CVE-2025-55182
Meta React Server Components Remote Code Execution Vulnerability
Description
CVE-2025-55182 is a critical pre-authentication remote code execution vulnerability in Meta's React Server Components, affecting versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 across the react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack packages. The vulnerability stems from unsafe deserialization of HTTP request payloads sent to Server Function endpoints, enabling unauthenticated attackers to execute arbitrary code on the server. With a maximum CVSS v3.1 base score of 10.0 and a changed scope, successful exploitation can fully compromise the hosting server and any connected infrastructure. CISA has added CVE-2025-55182 to the Known Exploited Vulnerabilities catalog with a due date of December 12, 2025, ransomware exploitation is known, and its EPSS score of 59.56% at the 98.2nd percentile indicates this is among the most actively exploited vulnerabilities in the current threat landscape.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| react | 19.0.0; 19.1.0; 19.1.1; 19.2.0 | |
| vercel | next.js | >= 15.0.0, < 15.0.5; >= 15.1.0, < 15.1.9; >= 15.2.0, < 15.2.6; >= 15.3.0, < 15.3.6; >= 15.4.0, < 15.4.8; >= 15.5.0, < 15.5.7; >= 16.0.0, < 16.0.7; 14.3.0; 15.6.0; 16.0.0 |
References
- https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components(Patch, Vendor Advisory)
- https://www.facebook.com/security/advisories/cve-2025-55182(Vendor Advisory)
- http://www.openwall.com/lists/oss-security/2025/12/03/4(Mailing List, Patch, Third Party Advisory)
- https://news.ycombinator.com/item?id=46136026(Issue Tracking)
- https://aws.amazon.com/blogs/security/china-nexus-cyber-threat-groups-rapidly-exploit-react2shell-vulnerability-cve-2025-55182/(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-55182(US Government Resource)
Weakness Type
CWE-502: Deserialization of Untrusted Data
CVE-2025-55182 is classified under CWE-502 (Deserialization of Untrusted Data), a critical weakness that occurs when an application deserializes data from an untrusted source without adequately verifying its integrity or safety. In the React Server Components architecture, Server Functions receive serialized payloads from client HTTP requests. The vulnerable code processes these payloads through a deserialization mechanism that can be manipulated to instantiate arbitrary objects, invoke dangerous methods, or execute attacker-controlled code on the server. Deserialization vulnerabilities are particularly devastating because they often enable pre-authentication remote code execution with minimal exploit complexity, and the React Server Components framework's widespread adoption amplifies the risk surface enormously. Learn more about CWE-502
Impact Analysis
CVE-2025-55182 represents a worst-case exploitation scenario with maximum impact across every dimension. Confidentiality is catastrophically compromised because pre-authentication RCE on a web server grants attackers access to all application data, environment variables containing secrets and API keys, database connection strings, user session data, and any files accessible to the server process. Given that React Server Components applications frequently store sensitive configuration in environment variables and connect to backend databases, the data exposure potential is enormous.
Integrity faces complete compromise as attackers can modify application code, inject malicious scripts served to end users, alter database records, and manipulate any server-side logic. The changed scope (S:C) in the CVSS vector means the impact extends beyond the vulnerable component to affect other systems, such as connected databases, microservices, cloud infrastructure accounts, and end-user browsers served by the compromised application.
Availability is fully at risk since attackers can terminate the application process, consume server resources through cryptomining or denial-of-service payloads, and destroy data or infrastructure. The EPSS score of 59.56% at the 98.2nd percentile places this among the top 2% of all vulnerabilities for exploitation probability. CISA has confirmed that ransomware groups are known to exploit this vulnerability, which is referred to as "React2Shell" in threat intelligence reporting. AWS has published analysis documenting China-nexus cyber threat groups rapidly exploiting this vulnerability, confirming nation-state level exploitation campaigns targeting React Server Components deployments worldwide.
Exploit Maturity
CVE-2025-55182 has one of the highest exploit maturity levels of any contemporary vulnerability. CISA has confirmed it in the Known Exploited Vulnerabilities catalog with a known ransomware association, one of the most severe classifications available. The EPSS score of 59.56% at the 98.2nd percentile means this vulnerability is more likely to be exploited than over 98% of all tracked vulnerabilities.
