Meta React Server Components Remote Code Execution Vulnerability (CVE-2025-55182)

What is affected, what to do

An attacker can perform remote code execution (RCE) without authentication by exploiting a deserialization flaw in React Server Components versions 19.0.0 to 19.2.0, affecting packages react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. This vulnerability is actively exploited in ransomware campaigns. Immediate updating to the latest version is critical to mitigate this risk.

The vulnerability is being actively exploited; treat it as a priority. CISA lists it as used in ransomware campaigns. Update next.js to version 15.0.5. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• Meta React-server-dom-webpack lte 19.0.0..19.0.0
• Meta React-server-dom-webpack lte 19.1.0..19.1.1
• Meta React-server-dom-webpack lte 19.2.0..19.2.0
• Meta React-server-dom-turbopack lte 19.0.0..19.0.0
• Meta React-server-dom-turbopack lte 19.1.0..19.1.1
• Meta React-server-dom-turbopack lte 19.2.0..19.2.0
• Meta React-server-dom-parcel lte 19.0.0..19.0.0
• Meta React-server-dom-parcel lte 19.1.0..19.1.1
• Meta React-server-dom-parcel lte 19.2.0..19.2.0

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Inventory dependencies: Search all repositories, container images and build artefacts for react-server-dom-webpack, react-server-dom-turbopack and react-server-dom-parcel at 19.0.0, 19.1.0, 19.1.1 or 19.2.0. Also search for next 15.0.0–15.0.5, 15.1.0–15.1.9, 15.2.0–15.2.6 and 15.3.0–15.3.6. Useful sources are npm ls react-server-dom-webpack next, SBOM queries and lockfile grep. Check other App Router-based Next.js lines against the vendor advisory.
   • Patch: Fixed releases are available from Meta/React and Vercel/Next.js. Look up the target version in each vendor advisory. Bump the lockfile, rebuild and redeploy. Updating source without rebuilding the image does not remove the vulnerable code.
   • Internet-facing first: Prioritise publicly reachable Next.js/RSC apps that use the App Router or Server Actions. If you cannot redeploy now, front the app with a WAF that has a rule for this CVE enabled, or take it offline temporarily.
   • Compromise assessment before patching: For any instance that was exposed and unpatched since early December 2025, preserve logs and the process tree. Hunt for the indicators below. Treat a positive hit as full host compromise.
   • Rotate secrets on suspicion: Rotate everything the Node.js process could read. That includes .env values, database credentials, API keys, cloud IAM role credentials reachable via the instance metadata service, and session/JWT signing keys.
2. 02

   Runbook step 2

   Mitigation layers

   • WAF/IPS: Inspect POST requests that carry a Next-Action header or RSC payloads (text/x-component, or multipart/form-data sent to server-function routes). Block bodies containing prototype references such as __proto__ or constructor:constructor, or RSC reference patterns such as "$@, "$1: or :then". Enable the CDN/WAF providers' managed rules for CVE-2025-55182 and switch them from log mode to block mode.
   • Segmentation and egress filtering: Restrict outbound traffic from Node.js app servers to an allowlist of the database, internal APIs and required SaaS endpoints. Block arbitrary internet egress and reverse-shell ports. Enforce IMDSv2 with a hop limit to protect 169.254.169.254.
   • Endpoint/container hardening: Run Node.js as an unprivileged user with readOnlyRootFilesystem. Drop capabilities and enable seccomp/AppArmor. Prefer distroless images without a shell so attackers cannot easily stage tooling.
   • IAM/least privilege: Scope the workload identity tightly. Grant no bucket write access, no iam:* and no Secrets Manager wildcards. Use database accounts without DDL or admin rights.
   • Configuration: Remove or disable unused Server Actions/Functions. Put internal Next.js admin UIs behind VPN/ZTNA only.
3. 03

   Runbook step 3

   Detection rules

   • EDR process ancestry: Alert on node or next-server spawning sh, bash, curl, wget, nc, python, base64 or chmod. Sigma shape: ParentImage|endswith: '/node' AND Image|endswith: ['/sh','/bash','/curl','/wget']. KQL: DeviceProcessEvents | where InitiatingProcessFileName =~ "node" and FileName in~ ("sh","bash","curl","wget","nc").
   • Linux auditd: Watch for execve events whose parent is the Node.js process. Rule: -a always,exit -F arch=b64 -S execve -F uid=<app-uid> -k rsc_exec. Any shell executed under the app user warrants investigation.
   • Web/reverse-proxy logs: Look for POSTs with a Next-Action header from unfamiliar sources, oversized multipart bodies, HTTP 500s following such POSTs, and sweeping scans across routes. SPL: index=web method=POST "Next-Action" | stats count by src_ip, uri | where count > 20.
   • Network telemetry (Zeek/Suricata): Flag first-seen outbound connections from app servers, metadata-endpoint access by Node processes, and DNS lookups for paste, tunnelling or mining services.
   • File and persistence artefacts: Watch for new executables in /tmp, /dev/shm or the app directory, and for edits to crontab or ~/.ssh/authorized_keys. Also flag shell processes reading .env (Sysmon for Linux EID 1/11).

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.

