CVE-2025-55182

Published Dec 3, 2025

Last updated 2 months ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-55182 is a critical unauthenticated remote code execution (RCE) vulnerability found in React Server Components (RSC) versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0. This vulnerability affects packages including `react-server-dom-parcel`, `react-server-dom-turbopack`, and `react-server-dom-webpack`. The flaw stems from insecure deserialization in the RSC payload handling logic, allowing attacker-controlled data to influence server-side execution. Exploitation requires only a crafted HTTP request. Patches are available for React and Next.js. It is recommended to upgrade to patched React versions such as 19.0.1, 19.1.2, or 19.2.1, and to update frameworks like Next.js to their corresponding patched versions.

Description
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.
Source
cve-assign@fb.com
NVD status
Analyzed
Products
react, next.js

Insights

Analysis from the Intruder Security Team
Published Dec 4, 2025 Updated Dec 9, 2025

This vulnerability allows for code execution via a deserialisation vulnerability within the react-server-dom packages. This will affect React, NextJS and downstream projects who utilise these frameworks.

AssetNote released a technical research post and detection technique which is effective at identifying unpatches instances, where as full RCE chains may fail due to WAF's fingerprinting those payloads and bypasses heavily. Vercel's CEO released a simple breakdown of the issue and how it works.

We have witnessed widespread exploitation activity for this vulnerability, especially exploiting this to deploy an in-memory webshell. There has been some community efforts to detect exploitation activity, however exploiting this vulnerability usually leaves little to no trace which is difficult for defenders.

Patching immediately is the only effective strategy for dealing with this vulnerability.

Risk scores

CVSS 3.1

Type
Secondary
Base score
10
Impact score
6
Exploitability score
3.9
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Severity
CRITICAL

Known exploits

Data from CISA

Vulnerability name
Meta React Server Components Remote Code Execution Vulnerability
Exploit added on
Dec 5, 2025
Exploit action due
Dec 26, 2025
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Weaknesses

nvd@nist.gov
CWE-502

Social media

Hype score
Not currently trending
  1. 🚨 THREAT ALERT - Jan 26 🔴 CRITICAL: • React RCE (CVE-2025-55182) - ACTIVE EXPLOITATION • VMware vCenter RCE (CVE-2024-37079) • 150+ malicious URLs (Mozi/Mirai) ⚠️ PATCH IMMEDIATELY 🛡️ Block: 182.127.30.227 #ThreatIntel #Cybersecurity

    @404LABSx

    26 Jan 2026

    66 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  2. Key events in cybersecurity from last week: React2Shell (CVE-2025-55182) is still actively exploited in the wild across internet-exposed applications. Threat intelligence confirms! Update should be immediate for Next.js/Node.js users ---

    @AdenijiAzeez

    25 Jan 2026

    49 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  3. 🚨 0-Day Exploit Released: CVE-2025-55182 ⚛️ A full exploit tool for Remote Code Execution (RCE) in React Server Components is now public. https://t.co/HkKnv7SY0z #exploit #infosec #cybersecurity #RCE #React #0day #CVE202555182

    @TheExploitLab

    24 Jan 2026

    48 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  4. In December 2025, we uncovered attacks on Russian organizations: CVE-2025-55182 was exploited to deploy the XMRig miner, Sliver implant, Kaiji and RustoBot botnets. Similar React2Shell incidents were tracked beyond Russia. Learn more: https://t.co/nRS6XAtmzL https://t.co/N8UR0l

    @bizone_en

    23 Jan 2026

    98 Impressions

    1 Retweet

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

  5. When React2Shell (CVE-2025-55182) dropped in December, the real panic wasn’t the exploit. It was realizing half the teams had zero visibility on their prod stacks. Legacy dependencies, untouched monorepos, maintenance debt everywhere. I’ve lived both: upgrades in seconds v

    @Alain_Ncls

    23 Jan 2026

    657 Impressions

    1 Retweet

    7 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  6. React2Shell (CVE-2025-55182) is a critical unauthenticated remote code execution vulnerability impacting applications built with React Server Components & frameworks like Next.js. Read the advisory to understand impact, risk, & required defensive actions. https://t.co/C3y

    @tevora

    22 Jan 2026

    10 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  7. is this vulnerble or not?? CVE-2025-55182 When i submit a payload it gives 400 bad request. #bugbounty #cve https://t.co/rPqH9NB7uu

    @mugh33ra

    22 Jan 2026

    9127 Impressions

    5 Retweets

    84 Likes

    42 Bookmarks

    8 Replies

    0 Quotes

  8. React2Shell (CVE-2025-55182) Analysis from Jsmon https://t.co/SKBw3jeVKn

    @jsmonsh

    21 Jan 2026

    129 Impressions

    0 Retweets

    2 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  9. 📝 New article by a CrowdSec Ambassador, Killian Prin-Abeil!  In this deep dive, Killian breaks down React2Shell (CVE-2025-55182), from how the RCE works in React Server Components to why Next.js apps are vulnerable by default. He also explores how the community reacted i

    @Crowd_Security

    21 Jan 2026

    200 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

  10. hey @expo @Baconbrix this is really concerning. i just wanna build my app, but bumping into these, forcing me to use an affected version of React (react@19.1.0, CVE-2025-55182 of December 03, 2025) https://t.co/7MfZjmrUBS

    @DorianTho5

    21 Jan 2026

    3322 Impressions

    0 Retweets

    0 Likes

    1 Bookmark

    2 Replies

    0 Quotes

  11. Qué interesante: China-nexus cyber threat groups rapidly exploit React2Shell vulnerability (CVE-2025-55182) https://t.co/g3L4rpxzrm https://t.co/besPDKyRdS

    @AutomatismCloud

    21 Jan 2026

    76 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  12. Today I accidentally stumbled upon an active React2Shell Campaign. The Threat Actor seemingly used an off-the-shelf exploit that not only exploits CVE-2025-55182 but aggressively establishes persistence and uses your CPU to mine monero. Read all about it. https://t.co/TRNTE93j0N

    @DuncanCitizen2

    21 Jan 2026

    4505 Impressions

    1 Retweet

    12 Likes

    3 Bookmarks

    0 Replies

    1 Quote

  13. One HTTP request. Complete system takeover. React2Shell (CVE-2025-55182) hits 10.0 CVSS and is already weaponized by RondoDox botnet operators. https://t.co/NTu62DDtWw @three_cube @DI0256

    @_aircore

    20 Jan 2026

    337 Impressions

    2 Retweets

    2 Likes

    1 Bookmark

    0 Replies

    0 Quotes

  14. CVE-2025-55182 — React/Next.js RCE (10.0) — actively exploited https://t.co/C7uCTm3nAp CVE-2025-55182: Remote Code Execution (RCE) Affected Stack: Next.js (SSR / App Router) Node.js runtime Edge / serverless deployments Misconfigured middleware, API routes, or dynamic import

    @Mania4Pakistan

    19 Jan 2026

    52 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  15. From Azure Network Security Blog articles, Protect against React RSC CVE-2025-55182 with Azure Web Application Firewall (WAF), by yuvalpery "Please subscribe to this blog as we will be updating the suggested rules as new attack permutations are found..." https://t.co/DMWi55xBEJ

    @luisarnauth

    19 Jan 2026

    26 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  16. React2Shell(CVE-2025-55182) 취약점 완전 분석 https://t.co/3ROzMfEdss

    @_idisdi_

    19 Jan 2026

    53 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  17. I just wrote about the active 0‑day vulnerability that affects React Server and Next.js: CVE-2025-55182 “React2Shell” Threat and Mitigations https://t.co/DeBe0Rz1K5

    @TechPreacher

    19 Jan 2026

    38 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  18. TrendAI™ Research’s analysis of React2Shell (CVE-2025-55182) reveals a landscape filled with fake scanners and tools with many spreading misinformation or even introducing backdoors. Read our analysis: https://t.co/sowwCiAZeW

    @TrendMicroRSRCH

    19 Jan 2026

    213 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  19. #PressRelease Critical React2Shell Vulnerability (CVE-2025-55182) Analysis: Surge in Attacks Targeting RSC-Enabled Services Worldwide https://t.co/qzWkEyuOV7

    @Komodosec

    18 Jan 2026

    64 Impressions

    0 Retweets

    1 Like

    1 Bookmark

    0 Replies

    0 Quotes

  20. ''CVE-2025-55182 – React Server Components RCE via Flight Payload Deserialization'' #infosec #pentest #redteam #blueteam https://t.co/g6HZgzJvtI

    @CyberWarship

    18 Jan 2026

    2395 Impressions

    11 Retweets

    29 Likes

    17 Bookmarks

    1 Reply

    0 Quotes

  21. React2Shell (CVE-2025-55182): Breaking the Server Boundary in React Server Components | by @4nuxd https://t.co/Si1JgMidnR

    @4nuxd

    18 Jan 2026

    54 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

  22. 🚨 THREAT UPDATE 1/17/26 • 100+ new malicious URLs • Active Emotet/QakBot C2s • Critical React RCE (CVE-2025-55182) • 1,488 CISA KEV vulns ⚡ Block IOCs, patch CVEs #ThreatIntel #InfoSec

    @404LABSx

    17 Jan 2026

    75 Impressions

    2 Retweets

    2 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  23. Trend AI™ Research’s analysis of React2Shell (CVE-2025-55182) reveals a landscape filled with fake scanners and tools with many spreading misinformation or even introducing backdoors. Read our analysis: https://t.co/sowwCiAZeW

    @TrendMicroRSRCH

    17 Jan 2026

    400 Impressions

    1 Retweet

    5 Likes

    1 Bookmark

    0 Replies

    0 Quotes

  24. CVSS 10.0 React2Shell masterpiece (CVE-2025-55182 / CVE-2025-66478) in @nextjs turned our client's production server into a 24/7 crypto mining rig in minutes :)))) A month of forensic digging later we discover the miners were politely hiding inside node_modules like Easter eggs

    @petsonii

    16 Jan 2026

    67 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  25. URGENT: Active React2Shell (CVE-2025-55182) exploitation in the wild Found crypto miner on our AWS EC2. Attacker has 43+ servers. We had to DESTROY & rebuild. Read here -> https://t.co/G7L4nwo8Rg TL;DR Quick thread 🧵

    @netrobeweb

    15 Jan 2026

    44 Impressions

    1 Retweet

    6 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  26. I just completed React2Shell: CVE-2025-55182 room on TryHackMe! Explore the CVE-2025-55182 vulnerability in React server components. https://t.co/f2MRNyUf00 #tryhackme via @tryhackme

    @acupunc28094787

    14 Jan 2026

    45 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  27. [Sophos - Naked Security] React2Shell flaw (CVE-2025-55182) exploited for remote code execution. The availability of exploit code will likely lead to more widespread opportunistic attacksTags: Threat Research, Featured, vulnerability, react2shell https://t.co/QODzjR8UGp

    @shah_sheikh

    14 Jan 2026

    0 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  28. El Google Threat Intelligence Group ha emitido una alerta urgente sobre React2Shell, una falla crítica de seguridad identificada como CVE-2025-55182 que afecta a servidores que utilizan React y Next.js. Esta vulnerabilidad permite que atacantes tomen el control total de los http

    @laprovittera

    14 Jan 2026

    201 Impressions

    0 Retweets

    1 Like

    1 Bookmark

    1 Reply

    0 Quotes

  29. Day 2 - CVE-2025-55182 (React2Shell) Critical unauthenticated RCE in React Server Components via unsafe deserialization. Patch & harden now. #CyberCIAForge #CVE #React #RCE #Infosec https://t.co/lXMqJV61AM

