-1792272214, CLSA-2026-1792272250, CLSA-2026-1792292985, CLSA-2026-1792292986, CLSA-2026-1792292987, CLSA-2026-1792292988, CLSA-2026-1792293023, CLSA-2026-1792304696, CLSA-2026-1792304698, CLSA-2026-1792304699, CLSA-2026-1792304701, CLSA-2026-1792304746, CLSA-2026-1792326281, CLSA-2026-1792326282, CLSA-2026-1792326283, CLSA-2026-1792326284, CLSA-2026-1792326311, CLSA-2026-1792338221, CLSA-2026-1792338222, CLSA-2026-1792338223, CLSA-2026-1792338224, CLSA-2026-1792338241, CLSA-2026-1792346458, CLSA-2026-1792346460, CLSA-2026-1792346461, CLSA-2026-1792346462, CLSA-2026-1792346472, CLSA-2026-1792346489, CLSA-2026-1792358574, CLSA-2026-1792358575, CLSA-2026-1792358576, CLSA-2026-1792358577, CLSA-2026-1792358601, CLSA-2026-1792363964, CLSA-2026-1792363966, CLSA-2026-1792363967, CLSA-2026-1792363969, CLSA-2026-1792364009, CLSA-2026-1792367377, CLSA-2026-1792367379, CLSA-2026-1792367380, CLSA-2026-1792367381, CLSA-2026-1792367393, CLSA-2026-1792367405, CVE-2025-66478, GHSA-fv66-9v8q-g76r ## What is CVE-2025-55182? CVE-2025-55182 is a critical unsafe deserialization vulnerability in Vercel Next.js, published on 3 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim. ### Official description A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints. Weakness: CWE-502 (Deserialization of Untrusted Data) ## Which versions are affected by CVE-2025-55182? 18 open source packages ship an affected version, including react-server-dom-parcel, react-server-dom-turbopack and react-server-dom-webpack. It affects 2 products. | Package | Ecosystem | Affected | Fixed in | | --- | --- | --- | --- | | `react-server-dom-parcel` | npm | From 19.0.0 | 19.0.1 | | `react-server-dom-parcel` | npm | From 19.0.0 | 19.0.1 | | `react-server-dom-parcel` | npm | From 19.1.0 | 19.1.2 | | `react-server-dom-parcel` | npm | From 19.1.0 | 19.1.2 | | `react-server-dom-parcel` | npm | From 19.2.0 | 19.2.1 | | `react-server-dom-parcel` | npm | From 19.2.0 | 19.2.1 | | `react-server-dom-turbopack` | npm | From 19.0.0 | 19.0.1 | | `react-server-dom-turbopack` | npm | From 19.0.0 | 19.0.1 | | `react-server-dom-turbopack` | npm | From 19.1.0 | 19.1.2 | | `react-server-dom-turbopack` | npm | From 19.1.0 | 19.1.2 | | `react-server-dom-turbopack` | npm | From 19.2.0 | 19.2.1 | | `react-server-dom-turbopack` | npm | From 19.2.0 | 19.2.1 | | `react-server-dom-webpack` | npm | From 19.0.0 | 19.0.1 | | `react-server-dom-webpack` | npm | From 19.0.0 | 19.0.1 | | `react-server-dom-webpack` | npm | From 19.1.0 | 19.1.2 | | `react-server-dom-webpack` | npm | From 19.1.0 | 19.1.2 | | `react-server-dom-webpack` | npm | From 19.2.0 | 19.2.1 | | `react-server-dom-webpack` | npm | From 19.2.0 | 19.2.1 | Products: Facebook React, Vercel Next.js. ## How do I fix CVE-2025-55182? Upgrade react-server-dom-parcel to a fixed version for your release line: 19.0.1, 19.1.2 or 19.2.1. US federal agencies must fix it by 12 Dec 2025. ## Is CVE-2025-55182 being exploited? Yes. Attackers have exploited CVE-2025-55182 in the wild since at least 5 Dec 2025, including in ransomware campaigns. Public exploit code: - High Fidelity Detection Mechanism for RSC/Next.js RCE (CVE-2025-55182 & CVE-2025-66478) (github_poc): https://github.com/assetnote/react2shell-scanner - Explanation and full RCE PoC for CVE-2025-55182 (github_poc): https://github.com/msanft/CVE-2025-55182 - Original