Critical· 10actively exploitedofficial fix available

CVE-2025-55182

A critical vulnerability allows attackers to run arbitrary code on a server before authentication by sending specially crafted data to React Server Components. The flaw exists in specific React Server Components versions and related packages. It can be exploited remotely without any user interaction.

publishedDec 3, 2025

last modifiedAug 4, 2026

sourcesNVD · CISA-KEV

severity · cvss

critical · how bad it is

exploitation · epss

100%

100th percentile · chance of exploitation in 30 days

(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →

auto-deletes from the system

counting…on Sep 3, 2026

An official fix is available, so this entry is kept for 30 days and then removed automatically.

Who is affected

React Server Components 19.0.0, 19.1.0, 19.1.1, 19.2.0 and related packages (react-server-dom-parcel, react-server-dom-turbopack, react-server-dom-webpack), as well as Vercel Next.js (including version 14.3.0).

Real-world impact

An attacker could execute arbitrary code on the server, potentially taking full control, stealing data, or disrupting services.

Why this severity

The CVSS score of 10 reflects that the vulnerability can be exploited remotely with no authentication, no user interaction, and gives the attacker full control over the system.

What to do about it

official fix available

recommended steps

01Update React Server Components to a patched version or apply the vendor's mitigation guidance.

CISA KEV required action

Timeline

Dec 3, 2025 · Dec 3, 2025
Published
Disclosed and added to the National Vulnerability Database.
Dec 5, 2025 · Dec 5, 2025
Confirmed exploited (CISA KEV)
CISA added it to the Known Exploited Vulnerabilities catalog — attackers are using it in the wild.
Dec 12, 2025 · Dec 12, 2025
CISA remediation deadline
Federal agencies are required to remediate by this date.
Aug 4, 2026 · 1d ago
Advisory updated
The NVD record was last revised.
Aug 4, 2026 · 1d ago
Official fix available
A vendor patch or mitigation now exists — see the remediation steps above.

How it’s attacked

Attack vectorNetwork (remote)

Attack complexityLow

Privileges requiredNone

User interactionNone needed

ScopeChanged

Confidentiality impactHigh

Integrity impactHigh

Availability impactHigh

References & advisories

react.dev/blog/2025/12/03/critical-se…patchvendor advisory
facebook.com/security/advisories/cve-202…vendor advisory
openwall.com/lists/oss-security/2025/12/…mailing listpatchthird party advisory
news.ycombinator.com/itemissue tracking
aws.amazon.com/blogs/security/china-nexus-…third party advisory
cisa.gov/known-exploited-vulnerabili…us government resource

NVD advisory ↗CISA KEV catalog ↗Search advisories ↗

(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →