{"schemaVersion":3,"id":"CVE-2025-55182","aliases":["GHSA-fv66-9v8q-g76r"],"status":"published","duplicateOf":null,"title":"Meta React Server Components Remote Code Execution Vulnerability","description":"A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.","dates":{"published":"2025-12-03T15:40:56.894Z","modified":"2026-10-07T17:58:00.859Z","reserved":null,"kevAdded":["2025-12-05T00:00:00.000Z","2026-04-08T00:00:00.000Z"],"kevDue":["2025-12-12T00:00:00.000Z"]},"cvss":{"headline":{"score":10,"severity":"critical","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":10,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Npm","score":10,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","exploitability":10,"impact":10,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":10,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.99802,"percentile":0.99958,"severity":"critical","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.99802},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.99802,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.99802,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.99802,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.99802,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.99802,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.99802,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.99802,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.99802,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.99802,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.99802,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.99802,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.99802,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.99802,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.99802,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.99802,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.99802,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.99802,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.99802,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.99802,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.99802,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.99802,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.99802,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.99802,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.99802,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.99802,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.99802,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.99802,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.99802,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.99802,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.99802,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.99802,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.99802,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.99802,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.99802,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.99802,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.99802,"percentile":0.99958}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.99802,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.99802,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.99802,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.99802,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.99802,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.99802,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.99802,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.99802,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.99802,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.99802,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.99802,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.99802,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.99802,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.99802,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.99802,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.99802,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.99802,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.99802,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.99802,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.99802,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.99802,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.99802,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.99802,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.99802,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.99802,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.99802,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.99802,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.99802,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.99802,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.99802,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.99802,"percentile":0.99958}]},"kev":{"state":"listed","entries":[{"source":"cisa","sourceLabel":"CISA","dateAdded":"2025-12-05T00:00:00.000Z","dueDate":"2025-12-12T00:00:00.000Z","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","name":"Meta React Server Components Remote Code Execution Vulnerability","description":"Meta React Server Components contains a remote code execution vulnerability that could allow unauthenticated remote code execution by exploiting a flaw in how React decodes payloads sent to React Server Function endpoints. Please note CVE-2025-66478 has been rejected, but it is associated with CVE-2025- 55182.","notes":[{"type":"text","value":"Check for signs of potential compromise on all internet accessible REACT instances after applying mitigations. For more information, please see: https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components"},{"type":"url","href":"https://github.com/vercel-labs/fix-react2shell-next?tab=readme-ov-file","label":"github.com/vercel-labs/fix-react2shell-next?tab=readme-ov-file"},{"type":"url","href":"https://nvd.nist.gov/vuln/detail/CVE-2025-55182","label":"nvd.nist.gov/vuln/detail/CVE-2025-55182"}],"vendor":"Meta","product":"React Server Components","ransomware":true,"ransomwareUse":"Known","exploitationType":null},{"source":"enisa","sourceLabel":"ENISA","dateAdded":"2026-04-08T00:00:00.000Z","dueDate":null,"requiredAction":null,"name":null,"description":"Flaw in how React decodes payloads sent to React Server Function endpoints enabled unauthenticated remote code execution. Apps supporting React Server Components may still be vulnerable even if not implementing any React Server Function endpoints.","notes":[{"type":"url","href":"https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components#update-instructions","label":"react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components"}],"vendor":"Meta","product":"React Server Components","ransomware":false,"ransomwareUse":null,"exploitationType":"APT"}],"listedCount":2,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":true,"entry":{"source":"cisa","sourceLabel":"CISA","dateAdded":"2025-12-05T00:00:00.000Z","dueDate":"2025-12-12T00:00:00.000Z","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","name":"Meta React Server Components Remote Code Execution Vulnerability","description":"Meta React Server Components contains a remote code execution vulnerability that could allow unauthenticated remote code execution by exploiting a flaw in how React decodes payloads sent to React Server Function endpoints. Please note CVE-2025-66478 has been rejected, but it is associated with CVE-2025- 55182.","notes":[{"type":"text","value":"Check for signs of potential compromise on all internet accessible REACT instances after applying mitigations. For more information, please see: https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components"},{"type":"url","href":"https://github.com/vercel-labs/fix-react2shell-next?tab=readme-ov-file","label":"github.com/vercel-labs/fix-react2shell-next?tab=readme-ov-file"},{"type":"url","href":"https://nvd.nist.gov/vuln/detail/CVE-2025-55182","label":"nvd.nist.gov/vuln/detail/CVE-2025-55182"}],"vendor":"Meta","product":"React Server Components","ransomware":true,"ransomwareUse":"Known","exploitationType":null}},{"source":"enisa","label":"ENISA","listed":true,"entry":{"source":"enisa","sourceLabel":"ENISA","dateAdded":"2026-04-08T00:00:00.000Z","dueDate":null,"requiredAction":null,"name":null,"description":"Flaw in how React decodes payloads sent to React Server Function endpoints enabled unauthenticated remote code execution. Apps supporting React Server Components may still be vulnerable even if not implementing any React Server Function endpoints.","notes":[{"type":"url","href":"https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components#update-instructions","label":"react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components"}],"vendor":"Meta","product":"React Server Components","ransomware":false,"ransomwareUse":null,"exploitationType":"APT"}},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"known","sources":["cisa"]},"exploits":[{"id":"52506","name":"React Server 19.2.0 - Remote Code Execution","source":"exploit-database","url":"https://www.exploit-db.com/exploits/52506","maturity":"poc","reliabilityScore":0.5,"verified":false,"type":null,"platforms":["multiple"],"requiresAuth":null,"exploitdb":{"verified":false,"type":"webapps","platform":"multiple","file":"exploits/multiple/webapps/52506.py","codes":["CVE-2025-55182"]},"metasploit":null},{"id":"MSF_EXPLOIT_MULTI_HTTP_REACT2SHELL_UNAUTH_RCE_CVE_2025_55182","name":"Unauthenticated RCE in React Server Components (React2Shell)","source":"metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploit/multi/http/react2shell_unauth_rce_cve_2025_55182.rb","maturity":"weaponized","reliabilityScore":1,"verified":true,"type":"remote","platforms":[],"requiresAuth":false,"exploitdb":null,"metasploit":{"fullname":"exploit/multi/http/react2shell_unauth_rce_cve_2025_55182","rank":"600","rankName":"excellent","postAuth":false,"check":true,"stability":["crash-safe"],"sideEffects":["ioc-in-logs"],"reliability":["repeatable-session"]}}],"exploitCount":2,"weaknesses":[{"id":"CWE-502","name":"Deserialization of Untrusted Data","description":"The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.","type":"weakness","status":"Draft","abstraction":"Base","likelihoodOfExploit":"Medium","url":"https://cwe.mitre.org/data/definitions/502.html"}],"affected":[{"vendor":"facebook","product":"react","name":"react","label":"react","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"19.0.0","noFixRecorded":false,"fixedIn":null},{"text":"19.1.0","noFixRecorded":false,"fixedIn":null},{"text":"19.1.1","noFixRecorded":false,"fixedIn":null},{"text":"19.2.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"19.0.0 | 19.1.0 | 19.1.1 | 19.2.0","eol":{"isEol":false,"eolDate":null,"matchMethod":"cpe","cycle":{"name":"19","label":"19","eolFrom":null,"isLts":false,"isMaintained":true,"latestVersion":"19.3.1"},"product":{"name":"react","label":"React","category":"framework"}},"hubHref":"/vendor/facebook/react"},{"vendor":"meta","product":"react-server-dom-parcel","name":"react-server-dom-parcel","label":"react-server-dom-parcel","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"19.0.0","noFixRecorded":false,"fixedIn":null},{"text":"≥ 19.1.0, ≤ 19.1.1","noFixRecorded":false,"fixedIn":null},{"text":"19.2.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"19.0.0 | ≥ 19.1.0, ≤ 19.1.1 | 19.2.0","eol":null,"hubHref":"/vendor/meta/react-server-dom-parcel"},{"vendor":"meta","product":"react-server-dom-turbopack","name":"react-server-dom-turbopack","label":"react-server-dom-turbopack","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"19.0.0","noFixRecorded":false,"fixedIn":null},{"text":"≥ 19.1.0, ≤ 19.1.1","noFixRecorded":false,"fixedIn":null},{"text":"19.2.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"19.0.0 | ≥ 19.1.0, ≤ 19.1.1 | 19.2.0","eol":null,"hubHref":"/vendor/meta/react-server-dom-turbopack"},{"vendor":"meta","product":"react-server-dom-webpack","name":"react-server-dom-webpack","label":"react-server-dom-webpack","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"19.0.0","noFixRecorded":false,"fixedIn":null},{"text":"≥ 19.1.0, ≤ 19.1.1","noFixRecorded":false,"fixedIn":null},{"text":"19.2.