CVE-2025-55182
Published 2025-12-03 · Updated 2026-10-18 · Source cve-assign@fb.com
Summary
CVE-2025-55182 is a critical-severity (CVSS 10.0) vulnerability in Meta React Server Components. CISA added it to the Known Exploited Vulnerabilities catalog on December 5, 2025, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by December 12, 2025. CISA also lists it as known to be used in ransomware campaigns, so it should be prioritised accordingly.
All 1 known-exploited Meta vulnerabilities →Description
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CISA Known-Exploited Vulnerability
Product: Meta — React Server Components
Name: Meta React Server Components Remote Code Execution Vulnerability
Date added: 2025-12-05 · Due: 2025-12-12
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
References
- https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components
- https://www.facebook.com/security/advisories/cve-2025-55182
- http://www.openwall.com/lists/oss-security/2025/12/03/4
- https://news.ycombinator.com/item?id=46136026
- https://aws.amazon.com/blogs/security/china-nexus-cyber-threat-groups-rapidly-exploit-react2shell-vulnerability-cve-2025-55182/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-55182