Remote Code Execution Vulnerability in React Server Components by Meta
CVE-2025-55182

10CRITICAL

Key Information:

Vendor: Meta
Status: React-server-dom-webpack; React-server-dom-turbopack; React-server-dom-parcel
Vendor: CVE Published:; 3 December 2025

Badges

🔥 Trending now🥇 Trended No. 1📈 Trended📈 Score: 212,000👾 Exploit Exists🟡 Public PoC📰 News Worthy

What is CVE-2025-55182?

CVE-2025-55182 refers to a serious remote code execution vulnerability found in the React Server Components developed by Meta. This vulnerability affects specific versions of React Server Components (19.0.0, 19.1.0, 19.1.1, and 19.2.0) along with associated packages such as react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The core issue lies in the insecure handling of payloads during the deserialization process from HTTP requests directed at Server Function endpoints. This flaw poses a significant risk, as it allows an attacker to potentially execute malicious code on the server without needing prior authentication, which could severely compromise the security and integrity of applications utilizing these components.

Potential Impact of CVE-2025-55182

Unauthorized Remote Code Execution: The vulnerability enables attackers to execute arbitrary code on the server hosting the affected components. This can lead to unauthorized access to sensitive data, manipulation of application logic, and control over the server environment.
Compromise of Application Integrity: Successful exploitation may allow adversaries to alter the application's behavior, insert malicious code, or create backdoors for future access. This not only jeopardizes the application's integrity but can also degrade user trust and damage the organization's reputation.
Wider System Vulnerabilities: Once an attacker gains a foothold through this vulnerability, they can potentially pivot to other systems within the organization's network, leading to a broader compromise. This could facilitate further malicious activities, including data breaches or launching additional attacks on other infrastructure components.

Affected Version(s)

react-server-dom-parcel 19.0.0 <= 19.2.0

react-server-dom-turbopack 19.0.0 <= 19.2.0

react-server-dom-webpack 19.0.0 <= 19.2.0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2025-55182-poc
Created by ejpir

CVE-2025-55182-poc
Created by whiteov3rflow

CVE-2025-55182-PoC
Created by Emiyelbarto

News Articles

BleepingComputer

CVE-2025-55182

Critical React, Next.js flaw lets hackers execute code on servers

A maximum severity vulnerability, dubbed 'React2Shell', in the React Server Components (RSC) 'Flight' protocol allows remote code execution without authentication in React and Next.js applications.

9 hours ago