Actively exploited in the wild

Meta React Server Components Remote Code Execution Vulnerability

Meta - React Server Components · Listed in the CISA KEV since 2025-12-05. This indicates confirmed attacks in production environments.

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CVE-2025-55182

CriticalCVSS 10.0KEV

Published: 03/12/2025(UTC)Updated: 04/08/2026(UTC)Translated: 05/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Very high risk

99.62%

100th percentile - higher than 100% of all known CVEs

Summary

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0, including packages react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.

Risk Assessment

An attacker can remotely execute arbitrary code on the server, potentially leading to full control of the application and data.

Recommendation

Update React Server Components packages to patched versions. Restrict access to Server Function endpoints.

Original NVD description (English source)

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.