CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Showing 1โ1 of 1 advisories (Page 1/1)
2025-12-03
React Server Components (RSC) Pre-Authentication Remote Code Execution (RCE) Vulnerability Advisory (CVE-2025-55182)
[Affected Scope] React versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 utilizing React Server Components (RSC), including react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack packages
[Impact] Unauthenticated remote attackers can execute arbitrary code on the server by sending malicious payloads to Server Function endpoints, leading to complete system compromise
[Mitigation] Immediately upgrade React and all associated react-server-dom packages to the latest patched versions, and apply WAF rules to restrict suspicious RSC requests