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"19.0.0 | ≥ 19.1.0, ≤ 19.1.1 | 19.2.0","eol":null,"hubHref":"/vendor/meta/react-server-dom-webpack"},{"vendor":"Npm","product":"react-server-dom-parcel","name":"react-server-dom-parcel","label":"react-server-dom-parcel","ecosystem":"Npm","cpePart":null,"purl":"pkg:npm/react-server-dom-parcel","purlType":"npm","versions":[{"text":"≥ 19.0.0, < 19.0.1","noFixRecorded":false,"fixedIn":null},{"text":"≥ 19.1.0, < 19.1.2","noFixRecorded":false,"fixedIn":null},{"text":"≥ 19.2.0, < 19.2.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 19.0.0, < 19.0.1 | ≥ 19.1.0, < 19.1.2 | ≥ 19.2.0, < 19.2.1","eol":null,"hubHref":null},{"vendor":"Npm","product":"react-server-dom-turbopack","name":"react-server-dom-turbopack","label":"react-server-dom-turbopack","ecosystem":"Npm","cpePart":null,"purl":"pkg:npm/react-server-dom-turbopack","purlType":"npm","versions":[{"text":"≥ 19.0.0, < 19.0.1","noFixRecorded":false,"fixedIn":null},{"text":"≥ 19.1.0, < 19.1.2","noFixRecorded":false,"fixedIn":null},{"text":"≥ 19.2.0, < 19.2.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 19.0.0, < 19.0.1 | ≥ 19.1.0, < 19.1.2 | ≥ 19.2.0, < 19.2.1","eol":null,"hubHref":null},{"vendor":"Npm","product":"react-server-dom-webpack","name":"react-server-dom-webpack","label":"react-server-dom-webpack","ecosystem":"Npm","cpePart":null,"purl":"pkg:npm/react-server-dom-webpack","purlType":"npm","versions":[{"text":"≥ 19.0.0, < 19.0.1","noFixRecorded":false,"fixedIn":null},{"text":"≥ 19.1.0, < 19.1.2","noFixRecorded":false,"fixedIn":null},{"text":"≥ 19.2.0, < 19.2.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 19.0.0, < 19.0.1 | ≥ 19.1.0, < 19.1.2 | ≥ 19.2.0, < 19.2.1","eol":null,"hubHref":null},{"vendor":"vercel","product":"next.js","name":"next.js","label":"next.js","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 15.0.0, < 15.0.5","noFixRecorded":false,"fixedIn":null},{"text":"≥ 15.1.0, < 15.1.9","noFixRecorded":false,"fixedIn":null},{"text":"≥ 15.2.0, < 15.2.6","noFixRecorded":false,"fixedIn":null},{"text":"≥ 15.3.0, < 15.3.6","noFixRecorded":false,"fixedIn":null},{"text":"≥ 15.4.0, < 15.4.8","noFixRecorded":false,"fixedIn":null},{"text":"≥ 15.5.0, < 15.5.7","noFixRecorded":false,"fixedIn":null},{"text":"≥ 16.0.0, < 16.0.7","noFixRecorded":false,"fixedIn":null},{"text":"14.3.0:canary77","noFixRecorded":false,"fixedIn":null},{"text":"14.3.0:canary78","noFixRecorded":false,"fixedIn":null},{"text":"14.3.0:canary79","noFixRecorded":false,"fixedIn":null},{"text":"14.3.0:canary80","noFixRecorded":false,"fixedIn":null},{"text":"14.3.0:canary81","noFixRecorded":false,"fixedIn":null},{"text":"14.3.0:canary82","noFixRecorded":false,"fixedIn":null},{"text":"14.3.0:canary83","noFixRecorded":false,"fixedIn":null},{"text":"14.3.0:canary84","noFixRecorded":false,"fixedIn":null},{"text":"14.3.0:canary85","noFixRecorded":false,"fixedIn":null},{"text":"14.3.0:canary86","noFixRecorded":false,"fixedIn":null},{"text":"14.3.0:canary87","noFixRecorded":false,"fixedIn":null},{"text":"15.6.0","noFixRecorded":false,"fixedIn":null},{"text":"15.6.0:canary0","noFixRecorded":false,"fixedIn":null},{"text":"15.6.0:canary1","noFixRecorded":false,"fixedIn":null},{"text":"15.6.0:canary10","noFixRecorded":false,"fixedIn":null},{"text":"15.6.0:canary11","noFixRecorded":false,"fixedIn":null},{"text":"15.6.0:canary12","noFixRecorded":false,"fixedIn":null},{"text":"15.6.0:canary13","noFixRecorded":false,"fixedIn":null},{"text":"15.6.0:canary14","noFixRecorded":false,"fixedIn":null},{"text":"15.6.0:canary15","noFixRecorded":false,"fixedIn":null},{"text":"15.6.0:canary16","noFixRecorded":false,"fixedIn":null},{"text":"15.6.0:canary17","noFixRecorded":false,"fixedIn":null},{"text":"15.6.0:canary18","noFixRecorded":false,"fixedIn":null},{"text":"15.6.0:canary19","noFixRecorded":false,"fixedIn":null},{"text":"15.6.0:canary2","noFixRecorded":false,"fixedIn":null},{"text":"15.6.0:canary20","noFixRecorded":false,"fixedIn":null},{"text":"15.6.0:canary21","noFixRecorded":false,"fixedIn":null},{"text":"15.6.0:canary22","noFixRecorded":false,"fixedIn":null},{"text":"15.6.0:canary23","noFixRecorded":false,"fixedIn":null},{"text":"15.6.0:canary24","noFixRecorded":false,"fixedIn":null},{"text":"15.6.0:canary25","noFixRecorded":false,"fixedIn":null},{"text":"15.6.0:canary26","noFixRecorded":false,"fixedIn":null},{"text":"15.6.0:canary27","noFixRecorded":false,"fixedIn":null},{"text":"15.6.0:canary28","noFixRecorded":false,"fixedIn":null},{"text":"15.6.0:canary29","noFixRecorded":false,"fixedIn":null},{"text":"15.6.0:canary3","noFixRecorded":false,"fixedIn":null},{"text":"15.6.0:canary30","noFixRecorded":false,"fixedIn":null},{"text":"15.6.0:canary31","noFixRecorded":false,"fixedIn":null},{"text":"15.6.0:canary32","noFixRecorded":false,"fixedIn":null},{"text":"15.6.0:canary33","noFixRecorded":false,"fixedIn":null},{"text":"15.6.0:canary34","noFixRecorded":false,"fixedIn":null},{"text":"15.6.0:canary35","noFixRecorded":false,"fixedIn":null},{"text":"15.6.0:canary36","noFixRecorded":false,"fixedIn":null},{"text":"15.6.0:canary37","noFixRecorded":false,"fixedIn":null},{"text":"15.6.0:canary38","noFixRecorded":false,"fixedIn":null},{"text":"15.6.0:canary39","noFixRecorded":false,"fixedIn":null},{"text":"15.6.0:canary4","noFixRecorded":false,"fixedIn":null},{"text":"15.6.0:canary40","noFixRecorded":false,"fixedIn":null},{"text":"15.6.0:canary41","noFixRecorded":false,"fixedIn":null},{"text":"15.6.0:canary42","noFixRecorded":false,"fixedIn":null},{"text":"15.6.0:canary43","noFixRecorded":false,"fixedIn":null},{"text":"15.6.0:canary44","noFixRecorded":false,"fixedIn":null},{"text":"15.6.0:canary45","noFixRecorded":false,"fixedIn":null},{"text":"15.6.0:canary46","noFixRecorded":false,"fixedIn":null},{"text":"15.6.0:canary47","noFixRecorded":false,"fixedIn":null},{"text":"15.6.0:canary48","noFixRecorded":false,"fixedIn":null},{"text":"15.6.0:canary49","noFixRecorded":false,"fixedIn":null},{"text":"15.6.0:canary5","noFixRecorded":false,"fixedIn":null},{"text":"15.6.0:canary50","noFixRecorded":false,"fixedIn":null},{"text":"15.6.0:canary51","noFixRecorded":false,"fixedIn":null},{"text":"15.6.0:canary52","noFixRecorded":false,"fixedIn":null},{"text":"15.6.0:canary53","noFixRecorded":false,"fixedIn":null},{"text":"15.6.0:canary54","noFixRecorded":false,"fixedIn":null},{"text":"15.6.0:canary55","noFixRecorded":false,"fixedIn":null},{"text":"15.6.0:canary56","noFixRecorded":false,"fixedIn":null},{"text":"15.6.0:canary57","noFixRecorded":false,"fixedIn":null},{"text":"15.6.0:canary6","noFixRecorded":false,"fixedIn":null},{"text":"15.6.0:canary7","noFixRecorded":false,"fixedIn":null},{"text":"15.6.0:canary8","noFixRecorded":false,"fixedIn":null},{"text":"15.6.0:canary9","noFixRecorded":false,"fixedIn":null},{"text":"16.0.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 15.0.0, < 15.0.5 | ≥ 15.1.0, < 15.1.9 | ≥ 15.2.0, < 15.2.6 | ≥ 15.3.0, < 15.3.6 | ≥ 15.4.0, < 15.4.8 | ≥ 15.5.0, < 15.5.7 | ≥ 16.0.0, < 16.0.7 | 14.3.0:canary77 | 14.3.0:canary78 | 14.3.0:canary79 | 14.3.0:canary80 | 14.3.0:canary81 | 14.3.0:canary82 | 14.3.0:canary83 | 14.3.0:canary84 | 14.3.0:canary85 | 14.3.0:canary86 | 14.3.0:canary87 | 15.6.0 | 15.6.0:canary0 | 15.6.0:canary1 | 15.6.0:canary10 | 15.6.0:canary11 | 15.6.0:canary12 | 15.6.0:canary13 | 15.6.0:canary14 | 15.6.0:canary15 | 15.6.0:canary16 | 15.6.0:canary17 | 15.6.0:canary18 | 15.6.0:canary19 | 15.6.0:canary2 | 15.6.0:canary20 | 15.6.0:canary21 | 15.6.0:canary22 | 15.6.0:canary23 | 15.6.0:canary24 | 15.6.0:canary25 | 15.6.0:canary26 | 15.6.0:canary27 | 15.6.0:canary28 | 15.6.0:canary29 | 15.6.0:canary3 | 15.6.0:canary30 | 15.6.0:canary31 | 15.6.0:canary32 | 15.6.0:canary33 | 15.6.0:canary34 | 15.6.0:canary35 | 15.6.0:canary36 | 15.6.0:canary37 | 15.6.0:canary38 | 15.6.0:canary39 | 15.6.0:canary4 | 15.6.0:canary40 | 15.6.0:canary41 | 15.6.0:canary42 | 15.6.0:canary43 | 15.6.0:canary44 | 15.6.0:canary45 | 