CVE-2025-55182

Published Dec 3, 2025

Last updated 9 days ago

Exploit knownCVSS critical 10.0
React
react2shell
npm
AWS
Cloud
Network
Zero-day
API
Container Security
ICS
Business logic
Supply chain
Server
OT
Port (443)

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-55182 is a critical unauthenticated remote code execution (RCE) vulnerability found in React Server Components (RSC) versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0. This vulnerability affects packages including `react-server-dom-parcel`, `react-server-dom-turbopack`, and `react-server-dom-webpack`. The flaw stems from insecure deserialization in the RSC payload handling logic, allowing attacker-controlled data to influence server-side execution. Exploitation requires only a crafted HTTP request. Patches are available for React and Next.js. It is recommended to upgrade to patched React versions such as 19.0.1, 19.1.2, or 19.2.1, and to update frameworks like Next.js to their corresponding patched versions.

Description
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.
Source
cve-assign@fb.com
NVD status
Analyzed
Products
react, next.js

Insights

Analysis from the Intruder Security Team
Published Dec 4, 2025 Updated Dec 9, 2025

This vulnerability allows for code execution via a deserialisation vulnerability within the react-server-dom packages. This will affect React, NextJS and downstream projects who utilise these frameworks.

AssetNote released a technical research post and detection technique which is effective at identifying unpatches instances, where as full RCE chains may fail due to WAF's fingerprinting those payloads and bypasses heavily. Vercel's CEO released a simple breakdown of the issue and how it works.

We have witnessed widespread exploitation activity for this vulnerability, especially exploiting this to deploy an in-memory webshell. There has been some community efforts to detect exploitation activity, however exploiting this vulnerability usually leaves little to no trace which is difficult for defenders.

Patching immediately is the only effective strategy for dealing with this vulnerability.

Risk scores

CVSS 3.1

Type
Secondary
Base score
10
Impact score
6
Exploitability score
3.9
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Severity
CRITICAL

Known exploits

Data from CISA

Vulnerability name
Meta React Server Components Remote Code Execution Vulnerability
Exploit added on
Dec 5, 2025
Exploit action due
Dec 12, 2025
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Weaknesses

nvd@nist.gov
CWE-502
134c704f-9b21-4f2e-91b3-4a467353bcc0
CWE-502

Social media

Hype score
Not currently trending
  1. This week's KEV entries: CVE-2021-44228 (Apache), CVE-2026-10520 (Ivanti), CVE-2020-0796 (Microsoft), CVE-2025-55182 (Meta), CVE-2025-10035 (Fortra). All critical, all exploited. Prioritize based on your asset inventory. #Ivanti #ThreatIntel #CyberSecurity

    @BytesNora

    26 Oct 2026

    1 Impression

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  2. ExploitGrid Daily Digest 🚨 Top Exploits: CVE-2023-46604 (CVSS: 10) Apache Softw... CVE-2025-55182, CVE-2026-109618 (CVSS: 9.6) Meta CVE-2026-102785 (CVSS: 10) https://t.co/IpdRu5AimX CVE-2026-110264 (CVSS: 10) gitlab CVE-2026-110264 (CVSS: 10) gitlab ..🧵👇

    @exploitgrid

    24 Oct 2026

    116 Impressions

    1 Retweet

    2 Likes

    0 Bookmarks

    2 Replies

    0 Quotes

  3. 🔴 OWASP Nettacker, Remote Code Execution, #CVE-2025-55182 (Critical) -DC-Oct2026-3717 https://t.co/8OhTXFZaM7

    @dailycve

    23 Oct 2026

    26 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  4. So basically we're live in peak time of couple of decades - Iran vs Israel & USA - Russia vs Ukraine & Nato - AI revolution - Pc/server fully controlled by Agents - due to php vulnerability, 70% web down - react CVE-2025-55182 - nods CVE-2026 - eMudhar secure us with n

    @Mumumimam

    21 Oct 2026

    153 Impressions

    1 Retweet

    3 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  5. ExploitGrid Daily Digest 🚨 Top Exploits: CVE-2021-44228 (CVSS: 10) Apache Softw... CVE-2023-20198 (CVSS: 10) Cisco CVE-2024-3400 (CVSS: 10) paloaltonetw... CVE-2025-55182 (CVSS: 10) Meta CVE-2024-12603 (CVSS: 9.8) TECNO ..🧵👇

