CVE-2025-55182

Published Dec 3, 2025

Last updated 2 months ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-55182 is a critical unauthenticated remote code execution (RCE) vulnerability found in React Server Components (RSC) versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0. This vulnerability affects packages including `react-server-dom-parcel`, `react-server-dom-turbopack`, and `react-server-dom-webpack`. The flaw stems from insecure deserialization in the RSC payload handling logic, allowing attacker-controlled data to influence server-side execution. Exploitation requires only a crafted HTTP request. Patches are available for React and Next.js. It is recommended to upgrade to patched React versions such as 19.0.1, 19.1.2, or 19.2.1, and to update frameworks like Next.js to their corresponding patched versions.

Description
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.
Source
cve-assign@fb.com
NVD status
Analyzed
Products
react, next.js

Insights

Analysis from the Intruder Security Team
Published Dec 4, 2025 Updated Dec 9, 2025

This vulnerability allows for code execution via a deserialisation vulnerability within the react-server-dom packages. This will affect React, NextJS and downstream projects who utilise these frameworks.

AssetNote released a technical research post and detection technique which is effective at identifying unpatches instances, where as full RCE chains may fail due to WAF's fingerprinting those payloads and bypasses heavily. Vercel's CEO released a simple breakdown of the issue and how it works.

We have witnessed widespread exploitation activity for this vulnerability, especially exploiting this to deploy an in-memory webshell. There has been some community efforts to detect exploitation activity, however exploiting this vulnerability usually leaves little to no trace which is difficult for defenders.

Patching immediately is the only effective strategy for dealing with this vulnerability.

Risk scores

CVSS 3.1

Type
Secondary
Base score
10
Impact score
6
Exploitability score
3.9
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Severity
CRITICAL

Known exploits

Data from CISA

Vulnerability name
Meta React Server Components Remote Code Execution Vulnerability
Exploit added on
Dec 5, 2025
Exploit action due
Dec 26, 2025
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Weaknesses

nvd@nist.gov
CWE-502

Social media

Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.

Hype score

2

  1. 🚨 0-Day Exploit Released: CVE-2025-55182 ⚛️ A full exploit tool for Remote Code Execution (RCE) in React Server Components is now public. https://t.co/HkKnv7SY0z #exploit #infosec #cybersecurity #RCE #React #0day #CVE202555182

    @TheExploitLab

    24 Jan 2026

    41 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  2. In December 2025, we uncovered attacks on Russian organizations: CVE-2025-55182 was exploited to deploy the XMRig miner, Sliver implant, Kaiji and RustoBot botnets. Similar React2Shell incidents were tracked beyond Russia. Learn more: https://t.co/nRS6XAtmzL https://t.co/N8UR0l

    @bizone_en

    23 Jan 2026

    98 Impressions

    1 Retweet

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

  3. When React2Shell (CVE-2025-55182) dropped in December, the real panic wasn’t the exploit. It was realizing half the teams had zero visibility on their prod stacks. Legacy dependencies, untouched monorepos, maintenance debt everywhere. I’ve lived both: upgrades in seconds v

    @Alain_Ncls

    23 Jan 2026

    657 Impressions

    1 Retweet

    7 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  4. React2Shell (CVE-2025-55182) is a critical unauthenticated remote code execution vulnerability impacting applications built with React Server Components & frameworks like Next.js. Read the advisory to understand impact, risk, & required defensive actions. https://t.co/C3y

    @tevora

    22 Jan 2026

    10 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  5. is this vulnerble or not?? CVE-2025-55182 When i submit a payload it gives 400 bad request. #bugbounty #cve https://t.co/rPqH9NB7uu

