On 29 November, a serious security vulnerability was reported in React that enables unauthenticated remote code execution (RCE). The cause is a flaw in the deserialisation of payloads sent to React Server Function endpoints. Particularly critical: even apps without Server Functions may be affected, provided they support React Server Components (RSC).
What happened?
The issue was published as CVE-2025-55182. The following packages are affected react-server-dom-webpack, react-server-dom-parcel and react-server-dom-turbopack in versions 19.0, 19.1.0, 19.1.1 and 19.2.0.
The vulnerability has been rated CVSS 10.0, the highest possible severity level. An immediate update is essential. The issue has been fixed in versions 19.0.1, 19.1.2 and 19.2.1.
Numerous frameworks and bundlers are also affected, including Next.js, React Router (RSC APIs), Waku, @parcel/rsc, @vitejs/plugin-rsc and RedwoodSDK. Some hosting providers have implemented temporary mitigations, but these are no substitute for updating to the patched versions.
How does the vulnerability work?
An attacker can send specially crafted HTTP requests to a server function endpoint. When deserialised by React, this can result in arbitrary code being executed on the server. According to the manufacturer, further technical details will be published once the fixes have been fully rolled out. Further information can be found in the React team’s official blog post.
Recommended measures
- Immediate updates: Update to patched versions of the RSC libraries (19.0.1, 19.1.2 or 19.2.1).
- Framework updates: Install framework-specific updates, for example for Next.js 15/16, depending on the release line.
- Check for impact: Verify whether your app uses RSC or RSC compatibility within the bundler.
- Not affected: If no server is used, your app is not affected by this vulnerability.
Timeline
- 29 November: Report of a vulnerability submitted by Lachlan Davidson.
- 30 November: Confirmed by Meta Security.
- 1 December: Development and validation of the fix.
- 3 December: Publication of the fixes on npm and disclosure as CVE-2025-55182.
Mint Secure GmbH
How Mint Secure supports you
We help development teams and operators to quickly identify and patch critical vulnerabilities such as CVE-2025-55182.
Vulnerability Management
We help identify affected applications and prioritise the implementation of patches.
penetration test
We carry out targeted testing of your web applications for RCE and deserialisation vulnerabilities.
consulting
We support you in establishing a robust patching process for your web and framework dependencies.
Conclusion
CVE-2025-55182 is an unauthenticated RCE vulnerability in React Server Components, rated CVSS 10.0, which affects numerous packages and frameworks such as Next.js, Waku and RedwoodSDK.
Affected teams should update to the patched versions 19.0.1, 19.1.2 or 19.2.1 immediately; temporary mitigations provided by hosting providers are no substitute for a proper update.
Mint Secure can help you patch your web applications quickly and securely. Talk to us.