    @exploitgrid

    21 Oct 2026

    85 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  6. 2025年12月の React2Shell(CVE-2025-55182 / Next.js 側では CVE-2025-66478)。React Server Components の 未認証 RCE で、CVSS は 10.0 だったんで、PHPのことを呆れられる立場にないっす。 そういうの本当に無意味だからやめよう。

    @VoQn

    21 Oct 2026

    939 Impressions

    6 Retweets

    14 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  7. ❌ PHP迎来属于自己的RSC时刻(CVE-2025-55182) ✅ RSC让NodeJS变成了PHP(CVE-2026-109618)

    @Alexia476334561

    21 Oct 2026

    289 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

  8. 1 Oct 2026: Our honeypot captured exploit bodies from 34.19.150.122 matching React2Shell (CVE-2025-55182), Langflow (CVE-2025-3248) and PHP-CGI (CVE-2024-4577), targeting environment variables. Execution and secret theft unconfirmed. #ThreatIntel

    @Decoynotes

    18 Oct 2026

    1 Impression

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  9. AIいわく、これは単純なボットノイズではなく、既知の重大なNext.js RCE脆弱性(CVE-2025-55182/CVE-2025-66478、通称「React2Shell」)を狙った攻撃スキャンの痕跡と考えられとのこと。 https://t.co/7cH8HBw5VU

    @shijukarakun

    17 Oct 2026

    91 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

  10. 🚨 Still running unpatched React or Next.js? React2Shell (CVE-2025-55182): one crafted HTTP request ➡️ remote code execution. No login needed. 😱 Max severity. Exploited in the wild. ~40% of cloud environments exposed. Patch. Segment. Monitor. 👇 #AppSec #NextJS #Re

    @bertblevins

    16 Oct 2026

    36 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  11. ExploitGrid Daily Digest 🚨 Top Exploits: CVE-2025-24813 (CVSS: 10) Apache Softw... CVE-2025-55182 (CVSS: 10) Meta CVE-2025-57819 (CVSS: 10) FreePBX CVE-2026-27626 (CVSS: 10) olivetin CVE-2025-69872 (CVSS: 9.8) ..🧵👇

    @exploitgrid

    13 Oct 2026

    184 Impressions

    0 Retweets

    2 Likes

    1 Bookmark

    1 Reply

    0 Quotes

  12. 🔴 #GitHub, Information Disclosure, #CVE-2025-55182 (Critical) -DC-Oct2026-3107 https://t.co/CPjeOAGnNP

    @dailycve

    12 Oct 2026

    27 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  13. Diese Woche: Alle Schwachstellen im KEV-Katalog sind kritisch. CVE-2021-44228 (Apache), CVE-2026-10520 (Ivanti), CVE-2020-0796 (Microsoft), CVE-2025-55182 (Meta), CVE-2025-10035 (Fortra) haben CVSS 10.0 und hohe EPSS. Priorisieren Sie nach Ihrem Bestand. #Ivanti #ThreatIntel

    @BytesNora

    12 Oct 2026

    2 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  14. ExploitGrid Daily Digest 🚨 Top Exploits: CVE-2025-55182 (CVSS: 10) Meta CVE-2025-57819 (CVSS: 10) FreePBX CVE-2026-48907 (CVSS: 10) joomlaconten... CVE-2026-48908 (CVSS: 10) https://t.co/rUCex2k1eh CVE-2026-5430 (CVSS: 10) WSO2 ..🧵👇

    @exploitgrid

    10 Oct 2026

    196 Impressions

    0 Retweets

    2 Likes

    2 Bookmarks

    1 Reply

    0 Quotes

  15. 🔴 Nextjs, Remote Code Execution, #CVE-2025-55182 (Critical) -DC-Oct2026-3069 https://t.co/UI6LZRltzT

    @dailycve

    10 Oct 2026

    30 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  16. ExploitGrid Daily Digest 🚨 Top Exploits: CVE-2024-23652, CVE-2022-0492 (CVSS: 8.9) moby CVE-2025-55182 (CVSS: 10) Meta CVE-2025-55182 (CVSS: 10) Meta CVE-2026-10520 (CVSS: 10) CVE-2026-72898 (CVSS: 10) metabase ..🧵👇