    @mugh33ra

    22 Jan 2026

    9127 Impressions

    5 Retweets

    84 Likes

    42 Bookmarks

    8 Replies

    0 Quotes

  6. React2Shell (CVE-2025-55182) Analysis from Jsmon https://t.co/SKBw3jeVKn

    @jsmonsh

    21 Jan 2026

    129 Impressions

    0 Retweets

    2 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  7. 📝 New article by a CrowdSec Ambassador, Killian Prin-Abeil!  In this deep dive, Killian breaks down React2Shell (CVE-2025-55182), from how the RCE works in React Server Components to why Next.js apps are vulnerable by default. He also explores how the community reacted i

    @Crowd_Security

    21 Jan 2026

    200 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

  8. hey @expo @Baconbrix this is really concerning. i just wanna build my app, but bumping into these, forcing me to use an affected version of React (react@19.1.0, CVE-2025-55182 of December 03, 2025) https://t.co/7MfZjmrUBS

    @DorianTho5

    21 Jan 2026

    3322 Impressions

    0 Retweets

    0 Likes

    1 Bookmark

    2 Replies

    0 Quotes

  9. Qué interesante: China-nexus cyber threat groups rapidly exploit React2Shell vulnerability (CVE-2025-55182) https://t.co/g3L4rpxzrm https://t.co/besPDKyRdS

    @AutomatismCloud

    21 Jan 2026

    76 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  10. Today I accidentally stumbled upon an active React2Shell Campaign. The Threat Actor seemingly used an off-the-shelf exploit that not only exploits CVE-2025-55182 but aggressively establishes persistence and uses your CPU to mine monero. Read all about it. https://t.co/TRNTE93j0N

    @DuncanCitizen2

    21 Jan 2026

    4505 Impressions

    1 Retweet

    12 Likes

    3 Bookmarks

    0 Replies

    1 Quote

  11. One HTTP request. Complete system takeover. React2Shell (CVE-2025-55182) hits 10.0 CVSS and is already weaponized by RondoDox botnet operators. https://t.co/NTu62DDtWw @three_cube @DI0256

    @_aircore

    20 Jan 2026

    337 Impressions

    2 Retweets

    2 Likes

    1 Bookmark

    0 Replies

    0 Quotes

  12. CVE-2025-55182 — React/Next.js RCE (10.0) — actively exploited https://t.co/C7uCTm3nAp CVE-2025-55182: Remote Code Execution (RCE) Affected Stack: Next.js (SSR / App Router) Node.js runtime Edge / serverless deployments Misconfigured middleware, API routes, or dynamic import

    @Mania4Pakistan

    19 Jan 2026

    52 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  13. From Azure Network Security Blog articles, Protect against React RSC CVE-2025-55182 with Azure Web Application Firewall (WAF), by yuvalpery "Please subscribe to this blog as we will be updating the suggested rules as new attack permutations are found..." https://t.co/DMWi55xBEJ

    @luisarnauth

    19 Jan 2026

    26 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  14. React2Shell(CVE-2025-55182) 취약점 완전 분석 https://t.co/3ROzMfEdss

    @_idisdi_

    19 Jan 2026

    53 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  15. I just wrote about the active 0‑day vulnerability that affects React Server and Next.js: CVE-2025-55182 “React2Shell” Threat and Mitigations https://t.co/DeBe0Rz1K5

    @TechPreacher

    19 Jan 2026

    38 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  16. TrendAI™ Research’s analysis of React2Shell (CVE-2025-55182) reveals a landscape filled with fake scanners and tools with many spreading misinformation or even introducing backdoors. Read our analysis: https://t.co/sowwCiAZeW

    @TrendMicroRSRCH

    19 Jan 2026

    213 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  17. #PressRelease Critical React2Shell Vulnerability (CVE-2025-55182) Analysis: Surge in Attacks Targeting RSC-Enabled Services Worldwide https://t.co/qzWkEyuOV7

    @Komodosec

    18 Jan 2026

    64 Impressions

    0 Retweets

    1 Like

    1 Bookmark

    0 Replies

    0 Quotes

  18. ''CVE-2025-55182 – React Server Components RCE via Flight Payload Deserialization'' #infosec #pentest #redteam #blueteam https://t.co/g6HZgzJvtI