    @Cyberciaforge

    14 Jan 2026

    57 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  30. Qué interesante: China-nexus cyber threat groups rapidly exploit React2Shell vulnerability (CVE-2025-55182) https://t.co/g3L4rpxzrm https://t.co/u5vXHF3m3V

    @AutomatismCloud

    14 Jan 2026

    0 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  31. Analysis of Attacks Targeting Israel and Global Government Entities via CVE-2025-55182 Exploitation 📌 New TI Report ▶ https://t.co/kKD6JJtvOZ #ThreatIntelligence #CVE202555182 #Israel

    @OASIS_SECURITY_

    13 Jan 2026

    15 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  32. Analysis of Attacks Targeting Israel and Global Government Entities via CVE-2025-55182 Exploitation 📌 New TI Report ▶ https://t.co/b5xyAnSBH8 #ThreatIntelligence #CVE202555182 #Israel

    @OASIS_SECURITY_

    13 Jan 2026

    4 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

  33. On December 3, 2025, a vulnerability (CVE-2025-55182) enabling unauthenticated remote code execution in React Server Components was disclosed. An attacker could send a specially crafted HTTP request (an unauthorized Flight payload via HTTP) to a server processing React Server

    @blog_casting

    12 Jan 2026

    26 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  34. Top 5 Trending CVEs: 1 - CVE-2025-48593 2 - CVE-2025-55182 3 - CVE-2023-45866 4 - CVE-2026-21440 5 - CVE-2025-60188 #cve #cvetrends #cveshield #cybersecurity https://t.co/4Fua3CAN6W

    @CVEShield

    12 Jan 2026

    42 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

  35. 🚨 New Critical CVE: CVE-2025-55182 📊 Score: 10.0 📝 A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19... 🔗 Read Details: https://t.co/RdteBEgVzd #CVE #CyberSecurity #WatchStack

    @watchstackio

    12 Jan 2026

    5 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  36. Top 5 Trending CVEs: 1 - CVE-2025-43533 2 - CVE-2023-29218 3 - CVE-2026-20029 4 - CVE-2025-55182 5 - CVE-2025-29927 #cve #cvetrends #cveshield #cybersecurity https://t.co/4Fua3CAN6W

    @CVEShield

    11 Jan 2026

    75 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  37. React2Shell (CVE-2025-55182) is causing a lot of sleepless nights this week. ☕️ If you run Next.js, check your versions immediately. We've compiled the full technical analysis and affected version list here: 🔗 https://t.co/3YPYwkjSCq #InfoSec #BugBounty #React #CyberSec

    @cvedatabase

    11 Jan 2026

    0 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  38. Earth Lamia + Jackpot Panda eksploatują React2Shell (CVE-2025-55182) w App Router 15/16. Pełna analiza OTX IOCs, PoC mechaniki, Cobalt Strike C2 + FRP backdoory. DEVS – PATCHUJ ALBO ZGINEISZ! 🔥 CZYTELNIJ TERAZ: https://t.co/R13b6WvtW3 #React2Shell #ZeroDayPL #CyberAlertPL

    @CyberAlert_

    10 Jan 2026

    106 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  39. 2026 reality check for React devs💀 Server Components are powerful... until they're not. The recent React2Shell CVE (CVE-2025-55182) showed us how a single misconfigured RSC can turn your app into an IoT botnet gateway. Security isn't optional anymore it is a critical.

