10

CVE-2025-55182: Meta React Server Components Remote Code Execution Vulnerability

CVSS: 10.0v3.1CriticalKEVRansomwareAnalyzed
AliasesGHSA-fv66-9v8q-g76r
Published 03-12-2025Last modified 07-10-2026
Open JSON

Vulnerability summary

CVE-2025-55182 is a critical (CVSS 10.0) Deserialization of Untrusted Data vulnerability in Meta React Server Components. It is known to be exploited: CISA and ENISA list it, first on 05-12-2025. It has been used in ransomware campaigns. EPSS estimates a 99.80% chance of exploitation in the next 30 days, higher than 99.9% of scored vulnerabilities. 2 public exploits are recorded.

Overall risk
100/100
0100
Critical · default modelHow is this calculated?
CVSS score
10.0/10
010
Critical · v3.1 (CVE.org)
EPSS score
99.80%
0%100%
Critical · 0.00 pp in 30 days
KEVListedCISA · ENISA
RansomwareKnown useFlagged by CISA
Public exploits2exploit-database, metasploit

Advisory lineage

Upstream 0 · Downstream 0 · Duplicates 1
CVE-2025-66478

Timeline

  1. 03-12-2025
    PublishedVulnerability first disclosed.
  2. 05-12-2025
    Added to CISA KEVMeta React Server Components Remote Code Execution Vulnerability
  3. 12-12-2025
    CISA remediation dueApply mitigations per vendor instructions.
  4. 08-04-2026
    Added to ENISA KEVAdded to the ENISA known exploited vulnerabilities catalog.
  5. 07-10-2026
    Last modifiedVulnerability information updated.

Description

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.

CVSS metrics

3 scores · 3 sources · 1 version

EPSS trend

Probability

99.80%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

0.00 pp

From 99.80% on 19-09-2026

19-09-202619-10-2026
EPSS score
99.80%

Known exploited

Compare KEV catalogs
CISA KEVListed
Added
05-12-2025
Federal due date
12-12-2025
Ransomware
ENISA CNWListed
Added
08-04-2026

CISA required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. github.com/vercel-labs/fix-react2shell-next?tab=readme-ov-file nvd.nist.gov/vuln/detail/CVE-2025-55182

Public exploits

2 found
  • exploit-databasemultipleUnverified

    React Server 19.2.0 - Remote Code Execution

    Maturity: poc

  • MetasploitMetasploitremoteVerified

    Unauthenticated RCE in React Server Components (React2Shell)

    exploit/multi/http/react2shell_unauth_rce_cve_2025_55182

    Maturity: weaponized

Weaknesses

CWE · root cause

Affected systems

Meta3 products
Npm3 products
  • react-server-dom-parcel≥ 19.0.0, < 19.0.1 | ≥ 19.1.0, < 19.1.2 | ≥ 19.2.0, < 19.2.1
  • react-server-dom-turbopack≥ 19.0.0, < 19.0.1 | ≥ 19.1.0, < 19.1.2 | ≥ 19.2.0, < 19.2.1
  • react-server-dom-webpack≥ 19.0.0, < 19.0.1 | ≥ 19.1.0, < 19.1.2 | ≥ 19.2.0, < 19.2.1
Facebook1 product
  • react19.0.0 | 19.1.0 | 19.1.1 | 19.2.0
Vercel1 product
  • next.js≥ 15.0.0, < 15.0.5 | ≥ 15.1.0, < 15.1.9 | ≥ 15.2.0, < 15.2.6 | ≥ 15.3.0, < 15.3.6 | ≥ 15.4.0, < 15.4.8 | ≥ 15.5.0, < 15.5.7 | ≥ 16.0.0, < 16.0.7 | 14.3.0:canary77 | 14.3.0:canary78 | 14.3.0:canary79 | 14.3.0:canary80 | 14.3.0:canary81 | 14.3.0:canary82 | 14.3.0:canary83 | 14.3.0:canary84 | 14.3.0:canary85 | 14.3.0:canary86 | 14.3.0:canary87 | 15.6.0 | 15.6.0:canary0 | 15.6.0:canary1 | 15.6.0:canary10 | 15.6.0:canary11 | 15.6.0:canary12 | 15.6.0:canary13 | 15.6.0:canary14 | 15.6.0:canary15 | 15.6.0:canary16 | 15.6.0:canary17 | 15.6.0:canary18 | 15.6.0:canary19 | 15.6.0:canary2 | 15.6.0:canary20 | 15.6.0:canary21 | 15.6.0:canary22 | 15.6.0:canary23 | 15.6.0:canary24 | 15.6.0:canary25 | 15.6.0:canary26 | 15.6.0:canary27 | 15.6.0:canary28 | 15.6.0:canary29 | 15.6.0:canary3 | 15.6.0:canary30 | 15.6.0:canary31 | 15.6.0:canary32 | 15.6.0:canary33 | 15.6.0:canary34 | 15.6.0:canary35 | 15.6.0:canary36 | 15.6.0:canary37 | 15.6.0:canary38 | 15.6.0:canary39 | 15.6.0:canary4 | 15.6.0:canary40 | 15.6.0:canary41 | 15.6.0:canary42 | 15.6.0:canary43 | 15.6.0:canary44 | 15.6.0:canary45 | 15.6.0:canary46 | 15.6.0:canary47 | 15.6.0:canary48 | 15.6.0:canary49 | 15.6.0:canary5 | 15.6.0:canary50 | 15.6.0:canary51 | 15.6.0:canary52 | 15.6.0:canary53 | 15.6.0:canary54 | 15.6.0:canary55 | 15.6.0:canary56 | 15.6.0:canary57 | 15.6.0:canary6 | 15.6.0:canary7 | 15.6.0:canary8 | 15.6.0:canary9 | 16.0.0

4 vendors · 8 products

References

15 links
Show all 15 references