    @CyberWarship

    18 Jan 2026

    2395 Impressions

    11 Retweets

    29 Likes

    17 Bookmarks

    1 Reply

    0 Quotes

  19. React2Shell (CVE-2025-55182): Breaking the Server Boundary in React Server Components | by @4nuxd https://t.co/Si1JgMidnR

    @4nuxd

    18 Jan 2026

    54 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

  20. 🚨 THREAT UPDATE 1/17/26 • 100+ new malicious URLs • Active Emotet/QakBot C2s • Critical React RCE (CVE-2025-55182) • 1,488 CISA KEV vulns ⚡ Block IOCs, patch CVEs #ThreatIntel #InfoSec

    @404LABSx

    17 Jan 2026

    75 Impressions

    2 Retweets

    2 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  21. Trend AI™ Research’s analysis of React2Shell (CVE-2025-55182) reveals a landscape filled with fake scanners and tools with many spreading misinformation or even introducing backdoors. Read our analysis: https://t.co/sowwCiAZeW

    @TrendMicroRSRCH

    17 Jan 2026

    400 Impressions

    1 Retweet

    5 Likes

    1 Bookmark

    0 Replies

    0 Quotes

  22. CVSS 10.0 React2Shell masterpiece (CVE-2025-55182 / CVE-2025-66478) in @nextjs turned our client's production server into a 24/7 crypto mining rig in minutes :)))) A month of forensic digging later we discover the miners were politely hiding inside node_modules like Easter eggs

    @petsonii

    16 Jan 2026

    67 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  23. URGENT: Active React2Shell (CVE-2025-55182) exploitation in the wild Found crypto miner on our AWS EC2. Attacker has 43+ servers. We had to DESTROY & rebuild. Read here -> https://t.co/G7L4nwo8Rg TL;DR Quick thread 🧵

    @netrobeweb

    15 Jan 2026

    44 Impressions

    1 Retweet

    6 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  24. I just completed React2Shell: CVE-2025-55182 room on TryHackMe! Explore the CVE-2025-55182 vulnerability in React server components. https://t.co/f2MRNyUf00 #tryhackme via @tryhackme

    @acupunc28094787

    14 Jan 2026

    45 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  25. [Sophos - Naked Security] React2Shell flaw (CVE-2025-55182) exploited for remote code execution. The availability of exploit code will likely lead to more widespread opportunistic attacksTags: Threat Research, Featured, vulnerability, react2shell https://t.co/QODzjR8UGp

    @shah_sheikh

    14 Jan 2026

    0 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  26. El Google Threat Intelligence Group ha emitido una alerta urgente sobre React2Shell, una falla crítica de seguridad identificada como CVE-2025-55182 que afecta a servidores que utilizan React y Next.js. Esta vulnerabilidad permite que atacantes tomen el control total de los http

    @laprovittera

    14 Jan 2026

    201 Impressions

    0 Retweets

    1 Like

    1 Bookmark

    1 Reply

    0 Quotes

  27. Day 2 - CVE-2025-55182 (React2Shell) Critical unauthenticated RCE in React Server Components via unsafe deserialization. Patch & harden now. #CyberCIAForge #CVE #React #RCE #Infosec https://t.co/lXMqJV61AM

    @Cyberciaforge

    14 Jan 2026

    57 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  28. Qué interesante: China-nexus cyber threat groups rapidly exploit React2Shell vulnerability (CVE-2025-55182) https://t.co/g3L4rpxzrm https://t.co/u5vXHF3m3V

    @AutomatismCloud

    14 Jan 2026

    0 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  29. Analysis of Attacks Targeting Israel and Global Government Entities via CVE-2025-55182 Exploitation 📌 New TI Report ▶ https://t.co/kKD6JJtvOZ #ThreatIntelligence #CVE202555182 #Israel

