CVE-2025-55182

CVE-2025-55182 is a pre-authentication remote code execution vulnerability affecting React Server Components in versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0, including the packages react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The flaw arises from vulnerable code that unsafely deserializes payloads from HTTP requests sent to Server Function endpoints. Published on 2025-12-03, it carries a CVSS v3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) and maps to CWE-502 (Deserialization of Untrusted Data).

Unauthenticated remote attackers can exploit this vulnerability by crafting and sending malicious HTTP requests to exposed Server Function endpoints, triggering deserialization and achieving arbitrary remote code execution on the affected server. The attack requires no privileges, user interaction, or special access, with low complexity and network accessibility enabling broad exploitation potential, including full confidentiality, integrity, and availability impacts due to the changed scope.

Advisories from React at https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components and Facebook at https://www.facebook.com/security/advisories/cve-2025-55182 outline mitigations and patches. Further technical discussion appears on the oss-security mailing list at http://www.openwall.com/lists/oss-security/2025/12/03/4 and Hacker News at https://news.ycombinator.com/item?id=46136026.

An AWS security blog notes rapid real-world exploitation by China-nexus cyber threat groups, dubbing the issue "react2shell" (https://aws.amazon.com/blogs/security/china-nexus-cyber-threat-groups-rapidly-exploit-react2shell-vulnerability-cve-2025-55182/).