CVE-2025-55182criticalunder attackransomwareCWE-502

CVE-2025-55182: critical vulnerability in Meta react-server-dom-parcel

Published 03 Dec 2025 · Updated 07 Oct 2026

Follow this CVE + Monitor react-server-dom-parcel + Monitor react-server-dom-turbopack

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA, has a working public exploit and 1 threat group(s) use it.

ssvc Actcvss 10epss 100%

from disclosure to weaponsame day

Published on NVDDec 3

1st PoCJun 17

metasploitDec 3

CISA KEV+2d

Who exploits it — 1

Groups known to exploit this vulnerability (MITRE ATT&CK attribution).

APT / StateTeamPCP MITRE ATT&CK

What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗

Not affected

9 products (33 components) — because the vulnerable code is not present in the product

Red Hat Enterprise Linux 9 · Red Hat Enterprise Linux 10 · Red Hat Enterprise Linux 8 · Red Hat Enterprise Linux 7 · Red Hat Enterprise Linux AI (RHEL AI) 3 · and others 4

Action required by CISAfederal deadline: 2025-12-12

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

In short

React Server Components versions 19.0.0 through 19.2.0 have a critical flaw that allows attackers to run malicious code on servers without needing to log in first. The vulnerability is in how the system processes data sent to Server Function endpoints, treating untrusted input as safe.

Technical detail

Pre-authentication RCE in react-server-dom packages (parcel, turbopack, webpack) due to unsafe deserialization of HTTP request payloads at Server Function endpoints. Attackers can craft malicious serialized objects and send them directly to vulnerable endpoints without authentication, achieving arbitrary code execution on the server.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Affected products

Meta · react-server-dom-parcel Meta · react-server-dom-turbopack Meta · react-server-dom-webpack

public PoCs found — 813

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Related CVEs — Meta react-server-dom-parcel

In the same product, most dangerous first.

CVE-2025-55184HIGHCVE-2025-55184EPSS 66.6%CVE-2025-55183MEDIUMCVE-2025-55183EPSS 64.2%CVE-2025-67779HIGHCVE-2025-67779EPSS 20.0%CVE-2026-23864HIGHCVE-2026-23864EPSS 2.6%CVE-2026-23869HIGHCVE-2026-23869EPSS 1.6%CVE-2026-23870HIGHCVE-2026-23870EPSS 1.5%

References

https://aws.amazon.com/blogs/security/china-nexus-cyber-threat-groups-rapidly-exploit-react2shell-vulnerability-cve-2025-55182/https://news.ycombinator.com/item?id=46136026 https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-55182 https://www.facebook.com/security/advisories/cve-2025-55182 http://www.openwall.com/lists/oss-security/2025/12/03/4