    @EshanBhat11

    10 Jan 2026

    102 Impressions

    0 Retweets

    3 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  40. December 2025 saw major security events: unauthenticated React2Shell RCE (CVE-2025-55182), BRICKSTORM backdoor resurfacing, MongoBleed data exposure (CVE-2025-14847), and EtherRAT leveraging Ethereum smart contracts. #React2Shell #BRICKSTORM #USA https://t.co/PuchGjGbzd

    @TweetThreatNews

    10 Jan 2026

    128 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  41. We reviewed the specific vulnerabilities that shaped attacker behavior in 2025: 1️⃣React2Shell (CVE-2025-55182) 2️⃣SAP NetWeaver (CVE-2025-31324) 3️⃣PAN-OS Auth Bypass (CVE-2025-0108) 4️⃣Cisco IOS XE (CVE-2025-20188) 5️⃣Erlang/OTP SSH (CVE-2025-32433) Full b

    @pdiscoveryio

    10 Jan 2026

    3532 Impressions

    12 Retweets

    69 Likes

    34 Bookmarks

    1 Reply

    0 Quotes

  42. Qué interesante: China-nexus cyber threat groups rapidly exploit React2Shell vulnerability (CVE-2025-55182) https://t.co/g3L4rpxzrm https://t.co/1oEi5O86wG

    @AutomatismCloud

    10 Jan 2026

    0 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  43. React devs, this one hurts 😬 React2Shell (CVE-2025-55182) lets attackers run arbitrary JS on your server with a single request. No auth. No user clicks. Upgrade your React/Next apps and rotate secrets. Worth a read 👇 https://t.co/8x3Ntxax1D

    @wiseduckdev

    9 Jan 2026

    9 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  44. 🔓 Exploiting CVE-2025-55182? React2Shell is an advanced Next.js/React RCE framework for security research. Harden your apps now! #exploit #cybersecurity #webdev https://t.co/jDFnTw5VA7

    @TheExploitLab

    9 Jan 2026

    188 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  45. CVE-2025-55182 (React2Shell) is a critical RCE affecting React Server Components and related frameworks. In his latest article, JD Burke explains how the flaw works and how to find and prioritize exposure using Kiuwan. Read more: https://t.co/1V4nwx6UDJ https://t.co/cJuseqzqbR

    @Kiuwan

    8 Jan 2026

    3 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  46. Hackers Launched 8.1 Million React2Shell Attack Sessions Vulnerability The React2Shell vulnerability (CVE-2025-55182) continues to face a relentless exploitation campaign.... #CyberSecurityNews #Attack #CVE https://t.co/6YUDWbvrrE

    @HackersRadar

    8 Jan 2026

    0 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  47. A little late but I wrote an article about React2Shell (CVE-2025-55182), the critical RCE vulnerability that hit the React ecosystem last month. Deep dive into the POC, prototype pollution mechanics, and impact. https://t.co/crcW6MzyhG #ReactJS #React2Shell #WebSecurity

    @sunggatalimbet

    8 Jan 2026

    17 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  48. A little late but I wrote an article about React2Shell (CVE-2025-55182), the critical RCE vulnerability that hit the React ecosystem last month. Deep dive into the POC, prototype pollution mechanics, and impact. https://t.co/crcW6MzyhG #ReactJS #WebDevelopment #WebSecurity

    @sunggatalimbet

    8 Jan 2026

    114 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  49. React2Shell: IoT Nightmare Unleashed! CVE-2025-55182 allows attackers to take control of IoT devices and web servers with a single HTTP request due to flaws in React Server Components. Dive into its origins and explore hands-on exploits! https://t.co/PHPm37it5n @three_cube htt

    @DI0256

    8 Jan 2026

    5690 Impressions

    16 Retweets

    104 Likes

    39 Bookmarks

    0 Replies

    0 Quotes

  50. 🚨 React2Shell Under Heavy Fire: 8.1M+ Exploitation Sessions Hit CVE-2025-55182 GreyNoise telemetry shows sustained mass exploitation of React2Shell (CVE-2025-55182) with 8.1M+ attack sessions, ~300K–400K daily attempts, and infrastructure spread across 8,163 IPs / 1,071 ASNs

    @ThreatSynop

    8 Jan 2026

    47 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

Configurations