    @OASIS_SECURITY_

    13 Jan 2026

    15 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  30. Analysis of Attacks Targeting Israel and Global Government Entities via CVE-2025-55182 Exploitation 📌 New TI Report ▶ https://t.co/b5xyAnSBH8 #ThreatIntelligence #CVE202555182 #Israel

    @OASIS_SECURITY_

    13 Jan 2026

    4 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

  31. On December 3, 2025, a vulnerability (CVE-2025-55182) enabling unauthenticated remote code execution in React Server Components was disclosed. An attacker could send a specially crafted HTTP request (an unauthorized Flight payload via HTTP) to a server processing React Server

    @blog_casting

    12 Jan 2026

    26 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  32. Top 5 Trending CVEs: 1 - CVE-2025-48593 2 - CVE-2025-55182 3 - CVE-2023-45866 4 - CVE-2026-21440 5 - CVE-2025-60188 #cve #cvetrends #cveshield #cybersecurity https://t.co/4Fua3CAN6W

    @CVEShield

    12 Jan 2026

    42 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

  33. 🚨 New Critical CVE: CVE-2025-55182 📊 Score: 10.0 📝 A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19... 🔗 Read Details: https://t.co/RdteBEgVzd #CVE #CyberSecurity #WatchStack

    @watchstackio

    12 Jan 2026

    5 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  34. Top 5 Trending CVEs: 1 - CVE-2025-43533 2 - CVE-2023-29218 3 - CVE-2026-20029 4 - CVE-2025-55182 5 - CVE-2025-29927 #cve #cvetrends #cveshield #cybersecurity https://t.co/4Fua3CAN6W

    @CVEShield

    11 Jan 2026

    75 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  35. React2Shell (CVE-2025-55182) is causing a lot of sleepless nights this week. ☕️ If you run Next.js, check your versions immediately. We've compiled the full technical analysis and affected version list here: 🔗 https://t.co/3YPYwkjSCq #InfoSec #BugBounty #React #CyberSec

    @cvedatabase

    11 Jan 2026

    0 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  36. Earth Lamia + Jackpot Panda eksploatują React2Shell (CVE-2025-55182) w App Router 15/16. Pełna analiza OTX IOCs, PoC mechaniki, Cobalt Strike C2 + FRP backdoory. DEVS – PATCHUJ ALBO ZGINEISZ! 🔥 CZYTELNIJ TERAZ: https://t.co/R13b6WvtW3 #React2Shell #ZeroDayPL #CyberAlertPL

    @CyberAlert_

    10 Jan 2026

    106 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  37. 2026 reality check for React devs💀 Server Components are powerful... until they're not. The recent React2Shell CVE (CVE-2025-55182) showed us how a single misconfigured RSC can turn your app into an IoT botnet gateway. Security isn't optional anymore it is a critical.

    @EshanBhat11

    10 Jan 2026

    102 Impressions

    0 Retweets

    3 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  38. December 2025 saw major security events: unauthenticated React2Shell RCE (CVE-2025-55182), BRICKSTORM backdoor resurfacing, MongoBleed data exposure (CVE-2025-14847), and EtherRAT leveraging Ethereum smart contracts. #React2Shell #BRICKSTORM #USA https://t.co/PuchGjGbzd

    @TweetThreatNews

    10 Jan 2026

    128 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  39. We reviewed the specific vulnerabilities that shaped attacker behavior in 2025: 1️⃣React2Shell (CVE-2025-55182) 2️⃣SAP NetWeaver (CVE-2025-31324) 3️⃣PAN-OS Auth Bypass (CVE-2025-0108) 4️⃣Cisco IOS XE (CVE-2025-20188) 5️⃣Erlang/OTP SSH (CVE-2025-32433) Full b