Source: certeu_advisory, CSA/SingCERT, pwn.watch, NVD (NIST), cvelistv5, OSV (Open Source Vulnerabilities), CISA KEV Catalog, CVE.org (MITRE)

Vendors and products

• Facebook Facebook React
• Meta React-server-dom-parcel
• Meta React-server-dom-turbopack
• Meta React-server-dom-webpack
• Vercel Vercel Next.js

Weakness classes (CWE)

• CWE-502Deserialization of Untrusted Data

  Base

  The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

  Entry at MITRE CWE-502

References & sources

• github.comfacebook/react/security/advisories/GHSA-fv66-9v8q-g76rweb
• NVD (NIST)NVD: CVE-2025-55182advisory, pwn-watch
• github.comfacebook/react/pull/35277web
• github.comfacebook/react/commit/7dc903cd29dac55efb4424853fd0442fef3a8700web
• github.comejpir/CVE-2025-55182-pocweb
• github.comfacebook/reactpackage
• github.comfacebook/react/releases/tag/v19.0.1web
• github.comfacebook/react/releases/tag/v19.1.2web
• github.comfacebook/react/releases/tag/v19.2.1web
• news.ycombinator.comitem?id=46136026web, Issue tracking
• react.devCritical Security Vulnerability in React Server Componentsweb, Patch, Vendor advisory, x_refsource_CONFIRM, pwn-watch
• facebook.comsecurity/advisories/cve-2025-55182web, Vendor advisory, x_refsource_CONFIRM
• openwall.comlists/oss-security/2025/12/03/4web, Mailing list, Patch, Third-party advisory
• aws.amazon.comChina-nexus cyber threat groups rapidly exploit React2Shellmedia-coverage, Third-party advisory, pwn-watch
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2025-55182government-resource, US government resource
• cert.atCERT.at: React2Shell - Angriffe gegen verwundbare Anwendungen auf von Basis React.JS und weiterer Frameworkscert-at
• cert.cyber.gouv.frANSSI / CERT-FR: CERTFR-2025-ALE-014 – [MàJ] Vulnérabilité dans React Server Components (clôturée 2026-02-12)cert-fr
• pwn.watchpwn.watch: React2Shell: CVSS 10 unauthenticated RCE in React Server Components and Next.jspwn-watch
• cloud.google.comMultiple Threat Actors Exploit React2Shell (CVE-2025-55182)pwn-watch
• unit42.paloaltonetworks.comExploitation of Critical Vulnerability in React Server Componentspwn-watch

Changes to this CVE

Who changed this CVE and when: NVD (analysis, affected products, CVSS), the CVE publisher (CNA) and additional providers such as CISA (ADP).

1. 08.10.2026NVD analysis modifiedNVD

2. 07.10.2026Record modifiedfb.com

   New references:

   • https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components
   • https://www.facebook.com/security/advisories/cve-2025-55182
   Show 6 original changes

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   Reference	added	—	https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components
   Reference	added	—	https://www.facebook.com/security/advisories/cve-2025-55182
   Reference	removed	https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components	—
   Reference	removed	https://www.facebook.com/security/advisories/cve-2025-55182	—
   Reference type	removed	https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components Types: Patch, Vendor Advisory	—
   Reference type	removed	https://www.facebook.com/security/advisories/cve-2025-55182 Types: Vendor Advisory	—

   Source identifier: cve-assign@fb.com

3. 07.10.2026Record modifiedCISA ADP

   CISA assessment (SSVC): exploitation: active, automatable: yes

   Weakness type: CWE-502

   New references:

   • https://aws.amazon.com/blogs/security/china-nexus-cyber-threat-groups-rapidly-exploit-react2shell-vulnerability-cve-2025-55182/
   • https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-55182
   Show 9 original changes

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   Weakness type (CWE)	added	—	CWE-502
   Reference	added	—	https://aws.amazon.com/blogs/security/china-nexus-cyber-threat-groups-rapidly-exploit-react2shell-vulnerability-cve-2025-55182/
   Reference	added	—	https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-55182
   Reference	removed	https://aws.amazon.com/blogs/security/china-nexus-cyber-threat-groups-rapidly-exploit-react2shell-vulnerability-cve-2025-55182/	—
   Reference	removed	https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-55182	—
   Reference type	removed	https://aws.amazon.com/blogs/security/china-nexus-cyber-threat-groups-rapidly-exploit-react2shell-vulnerability-cve-2025-55182/ Types: Third Party Advisory	—
   Reference type	removed	https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-55182 Types: US Government Resource	—
   SSVC assessment	removed	{"id":"CVE-2025-55182","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"yes"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2025-12-03T00:00:00+00:00"}	—
   SSVC assessment	added	—	{"id":"CVE-2025-55182","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"yes"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-08-04T03:56:02.696515Z"}

   Source identifier: 134c704f-9b21-4f2e-91b3-4a467353bcc0

4. 07.10.2026Record modifiedCVE Program

   New references:

   • http://www.openwall.com/lists/oss-security/2025/12/03/4
   • https://news.ycombinator.com/item?id=46136026
   Show 6 original changes

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   Reference	added	—	http://www.openwall.com/lists/oss-security/2025/12/03/4
   Reference	added	—	https://news.ycombinator.com/item?id=46136026
   Reference	removed	http://www.openwall.com/lists/oss-security/2025/12/03/4	—
   Reference	removed	https://news.ycombinator.com/item?id=46136026	—
   Reference type	removed	http://www.openwall.com/lists/oss-security/2025/12/03/4 Types: Mailing List, Patch, Third Party Advisory	—
   Reference type	removed	https://news.ycombinator.com/item?id=46136026 Types: Issue Tracking	—

   Source identifier: af854a3a-2127-422b-91ae-364da2661108

One NVD translation into another language is hidden.

Linked advisories

• Dysphoria: 296,000 IoT Devices Abused for DDoS and Residential ProxyingNEOSEC article18.08.2026
• Credential Harvesting Campaign Exploits React2ShellSANS NewsBites07.04.2026
• LexisNexis breach (FulcrumSec claims React2Shell path)pwn.watch24.02.2026