CVE DatabaseCVE-2025-55182

Updated 2026-10-18한국어 권고문 →

CVE-2025-5518210.0/CRITICALCISA KEVCWE-502

React Server Components (RSC) Pre-Authentication Remote Code Execution (RCE) Vulnerability Advisory (CVE-2025-55182)

⚡ Jump to Patch

Affected Vendors

facebook, react

Affected Components

react, react-server-dom-parcel, react-server-dom-turbopack, react-server-dom-webpack

Published Date

2025-12-03

CVSS v3.1

10.0

CRITICAL

EPSS (30d)

99.7%

FIRST.org

CISA KEV

Exploited

NVD Source ↗

Executive & SecOps Summary

SECOPS ASSESSMENT

Affected Scope

React versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 utilizing React Server Components (RSC), including react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack packages

Impact

Unauthenticated remote attackers can execute arbitrary code on the server by sending malicious payloads to Server Function endpoints, leading to complete system compromise

Mitigation

Immediately upgrade React and all associated react-server-dom packages to the latest patched versions, and apply WAF rules to restrict suspicious RSC requests

Affected Products & Version Scope

React versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0, including react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack packages

Remediation & Live Workaround Commands

PATCH & WORKAROUND

1. Official Patch & Version Upgrade Commands

Execute the appropriate command for your package manager to upgrade React and its server-side DOM dependencies to the latest secure versions.

bash

# For npm users
npm install react@latest react-dom@latest
npm install react-server-dom-webpack@latest

# For yarn users
yarn upgrade react react-dom react-server-dom-webpack

# For pnpm users
pnpm update react react-dom react-server-dom-webpack

2. Temporary Workaround & Hardening Configuration

If immediate patching is not feasible, configure your reverse proxy or Web Application Firewall (WAF) to block or restrict access to RSC endpoints (e.g., paths handling server functions).

nginx

# Nginx configuration to restrict RSC endpoint access
location /_rsc {
    client_max_body_size 10k;
    if ($request_method !~ ^(GET|POST)$) {
        return 405;
    }
    # Restrict access to trusted IP ranges if applicable
    # allow 10.0.0.0/8;
    # deny all;
}

3. Log Audit & IoC Verification Commands

Use the following commands to check for vulnerable package versions in your environment and audit application logs for potential exploitation attempts.

bash

# Check for vulnerable react-server-dom packages in your project
npm list --depth=3 | grep -E 'react-server-dom-(webpack|parcel|turbopack)@(19\.0\.0|19\.1\.[0-1]|19\.2\.0)'

# Scan web server access logs for suspicious RSC requests
grep -Ei 'rsc|server-function' /var/log/nginx/access.log | grep -E 'POST|400|500'

Interactive SecOps Remediation Checklist

0/4 (0%)

Recommended Security Control & Mitigation Partner

Cloudflare Enterprise & Pro WAF

This is an actively exploited critical vulnerability; immediately update your React and react-server-dom dependencies to secure versions.

Block Exploits Instantly with Managed Virtual Patching Rules

Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.

3-min setup · Automated Zero-Day Managed Rules

Deploy Instant WAF Protection Free

Practice Exploiting & Patching This Web Vulnerability in an Interactive Lab

Launch Hands-On Security Lab

Technical Root Cause & Exploitation Mechanics

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2025-55182) is a critical insecure deserialization flaw (CWE-502) residing within React Server Components (RSC). The Server Function endpoints introduced in React 19 unsafely deserialize incoming payloads from HTTP requests without sufficient validation. This allows an attacker to craft malicious serialized payloads that, when processed by the server, trigger arbitrary code execution within the server's runtime context.

2. Exploitation Mechanics & Attack Scenario

An unauthenticated attacker targets exposed RSC Server Function endpoints. By sending a specially crafted HTTP POST request containing serialized malicious Node.js objects, the attacker exploits the deserialization routine of the react-server-dom packages. As the server attempts to reconstruct the object, it executes the embedded payload, granting the attacker an interactive shell or arbitrary command execution capabilities (referred to as React2Shell).

3. Infrastructure & Business Impact

With a CVSS score of 10.0 and active exploitation confirmed in the wild (CISA KEV listed), this vulnerability poses an extreme risk to enterprise infrastructure. Successful exploitation allows full remote takeover of the application server, potential exposure of sensitive environment variables, database credentials, and lateral movement into internal networks.

Official Vendor Advisories & References

NVD Original English Description

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.

https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components

Source: cve-assign@fb.com · Patch, Vendor Advisory

https://www.facebook.com/security/advisories/cve-2025-55182

Source: cve-assign@fb.com · Vendor Advisory

http://www.openwall.com/lists/oss-security/2025/12/03/4

Source: af854a3a-2127-422b-91ae-364da2661108 · Mailing List, Patch, Third Party Advisory

https://news.ycombinator.com/item?id=46136026

Source: af854a3a-2127-422b-91ae-364da2661108 · Issue Tracking

https://aws.amazon.com/blogs/security/china-nexus-cyber-threat-groups-rapidly-exploit-react2shell-vulnerability-cve-2025-55182/

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 · Third Party Advisory

Frequently Asked SecOps Questions (CVE-2025-55182)

FAQ

Q1. How critical is CVE-2025-55182 and is it actively exploited in the wild?

CVE-2025-55182 is rated CVSS 10.0 (CRITICAL) with a 30-day EPSS exploitation probability of 99.7%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.

Q2. Which vendors and products are affected by CVE-2025-55182?

Primary impacted vendors include facebook, react across react, react-server-dom-parcel, react-server-dom-turbopack, react-server-dom-webpack. Scope summary: React versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0, including react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack packages

Q3. What temporary mitigations or workarounds exist for CVE-2025-55182 before patching?

[Mitigation] Immediately upgrade React and all associated react-server-dom packages to the latest patched versions, and apply WAF rules to restrict suspicious RSC requests Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.

SECOPS WORKBENCH INTEGRATION