    @pdiscoveryio

    10 Jan 2026

    3532 Impressions

    12 Retweets

    69 Likes

    34 Bookmarks

    1 Reply

    0 Quotes

  40. Qué interesante: China-nexus cyber threat groups rapidly exploit React2Shell vulnerability (CVE-2025-55182) https://t.co/g3L4rpxzrm https://t.co/1oEi5O86wG

    @AutomatismCloud

    10 Jan 2026

    0 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  41. React devs, this one hurts 😬 React2Shell (CVE-2025-55182) lets attackers run arbitrary JS on your server with a single request. No auth. No user clicks. Upgrade your React/Next apps and rotate secrets. Worth a read 👇 https://t.co/8x3Ntxax1D

    @wiseduckdev

    9 Jan 2026

    9 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  42. 🔓 Exploiting CVE-2025-55182? React2Shell is an advanced Next.js/React RCE framework for security research. Harden your apps now! #exploit #cybersecurity #webdev https://t.co/jDFnTw5VA7

    @TheExploitLab

    9 Jan 2026

    188 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  43. CVE-2025-55182 (React2Shell) is a critical RCE affecting React Server Components and related frameworks. In his latest article, JD Burke explains how the flaw works and how to find and prioritize exposure using Kiuwan. Read more: https://t.co/1V4nwx6UDJ https://t.co/cJuseqzqbR

    @Kiuwan

    8 Jan 2026

    3 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  44. Hackers Launched 8.1 Million React2Shell Attack Sessions Vulnerability The React2Shell vulnerability (CVE-2025-55182) continues to face a relentless exploitation campaign.... #CyberSecurityNews #Attack #CVE https://t.co/6YUDWbvrrE

    @HackersRadar

    8 Jan 2026

    0 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  45. A little late but I wrote an article about React2Shell (CVE-2025-55182), the critical RCE vulnerability that hit the React ecosystem last month. Deep dive into the POC, prototype pollution mechanics, and impact. https://t.co/crcW6MzyhG #ReactJS #React2Shell #WebSecurity

    @sunggatalimbet

    8 Jan 2026

    17 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  46. A little late but I wrote an article about React2Shell (CVE-2025-55182), the critical RCE vulnerability that hit the React ecosystem last month. Deep dive into the POC, prototype pollution mechanics, and impact. https://t.co/crcW6MzyhG #ReactJS #WebDevelopment #WebSecurity

    @sunggatalimbet

    8 Jan 2026

    114 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  47. React2Shell: IoT Nightmare Unleashed! CVE-2025-55182 allows attackers to take control of IoT devices and web servers with a single HTTP request due to flaws in React Server Components. Dive into its origins and explore hands-on exploits! https://t.co/PHPm37it5n @three_cube htt

    @DI0256

    8 Jan 2026

    5690 Impressions

    16 Retweets

    104 Likes

    39 Bookmarks

    0 Replies

    0 Quotes

  48. 🚨 React2Shell Under Heavy Fire: 8.1M+ Exploitation Sessions Hit CVE-2025-55182 GreyNoise telemetry shows sustained mass exploitation of React2Shell (CVE-2025-55182) with 8.1M+ attack sessions, ~300K–400K daily attempts, and infrastructure spread across 8,163 IPs / 1,071 ASNs

    @ThreatSynop

    8 Jan 2026

    47 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  49. Security alert for React and Next.js users: We released a new Cloud Armor WAF rule to help mitigate CVE-2025-55182. See our guide for rule IDs and patching recommendations to secure your workloads against remote code execution risks. #GoogleCloud https://t.co/fLn6SCOS23

    @CarmellaWe23068

    8 Jan 2026

    39 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  50. #CVE-2025-55182-bypass-Waf #bugbounty #bugbountytips https://t.co/C9IpDyFAfB

    @momika233

    8 Jan 2026

    10988 Impressions

    38 Retweets

    163 Likes

    109 Bookmarks

    1 Reply

    2 Quotes

Configurations