    @exploitgrid

    9 Oct 2026

    86 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  17. これだけ色々侵入されているの、昨年末の「React2Shell」を放置していた、とかだったりしないかなぁ……(著名なOSやミドルに未知の深刻な脆弱性があって攻撃をされているとかは胃が痛すぎる……) React Server Co

    @steer_jp

    9 Oct 2026

    82 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  18. 🔴 CVE-2025-55182 | React2Shell Want to understand React2Shell? 🔬 I've published a technical breakdown on GitHub. Explore the vulnerability, understand the root cause, and learn how to mitigate it. https://t.co/kVN4ZA9fLE #CyberSecurity #React2Shell #InfoSec https://t.co

    @0xBlackash

    8 Oct 2026

    49 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

  19. ExploitGrid Daily Digest 🚨 Top Exploits: CVE-2025-55182 (CVSS: 10) Meta CVE-2026-67401 (CVSS: 9.9) WebPros CVE-2017-5638 (CVSS: 9.8) Apache Softw... CVE-2018-7600 (CVSS: 9.8) n/a CVE-2021-42013 (CVSS: 9.8) Apache Softw... ..🧵👇

    @exploitgrid

    8 Oct 2026

    222 Impressions

    0 Retweets

    3 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  20. 🔴 #React Server Components, Remote Code Execution, #CVE-2025-55182 (critical) -DC-Oct2026-2887 https://t.co/FASMnkudjc

    @dailycve

    8 Oct 2026

    30 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  21. Rooted Reactor on @hackthebox_eu 🏴‍☠️ Watch full video walkthrough on youtube👇 HackTheBox - Reactor | React2Shell | CVE-2025-55182 | CTF Walkthrough https://t.co/anivcCOm06 via @YouTube

    @cybervolt07

    7 Oct 2026

    18 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

  22. ExploitGrid Daily Digest 🚨 Top Exploits: CVE-2024-51482 (CVSS: 10) zoneminder CVE-2025-55182 (CVSS: 10) Meta CVE-2026-103956 (CVSS: 10) AWS CVE-2026-40281, CVE-2026-42589 (CVSS: 9.9) gotenberg CVE-2018-7600 (CVSS: 9.8) n/a ..🧵👇

    @exploitgrid

    6 Oct 2026

    389 Impressions

    1 Retweet

    11 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  23. HackTheBox - Reactor ⚛️ React2Shell (CVE-2025-55182) 🔐 Acceso SSH con credenciales en DB SQLite engineer 👑 Proceso Node modo depuracion para Privesc https://t.co/Fb6r1lv9ce

    @sckull_

    4 Oct 2026

    60 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  24. NØØT Security Alerts Classification: Critical CVE: CVE-2025-55182 Product: Meta / React Server Components Summary: VulnCheck reports real-world exploitation activity affecting Meta / React Server Components. Evidence: Critical severity; Public PoC/exploit available; Ransomwa

    @Python_s_

    2 Oct 2026

    60 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  25. ExploitGrid Daily Digest 🚨 Top Exploits: CVE-2025-55182 (CVSS: 10) Meta CVE-2026-100886 (CVSS: 10) Seetong CVE-2026-85706 (CVSS: 10) gitlab CVE-2026-38526 (CVSS: 9.9) CVE-2017-5941 (CVSS: 9.8) ..🧵👇

    @exploitgrid

    30 Sept 2026

    77 Impressions

    0 Retweets

    0 Likes

    1 Bookmark

    1 Reply

    0 Quotes

  26. React 19 + Next.js CVE-2025-55182. We tracked the timeline: Google Cloud in June, AWS in October, Cloudflare twice. Instead of panic-patching, we audited our entire pipeline first. Measure twice. Patch once. https://t.co/eLQDhVMGMi #React #NextJS #Security

    @videogeeksnet

    29 Sept 2026

    48 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  27. "しかし、こんなコードが動くとなれば、たいへん嫌な予感がしますよね。 はい、ご存じCVE-2025-55182ことReact2Shellは、このthenインジェクションを正面から活用したものでした" / “【JavaScript】Promise.resolveはPromis

