CVE record
CVE-2025-55182
Meta React Server Components Remote Code Execution Vulnerability
Meta React Server Components contains a remote code execution vulnerability that could allow unauthenticated remote code execution by exploiting a flaw in how React decodes payloads sent to React Server Function endpoints. Please note CVE-2025-66478 has been rejected, but it is associated with CVE-2025- 55182.
CVE evidence
Known exploitation
Listed in CISA KEV
Absence from the fetched catalog does not establish that exploitation has not occurred.
Severity
critical
CVSS 10.0 · CVSS_V3
Affected packages
3
Supported package records returned by OSV. Vendor and product names are not used to infer matches.
CISA Known Exploited Vulnerabilities
Catalog record
- Vendor / project
- Meta
- Product
- React Server Components
- Date added
- Dec 5, 2025
- CISA federal remediation due date
- Dec 12, 2025
- Required action
- Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known ransomware campaign use
- Known
- CWE
- Not supplied
OSV package mapping
Affected open-source packages
| Package | Ecosystem | Fixed versions |
|---|---|---|
| react-server-dom-webpack | npm | 19.0.1, 19.1.2, 19.2.1 |
| react-server-dom-turbopack | npm | 19.0.1, 19.1.2, 19.2.1 |
| react-server-dom-parcel | npm | 19.0.1, 19.1.2, 19.2.1 |