Proof-of-Concepts for React2Shell CVE-2025-55182 (github_poc): https://github.com/lachlan2k/React2Shell-CVE-2025-55182-original-poc - CVE-2025-55182 POC (github_poc): https://github.com/ejpir/CVE-2025-55182-research - Supports RSC fingerprinting and exploitation of the React component vulnerability CVE-2025-55182. (github_poc): https://github.com/mrknow001/RSC_Detector - RSC/Next.js RCE Vulnerability Detector & PoC Chrome Extension – CVE-2025-55182 & CVE-2025-66478 (github_poc): https://github.com/emredavut/CVE-2025-55182 ## Other vulnerabilities in Vercel Next.js - [CVE-2026-23864](https://insights.sbomify.com/CVE-2026-23864/): React Server Components have multiple Denial of Service Vulnerabilities (high 7.5) - [CVE-2025-55184](https://insights.sbomify.com/CVE-2025-55184/): Denial of Service Vulnerability in React Server Components (high 7.5) - [CVE-2025-67779](https://insights.sbomify.com/CVE-2025-67779/): Denial of Service Vulnerability in React Server Components (high 7.5) - [CVE-2018-6341](https://insights.sbomify.com/CVE-2018-6341/): Cross-Site Scripting in react-dom (medium 6.1) - [CVE-2025-55183](https://insights.sbomify.com/CVE-2025-55183/): Source Code Exposure Vulnerability in React Server Components (medium 5.3) ## Fix prompt for AI coding agents ```text Check this codebase for CVE-2025-55182 and fix it if it is affected. What it is: CVE-2025-55182 is a critical unsafe deserialization vulnerability in Vercel Next.js, published on 3 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim. Exploitation: Yes. Attackers have exploited CVE-2025-55182 in the wild since at least 5 Dec 2025, including in ransomware campaigns. Affected packages and fixed versions: - react-server-dom-parcel (npm): affected from 19.0.0; fixed in 19.0.1 - react-server-dom-parcel (npm): affected from 19.0.0; fixed in 19.0.1 - react-server-dom-parcel (npm): affected from 19.1.0; fixed in 19.1.2 - react-server-dom-parcel (npm): affected from 19.1.0; fixed in 19.1.2 - react-server-dom-parcel (npm): affected from 19.2.0; fixed in 19.2.1 - react-server-dom-parcel (npm): affected from 19.2.0; fixed in 19.2.1 - react-server-dom-turbopack (npm): affected from 19.0.0; fixed in 19.0.1 - react-server-dom-turbopack (npm): affected from 19.0.0; fixed in 19.0.1 - react-server-dom-turbopack (npm): affected from 19.1.0; fixed in 19.1.2 - react-server-dom-turbopack (npm): affected from 19.1.0; fixed in 19.1.2 - react-server-dom-turbopack (npm): affected from 19.2.0; fixed in 19.2.1 - react-server-dom-turbopack (npm): affected from 19.2.0; fixed in 19.2.1 Task: 1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies. 2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it. 3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead. 4. Run the tests and summarise what changed and why. 5. If nothing in the project is affected, say so and change nothing. Reference: https://insights.sbomify.com/CVE-2025-55182/ (Markdown: https://insights.sbomify.com/CVE-2025-55182/index.md) ``` ## Sources - CVE record: https://www.cve.org/CVERecord?id=CVE-2025-55182 - NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-55182 - OSV: https://osv.dev/vulnerability/CVE-2025-55182 --- From sbomify Insights: https://insights.sbomify.com/CVE-2025-55182/ Summaries are generated and may contain mistakes; the official description above is the record.