    @tmhwq

    29 Sept 2026

    216 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

  28. All these KEV entries are exploited. CVE-2021-44228 (Apache), CVE-2026-10520 (Ivanti), CVE-2020-0796 (Microsoft), CVE-2025-55182 (Meta), CVE-2025-10035 (Fortra) all have CVSS 10.0 and EPSS >99%. Prioritize based on your asset inventory. #Ivanti #ThreatIntel #CyberSecurity

    @BytesNora

    28 Sept 2026

    3 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  29. Damn, my VPS just got hacked I redeployed an old side project on Next.js 15.4.6. I'd actually read the security warnings but I didn't think about it when spinning up an old project. Big mistake! That version has a critical bug called React2Shell (CVE-2025-55182). It lets http

    @TeeDevh

    25 Sept 2026

    112 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  30. Good morning @X Trying to find CVE-2025-55182 in a website . WHAT ABOUT YOU??

    @sarveshtiwarit

    23 Sept 2026

    95 Impressions

    0 Retweets

    4 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  31. 🛡️ #ExploitGrid Daily #Threat Digest Critical Exploits disclosed today: CVE-2025-55182 CVE-2026-81648 CVE-2023-21554 CVE-2024-31218 CVE-2025-39682 ..🧵👇

    @exploitgrid

    22 Sept 2026

    54 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  32. 🛡️ #ExploitGrid Daily #Threat Digest Critical Exploits disclosed today: CVE-2025-55182 CVE-2026-81648 CVE-2023-21554 CVE-2024-31218 CVE-2025-39682 ..🧵👇

    @exploitgrid

    21 Sept 2026

    58 Impressions

    0 Retweets

    2 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  33. All these KEV-cataloged vulns are exploited. CVE-2021-44228 (Apache), CVE-2026-10520 (Ivanti), CVE-2025-32432 (Craft CMS), CVE-2020-0796 (Microsoft), CVE-2025-55182 (Meta) all have CVSS 10.0, EPSS 100%, SecBoard Risk 85. Prioritize based on your assets. #Ivanti #ThreatIntel

    @BytesNora

    21 Sept 2026

    9 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  34. @brave @BraveSupport Windows Defender just quarantined Trojan:JS/CVE-2025-55182.A (React2Shell-related) as Severe inside Brave’s own profile:...\BraveSoftware\Brave-Browser\User Data\Default\blob_storage\...“This program is dangerous and executes commands from an attacker.

    @Saisrinivasmahi

    18 Sept 2026

    17 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  35. All 5 KEV-listed vulns this week are critical (CVSS 10.0, EPSS 100%). But not all deserve equal urgency. CVE-2021-44228 (Apache), CVE-2026-10520 (Ivanti), CVE-2025-32432 (Craft CMS), CVE-2020-0796 (Microsoft), CVE-2025-55182 (Meta). Prioritize based on your asset inventory.

    @BytesNora

    14 Sept 2026

    5 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  36. React Server Components Remote Code Execution (CVE-2025-55182) Now Has Public Exploit Code, Patch Immediately https://t.co/oHFKCAXVU6 #cybersecurity #threatintelligence https://t.co/VLoMlMrbzc

    @cybr_monk

    11 Sept 2026

    33 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  37. Hack The Box Reactor machine fully compromised via unauthenticated RCE in CVE-2025-55182 (React2Shell) affecting outdated Next.js. Attack chain includes Nmap discovery, public exploit for initial shell as node, hash extraction from reactor.db, offline cracking for SSH access,

    @WorldCyberNewsX

    11 Sept 2026

    7 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  38. Most AI tools hallucinate CVEs and give broken exploits.I asked Luah AI to research React2Shell (CVE-2025-55182) and generate a working https://t.co/y14Vc8q12E returned a full Python exploit for the critical pre-auth RCE in React/Next.js. https://t.co/dHHnE9GUmt

    @luahai_com

    10 Sept 2026

    24 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    1 Reply

    0 Quotes

  39. Spawned & rooted Reactor on HTB tonight. React2Shell (CVE-2025-55182) → unauth RCE in a Next.js dashboard. MD5 from the app DB → engineer's SSH pass. Root = a root node --inspect on loopback, driven over the DevTools protocol. https://t.co/TxeqLo408f #HackTheBox #HTB

    @_SP1R4

    9 Sept 2026

    45 Impressions

    0 Retweets

    2 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  40. Spawned & rooted Reactor on HTB tonight. React2Shell (CVE-2025-55182) → unauth RCE in a Next.js dashboard. MD5 from the app DB → engineer's SSH pass. Root = a root node --inspect on loopback via the DevTools protocol. https://t.co/TxeqLo408f #HackTheBox #HTB #InfoSec #P