15.6.0:canary46 | 15.6.0:canary47 | 15.6.0:canary48 | 15.6.0:canary49 | 15.6.0:canary5 | 15.6.0:canary50 | 15.6.0:canary51 | 15.6.0:canary52 | 15.6.0:canary53 | 15.6.0:canary54 | 15.6.0:canary55 | 15.6.0:canary56 | 15.6.0:canary57 | 15.6.0:canary6 | 15.6.0:canary7 | 15.6.0:canary8 | 15.6.0:canary9 | 16.0.0","eol":null,"hubHref":"/vendor/vercel/nextjs"}],"affectedCount":8,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://www.facebook.com/security/advisories/cve-2025-55182","label":"www.facebook.com/security/advisories/cve-2025-55182","hostname":"www.facebook.com","tags":["X Refsource CONFIRM","WEB","Vendor Advisory"]},{"url":"https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components","label":"react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components","hostname":"react.dev","tags":["X Refsource CONFIRM","WEB","Patch","Vendor Advisory"]},{"url":"https://aws.amazon.com/blogs/security/china-nexus-cyber-threat-groups-rapidly-exploit-react2shell-vulnerability-cve-2025-55182/","label":"aws.amazon.com/blogs/…","hostname":"aws.amazon.com","tags":["Media Coverage","Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-55182","label":"www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-55182","hostname":"www.cisa.gov","tags":["Government Resource","US Government Resource"]},{"url":"http://www.openwall.com/lists/oss-security/2025/12/03/4","label":"www.openwall.com/lists/oss-security/2025/12/03/4","hostname":"www.openwall.com","tags":["WEB","Mailing List","Patch","Third Party Advisory"]},{"url":"https://news.ycombinator.com/item?id=46136026","label":"news.ycombinator.com/item?id=46136026","hostname":"news.ycombinator.com","tags":["WEB","Issue Tracking"]},{"url":"https://github.com/facebook/react/security/advisories/GHSA-fv66-9v8q-g76r","label":"github.com/facebook/react/security/advisories/GHSA-fv66-9v8q-g76r","hostname":"github.com","tags":["WEB"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-55182","label":"nvd.nist.gov/vuln/detail/CVE-2025-55182","hostname":"nvd.nist.gov","tags":["Advisory"]},{"url":"https://github.com/facebook/react/pull/35277","label":"github.com/facebook/react/pull/35277","hostname":"github.com","tags":["WEB"]},{"url":"https://github.com/facebook/react/commit/7dc903cd29dac55efb4424853fd0442fef3a8700","label":"github.com/facebook/react/commit/7dc903cd29dac55efb4424853fd0442fef3a8700","hostname":"github.com","tags":["WEB"]},{"url":"https://github.com/ejpir/CVE-2025-55182-poc","label":"github.com/ejpir/CVE-2025-55182-poc","hostname":"github.com","tags":["WEB"]},{"url":"https://github.com/facebook/react","label":"github.com/facebook/react","hostname":"github.com","tags":["PACKAGE"]},{"url":"https://github.com/facebook/react/releases/tag/v19.0.1","label":"github.com/facebook/react/releases/tag/v19.0.1","hostname":"github.com","tags":["WEB"]},{"url":"https://github.com/facebook/react/releases/tag/v19.1.2","label":"github.com/facebook/react/releases/tag/v19.1.2","hostname":"github.com","tags":["WEB"]},{"url":"https://github.com/facebook/react/releases/tag/v19.2.1","label":"github.com/facebook/react/releases/tag/v19.2.1","hostname":"github.com","tags":["WEB"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":["CVE-2025-66478"],"related":[]},"timeline":[{"kind":"published","date":"2025-12-03T15:40:56.894Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"kev-added","date":"2025-12-05T00:00:00.000Z","label":"Added to CISA KEV","detail":"Meta React Server Components Remote Code Execution Vulnerability","source":"cisa"},{"kind":"kev-due","date":"2025-12-12T00:00:00.000Z","label":"CISA remediation due","detail":"Apply mitigations per vendor instructions.","source":"cisa"},{"kind":"kev-added","date":"2026-04-08T00:00:00.000Z","label":"Added to ENISA KEV","detail":"Added to the ENISA known exploited vulnerabilities catalog.","source":"enisa"},{"kind":"modified","date":"2026-10-07T17:58:00.859Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":100,"level":"critical","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T13:54:29.761Z","stale":false,"partial":false}}