MSRXMSRXSecurity
Vulnerabilities / Next.js App Router (React Server Components)

Next.js App Router (React Server Components) vulnerabilities

1 Next.js App Router (React Server Components) flaw was confirmed exploited in the wild in the past 365 days, 1 used in ransomware. Patch these first.

AddedExploited vulnerabilityFix by
2025-12-05CVE-2025-55182 Meta React Server Components
ransomwareMeta React Server Components Remote Code Execution Vulnerability

Meta React Server Components contains a remote code execution vulnerability that could allow unauthenticated remote code execution by exploiting a flaw in how React decodes payloads sent to React Server Function endpoints. Please note CVE-2025-66478 has been rejected, but it is associated with CVE-2025- 55182.

2025-12-12
Scan a website for Next.js App Router (React Server Components)Check your dependenciesAll products

Source: CISA Known Exploited Vulnerabilities catalog 2026.10.28 (live), refreshed every 12 hours.