    @_SP1R4

    9 Sept 2026

    44 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

  41. 🛡️ #ExploitGrid Daily #Threat Digest Critical Exploits disclosed today: CVE-2024-3094 CVE-2025-31324 CVE-2025-55182 CVE-2025-57819 CVE-2026-28576 ..🧵👇

    @exploitgrid

    8 Sept 2026

    39 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  42. This week's KEV additions: CVE-2021-44228 (Apache), CVE-2026-10520 (Ivanti), CVE-2025-32432 (Craft CMS), CVE-2020-0796 (Microsoft), CVE-2025-55182 (Meta). All are actively exploited. Prioritize based on your asset inventory, not just CVSS 10.0 scores.

    @BytesNora

    7 Sept 2026

    6 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  43. 🛡️ ExploitGrid Daily Threat Digest Critical Exploits disclosed today: CVE-2026-46339 CVE-2024-45798 CVE-2025-55182 CVE-2025-57819 CVE-2025-59528 ..🧵👇

    @exploitgrid

    29 Aug 2026

    58 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  44. I DID IT AGAIN RCE LEAD TO ADMIN PAYMENT PORTAL🔥🔥🔥 Next.js will you marry me ❤️❤️ ❤️ Tips: I found the embedded link in the js which i input which turn on Notifications it’s Vulnerable to RCE Next.js RSC Exploit Tool (CVE-2025-55182) https://t.co/epDh4

    @Shabosec

    27 Aug 2026

    9053 Impressions

    12 Retweets

    124 Likes

    102 Bookmarks

    6 Replies

    2 Quotes

  45. 🛡️ #ExploitGrid Daily #Threat Digest Critical Exploits disclosed today: #CVE-2025-55182 CVE-2026-2796 CVE-2026-2768 CVE-2026-34910 CVE-2026-34909 CVE-2026-58231 CVE-2026-48907 ..🧵👇

    @exploitgrid

    25 Aug 2026

    121 Impressions

    1 Retweet

    2 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  46. Look at what I saw today. React 18.3.1 frontend looks fine, but if you're using React Server Components, React2Shell (CVE-2025-55182) gives unauthenticated CVSS 10.0 RCE via the Flight protocol. Update server-side packages like react-server-dom-webpack NOW. 💀 @RedHatPenteste

    @focus_furry

    22 Aug 2026

    390 Impressions

    0 Retweets

    9 Likes

    2 Bookmarks

    0 Replies

    0 Quotes

  47. Huge spike in React2Shell (CVE-2025-55182) exploitation activity over the past couple of days. https://t.co/GaRTW5EfOP

    @kev_intel

    22 Aug 2026

    116 Impressions

    2 Retweets

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

  48. 🛡️ #ExploitGrid Daily #Threat Digest Critical Exploits disclosed today: EGE-EDB-AWZes1i ( CVE-2026-48907 ) EGE-GH-86PDTBb ( CVE-2025-55182 ) EGE-GH-uET14Zz ( CVE-2026-20079 ) EGE-GH-voHgFaT ( CVE-2026-59310 ) EGE-GH-seDlYMs ( CVE-2026-59310 ) ..🧵👇

    @exploitgrid

    18 Aug 2026

    88 Impressions

    0 Retweets

    3 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  49. 🛡️ #ExploitGrid Daily #Threat Digest Critical Exploits disclosed today: EGE-GH-z2Wb7PG ( CVE-2026-72898 ) EGE-GH-UkSJfvx ( CVE-2026-73678 ) EGE-GH-MKUk78n ( CVE-2023-22621 ) EGE-GH-EjpQM0Q ( CVE-2025-3243, CVE-2025-32433 ) EGE-GH-seDm3r2 ( CVE-2025-55182 ) ..🧵👇

    @exploitgrid

    17 Aug 2026

    29 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  50. A deserialization bug in Meta's React Server Components gives you pre-authentication RCE. We reproduced the public vulnerability, CVE-2025-55182, end-to-end. Cost to build the exploit and verify the fix was $2.96.

    @vulnresearchlab

    12 Aug 2026

    7 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

Configurations