Skip to content
fr Sign in
10.0 Critical Exploited · ransomware

CVE-2025-55182 Meta React Server Components Remote Code Execution Vulnerability

Active exploitation observed

· CISA KEV catalogue
Required action Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Ransomware campaigns Known to be used

Description

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.

Affected products and versions

Product Affected versions Fixed in
react-server-dom-webpack 19.2.0 No fix stated
react-server-dom-webpack 19.1 19.1.0 → 19.1.1 No fix stated
react-server-dom-webpack 19.0.0 No fix stated
react-server-dom-turbopack 19.2.0 No fix stated
react-server-dom-turbopack 19.1 19.1.0 → 19.1.1 No fix stated
react-server-dom-turbopack 19.0.0 No fix stated
react-server-dom-parcel 19.2.0 No fix stated
react-server-dom-parcel 19.1 19.1.0 → 19.1.1 No fix stated
react-server-dom-parcel 19.0.0 No fix stated

References

Timeline

  1. Published
  2. Added to the KEV catalogue
  3. Last modified

Other CVEs of react-server-dom-webpack

The 8 CVEs of react-server-dom-webpack →
CVE-2026-44907 A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function… 7.5 High CVE-2026-23870 A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function… 7.5 High CVE-2026-23869 A denial of service vulnerability exists in React Server Components, affecting the following packages:… 7.5 High CVE-2026-23864 Multiple denial of service vulnerabilities exist in React Server Components, affecting the following packages:… 7.5 High
Track this CVE