Meta React Server Components Remote Code Execution Vulnerability
Meta — react-server-dom-webpack
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.
10.0
99.8%
Vector breakdown
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Changed
- Confidentiality
- High
- Integrity
- High
- Availability
- High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
- Published
- Dec 3, 2025
- Modified
- Oct 18, 2026
- Added to KEV
- Dec 5, 2025
- Federal patch due
- Dec 12, 2025
CISA required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Weakness classification
Affected packages
Proof-of-concept & exploitation references
8 foundWeaponization
Public repositories whose name or description references CVE-2025-55182, found via a live GitHub search at request time. These are community-sourced signals, not a verified working exploit - cross-check each one before relying on it, and treat higher star counts and recent activity as (weak) corroboration, not proof.
- assetnote/react2shell-scanner★ 2454
High Fidelity Detection Mechanism for RSC/Next.js RCE (CVE-2025-55182 & CVE-2025-66478)
updated Oct 19, 2026
- msanft/CVE-2025-55182★ 1431
Explanation and full RCE PoC for CVE-2025-55182
updated Oct 17, 2026
- lachlan2k/React2Shell-CVE-2025-55182-original-poc★ 1064
Original Proof-of-Concepts for React2Shell CVE-2025-55182
updated Oct 16, 2026
- ejpir/CVE-2025-55182-research★ 790
CVE-2025-55182 POC
updated Oct 13, 2026
- mrknow001/RSC_Detector★ 587
Supports RSC fingerprinting and exploitation of the React component vulnerability CVE-2025-55182.
updated Oct 12, 2026
- emredavut/CVE-2025-55182★ 313
RSC/Next.js RCE Vulnerability Detector & PoC Chrome Extension – CVE-2025-55182 & CVE-2025-66478
updated Oct 5, 2026
- zack0x01/CVE-2025-55182-advanced-scanner-★ 281
updated Oct 16, 2026
- ynsmroztas/NextRce★ 267
React Shell & Next.js RSC Exploit Tool (CVE-2025-55182)
updated Oct 19, 2026
References
How this class of flaw gets exploited
Frequently asked questions
What is CVE-2025-55182?
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.
How severe is CVE-2025-55182?
CVE-2025-55182 has a CVSS base score of 10.0 out of 10 (CVSS 3.1).
Is CVE-2025-55182 actively exploited in the wild?
Yes. CVE-2025-55182 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added Dec 5, 2025, meaning CISA has confirmed evidence of active exploitation. It is also flagged as used in ransomware campaigns.
What is the EPSS score for CVE-2025-55182?
99.8% - meaning FIRST.org's EPSS model estimates a 99.8% probability this vulnerability will be exploited in the wild within 30 days (100% percentile among all scored CVEs).
Is there exploit tooling available for CVE-2025-55182?
Yes - a public Nuclei template referencing CVE-2025-55182 exist in public repositories we checked. We also found 8 public GitHub repositories referencing this CVE.
What type of vulnerability is CVE-2025-55182?
CVE-2025-55182 is classified under CWE-502 (CWE-502 Deserialization of Untrusted Data).
Cross-checked against
Impactr finds and proves whether CVE-2025-55182 - or flaws like it - are actually reachable in your own web apps and APIs, with a reproducible exploit as evidence.
Join the waitlist