Multiple authoritative sources document active exploitation. Meta published an official security advisory and the React team released a dedicated blog post detailing the vulnerability and remediation steps. AWS threat intelligence published a detailed analysis of China-nexus cyber threat groups rapidly exploiting the React2Shell vulnerability, confirming that state-sponsored actors are weaponizing the flaw at scale. The vulnerability was also disclosed on the oss-security mailing list with patch details. The pre-authentication nature of the exploit, combined with the massive deployment footprint of React-based web applications and Next.js, makes this an extremely high-value target for both ransomware operators and advanced persistent threat groups seeking to compromise web infrastructure at scale.
Remediation
-
Upgrade React packages immediately to patched versions. For React core, upgrade to versions that include the Server Components fix as detailed in the React security blog post. Specifically update react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack packages past the affected versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0.
-
Upgrade Next.js if your application uses it, as the vulnerability affects multiple Next.js version ranges. Update to Next.js 15.0.5+, 15.1.9+, 15.2.6+, 15.3.6+, 15.4.8+, 15.5.7+, or 16.0.7+ depending on your current version branch. Versions 14.3.0, 15.6.0, and 16.0.0 are also specifically noted as affected and should be upgraded.
-
Conduct a full forensic assessment of any server running vulnerable React Server Components. Given the pre-authentication nature and confirmed nation-state exploitation, treat all exposed instances as potentially compromised. Review server logs for unusual POST requests to Server Function endpoints, check for unauthorized file modifications, unexpected processes, and signs of data exfiltration.
-
Implement Web Application Firewall (WAF) rules as a temporary compensating control while patching is underway. Configure rules to inspect and block suspicious serialized payloads in HTTP requests targeting Server Function endpoints. This is a defense-in-depth measure and should not replace patching.
-
Rotate all secrets and credentials accessible to the compromised server, including database connection strings, API keys stored in environment variables, session signing keys, and any third-party service credentials. Given the changed scope of the vulnerability, also review connected services and downstream systems for signs of compromise.
Technical Details
CVE-2025-55182 is a pre-authentication remote code execution vulnerability caused by unsafe deserialization of HTTP request payloads in React Server Components. The CVSS v3.1 vector string is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, producing the maximum base score of 10.0.
The vector analysis reveals the extreme severity of this vulnerability. Attack Vector (AV:N) confirms remote exploitation over the network. Attack Complexity (AC:L) means no special conditions are required. Privileges Required (PR:N) indicates the attack is pre-authentication, requiring no credentials whatsoever. User Interaction (UI:N) confirms fully automated exploitation. Scope (S:C) is the critical modifier that elevates the score to 10.0, indicating that exploitation of the React Server Components runtime affects resources beyond the vulnerable component, such as the host operating system, connected databases, and other services sharing the infrastructure.
The vulnerability resides in the Server Functions feature of React Server Components, which allows client-side code to invoke server-side functions through HTTP requests. When a client sends a request to a Server Function endpoint, the server deserializes the request payload to reconstruct the function arguments. The deserialization process in affected versions does not properly validate or restrict the types of objects that can be instantiated from the serialized data. An attacker can craft a malicious serialized payload that, when deserialized by the server, triggers arbitrary code execution through gadget chains or prototype manipulation. The affected packages react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack all share the same vulnerable deserialization logic adapted for their respective bundler integrations.
Frequently Asked Questions
What is CVE-2025-55182 (React2Shell)?
CVE-2025-55182, also known as React2Shell, is a critical pre-authentication remote code execution vulnerability in React Server Components. It allows unauthenticated attackers to execute arbitrary code on servers running affected React applications by sending malicious serialized payloads to Server Function endpoints.
Which frameworks and packages are affected?
The vulnerability affects React Server Components packages react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack in versions 19.0.0 through 19.2.0. Next.js is also affected across multiple version branches from 14.3.0 through 16.0.0, with specific patched versions available for each branch.
Is CVE-2025-55182 being used by ransomware groups?
Yes. CISA has classified the ransomware association as "Known," confirming that ransomware operators are actively exploiting this vulnerability. Additionally, AWS threat intelligence has documented China-nexus cyber threat groups rapidly weaponizing the flaw for large-scale attacks.
How do I know if my application is vulnerable?
Check your package.json and lock files for react-server-dom-parcel, react-server-dom-turbopack, or react-server-dom-webpack at versions 19.0.0, 19.1.0, 19.1.1, or 19.2.0. If you use Next.js, verify your version against the affected ranges. Applications that do not use React Server Components or Server Functions are not affected.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.