MSRXVulnerabilities / CVE-2025-55182
CVE-2025-55182
Published 2025-12-03 · published (not yet in NVD)
CVE-2025-55182
Exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2025-12-05, with a fix-by date of 2025-12-12. Patch it first.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
10.0 CRITICAL
CVSS 3.1 · CNA
CVSS 3.1 · CNA
100%
chance of exploitation in the next 30 days (EPSS; in the top 1% of all CVEs)
chance of exploitation in the next 30 days (EPSS; in the top 1% of all CVEs)
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.
Scores
Affected packages and fixed versions
| Package | Ecosystem | Fixed in |
|---|---|---|
| react-server-dom-webpack | npm | 19.0.1, 19.1.2, 19.2.1 |
| react-server-dom-turbopack | npm | 19.0.1, 19.1.2, 19.2.1 |
| react-server-dom-parcel | npm | 19.0.1, 19.1.2, 19.2.1 |
Affected products
- Meta react-server-dom-webpack: 19.0.0 to ≤ 19.0.0; 19.1.0 to ≤ 19.1.1; 19.2.0 to ≤ 19.2.0
- Meta react-server-dom-turbopack: 19.0.0 to ≤ 19.0.0; 19.1.0 to ≤ 19.1.1; 19.2.0 to ≤ 19.2.0
- Meta react-server-dom-parcel: 19.0.0 to ≤ 19.0.0; 19.1.0 to ≤ 19.1.1; 19.2.0 to ≤ 19.2.0
Also known as: GHSA-fv66-9v8q-g76r
2 references (advisories, patches, write-ups)
- https://www.facebook.com/security/advisories/cve-2025-55182 · x_refsource_CONFIRM
- https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components · x_refsource_CONFIRM
Sources: CVE.org, OSV.dev, FIRST EPSS. Missing ones did not answer or have no record yet.