{"id":"CVE-2025-55182","state":"PUBLISHED","title":"A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-serve","description":"A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.","publishedAt":"2025-12-03T15:40:56.894Z","updatedAt":"2026-10-07T17:58:00.859Z","severity":{"score":10,"label":"Critical","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","source":"Meta"},"assigner":"Meta","products":["Meta react-server-dom-webpack","Meta react-server-dom-turbopack","Meta react-server-dom-parcel"],"affected":[{"vendor":"Meta","product":"react-server-dom-webpack","defaultStatus":"unaffected","versions":[{"version":"19.0.0","status":"affected","lessThanOrEqual":"19.0.0","versionType":"semver"},{"version":"19.1.0","status":"affected","lessThanOrEqual":"19.1.1","versionType":"semver"},{"version":"19.2.0","status":"affected","lessThanOrEqual":"19.2.0","versionType":"semver"}]},{"vendor":"Meta","product":"react-server-dom-turbopack","defaultStatus":"unaffected","versions":[{"version":"19.0.0","status":"affected","lessThanOrEqual":"19.0.0","versionType":"semver"},{"version":"19.1.0","status":"affected","lessThanOrEqual":"19.1.1","versionType":"semver"},{"version":"19.2.0","status":"affected","lessThanOrEqual":"19.2.0","versionType":"semver"}]},{"vendor":"Meta","product":"react-server-dom-parcel","defaultStatus":"unaffected","versions":[{"version":"19.0.0","status":"affected","lessThanOrEqual":"19.0.0","versionType":"semver"},{"version":"19.1.0","status":"affected","lessThanOrEqual":"19.1.1","versionType":"semver"},{"version":"19.2.0","status":"affected","lessThanOrEqual":"19.2.0","versionType":"semver"}]}],"references":["https://www.facebook.com/security/advisories/cve-2025-55182","https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components","https://aws.amazon.com/blogs/security/china-nexus-cyber-threat-groups-rapidly-exploit-react2shell-vulnerability-cve-2025-55182/","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-55182","http://www.openwall.com/lists/oss-security/2025/12/03/4","https://news.ycombinator.com/item?id=46136026"],"weaknesses":["CWE-502"],"ingestedAt":"2026-10-29T20:09:31.862Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/55xxx/CVE-2025-55182.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-55182","state":"PUBLISHED","datePublished":"2025-12-03T15:40:56.894Z","dateUpdated":"2026-10-07T17:58:00.859Z","assignerShortName":"Meta","assignerOrgId":"4fc57720-52fe-4431-a0fb-3d2c8747b827","dateReserved":"2025-08-08T18:21:47.119Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints."}],"affected":[{"vendor":"Meta","product":"react-server-dom-webpack","defaultStatus":"unaffected","versions":[{"version":"19.0.0","status":"affected","lessThanOrEqual":"19.0.0","versionType":"semver"},{"version":"19.1.0","status":"affected","lessThanOrEqual":"19.1.1","versionType":"semver"},{"version":"19.2.0","status":"affected","lessThanOrEqual":"19.2.0","versionType":"semver"}]},{"vendor":"Meta","product":"react-server-dom-turbopack","defaultStatus":"unaffected","versions":[{"version":"19.0.0","status":"affected","lessThanOrEqual":"19.0.0","versionType":"semver"},{"version":"19.1.0","status":"affected","lessThanOrEqual":"19.1.1","versionType":"semver"},{"version":"19.2.0","status":"affected","lessThanOrEqual":"19.2.0","versionType":"semver"}]},{"vendor":"Meta","product":"react-server-dom-parcel","defaultStatus":"unaffected","versions":[{"version":"19.0.0","status":"affected","lessThanOrEqual":"19.0.0","versionType":"semver"},{"version":"19.1.0","status":"affected","lessThanOrEqual":"19.1.1","versionType":"semver"},{"version":"19.2.0","status":"affected","lessThanOrEqual":"19.2.0","versionType":"semver"}]}],"references":[{"url":"https://www.facebook.com/security/advisories/cve-2025-55182","tags":["x_refsource_CONFIRM"]},{"url":"https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components","tags":["x_refsource_CONFIRM"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","baseScore":10,"baseSeverity":"CRITICAL"}}],"problemTypes":[{"descriptions":[{"description":"Deserialization of Untrusted Data (CWE-502)","lang":"en"}]}],"providerMetadata":{"shortName":"Meta","orgId":"4fc57720-52fe-4431-a0fb-3d2c8747b827","dateUpdated":"2025-12-11T20:15:37.699Z"},"dateAssigned":"2025-12-02T00:00:00.000Z"},"adp":[{"title":"CISA ADP Vulnrichment","references":[{"url":"https://aws.amazon.com/blogs/security/china-nexus-cyber-threat-groups-rapidly-exploit-react2shell-vulnerability-cve-2025-55182/","tags":["media-coverage"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-55182","tags":["government-resource"]}],"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-08-04T03:56:02.696515Z","id":"CVE-2025-55182","options":[{"Exploitation":"active"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}},{"other":{"type":"kev","content":{"dateAdded":"2025-12-05","reference":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-55182"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-502","type":"CWE","lang":"en","description":"CWE-502 Deserialization of Untrusted Data"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-07T17:58:00.859Z"}},{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2025/12/03/4"},{"url":"https://news.ycombinator.com/item?id=46136026"}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2025-12-04T17:32:12.884Z"},"x_generator":{"engine":"ADPogram 0.0.1"}}]}}}