{"schema":"threatline.record/2","record":{"id":"CVE-2025-55182","aliases":["GHSA-9qr9-h5gf-34mp"],"summary":"Meta React Server Components Remote Code Execution Vulnerability","details":"Meta React Server Components contains a remote code execution vulnerability that could allow unauthenticated remote code execution by exploiting a flaw in how React decodes payloads sent to React Server Function endpoints. Please note CVE-2025-66478 has been rejected, but it is associated with CVE-2025- 55182.","categories":["Frameworks"],"product":"React Server Components","vendor":"Meta","ecosystem":"npm","affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-55182","source_modified_at":"2026-10-07T17:58:00.859Z","fetched_at":"2026-10-23T18:42:43.628194Z","product":"react-server-dom-webpack","vendor":"Meta","versions":[{"lessThanOrEqual":"19.0.0","status":"affected","version":"19.0.0","versionType":"semver"},{"lessThanOrEqual":"19.1.1","status":"affected","version":"19.1.0","versionType":"semver"},{"lessThanOrEqual":"19.2.0","status":"affected","version":"19.2.0","versionType":"semver"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-55182","source_modified_at":"2026-10-07T17:58:00.859Z","fetched_at":"2026-10-23T18:42:43.628194Z","product":"react-server-dom-turbopack","vendor":"Meta","versions":[{"lessThanOrEqual":"19.0.0","status":"affected","version":"19.0.0","versionType":"semver"},{"lessThanOrEqual":"19.1.1","status":"affected","version":"19.1.0","versionType":"semver"},{"lessThanOrEqual":"19.2.0","status":"affected","version":"19.2.0","versionType":"semver"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-55182","source_modified_at":"2026-10-07T17:58:00.859Z","fetched_at":"2026-10-23T18:42:43.628194Z","product":"react-server-dom-parcel","vendor":"Meta","versions":[{"lessThanOrEqual":"19.0.0","status":"affected","version":"19.0.0","versionType":"semver"},{"lessThanOrEqual":"19.1.1","status":"affected","version":"19.1.0","versionType":"semver"},{"lessThanOrEqual":"19.2.0","status":"affected","version":"19.2.0","versionType":"semver"}],"defaultStatus":"unaffected"},{"source":"GitHub Advisory Database","source_url":"https://github.com/vercel/next.js/security/advisories/GHSA-9qr9-h5gf-34mp","source_modified_at":"2025-12-17T16:42:23Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"next"},"range":">=14.3.0-canary.77, >=15, >=16"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-9qr9-h5gf-34mp","source_modified_at":"2026-09-10T03:50:31.796397588Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"next","ecosystem":"npm","purl":"pkg:npm/next"},"ranges":[{"type":"SEMVER","events":[{"introduced":"14.3.0-canary.77"},{"fixed":"15.0.5"}]}],"versions":[]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-9qr9-h5gf-34mp","source_modified_at":"2026-09-10T03:50:31.796397588Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"next","ecosystem":"npm","purl":"pkg:npm/next"},"ranges":[{"type":"SEMVER","events":[{"introduced":"15.1.0-canary.0"},{"fixed":"15.1.9"}]}],"versions":[]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-9qr9-h5gf-34mp","source_modified_at":"2026-09-10T03:50:31.796397588Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"next","ecosystem":"npm","purl":"pkg:npm/next"},"ranges":[{"type":"SEMVER","events":[{"introduced":"15.2.0-canary.0"},{"fixed":"15.2.6"}]}],"versions":[]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-9qr9-h5gf-34mp","source_modified_at":"2026-09-10T03:50:31.796397588Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"next","ecosystem":"npm","purl":"pkg:npm/next"},"ranges":[{"type":"SEMVER","events":[{"introduced":"15.3.0-canary.0"},{"fixed":"15.3.6"}]}],"versions":[]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-9qr9-h5gf-34mp","source_modified_at":"2026-09-10T03:50:31.796397588Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"next","ecosystem":"npm","purl":"pkg:npm/next"},"ranges":[{"type":"SEMVER","events":[{"introduced":"15.4.0-canary.0"},{"fixed":"15.4.8"}]}],"versions":[]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-9qr9-h5gf-34mp","source_modified_at":"2026-09-10T03:50:31.796397588Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"next","ecosystem":"npm","purl":"pkg:npm/next"},"ranges":[{"type":"SEMVER","events":[{"introduced":"15.5.0-canary.0"},{"fixed":"15.5.7"}]}],"versions":[]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-9qr9-h5gf-34mp","source_modified_at":"2026-09-10T03:50:31.796397588Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"next","ecosystem":"npm","purl":"pkg:npm/next"},"ranges":[{"type":"SEMVER","events":[{"introduced":"16.0.0-canary.0"},{"fixed":"16.0.7"}]}],"versions":[]}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/vercel/next.js/security/advisories/GHSA-9qr9-h5gf-34mp","source_modified_at":"2025-12-17T16:42:23Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"next"},"version":"15.6.0-canary.58"},{"source":"GitHub Advisory Database","source_url":"https://github.com/vercel/next.js/security/advisories/GHSA-9qr9-h5gf-34mp","source_modified_at":"2025-12-17T16:42:23Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"next"},"version":"16.1.0-canary.12"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-9qr9-h5gf-34mp","source_modified_at":"2026-09-10T03:50:31.796397588Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"next","ecosystem":"npm","purl":"pkg:npm/next"},"version":"15.0.5"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-9qr9-h5gf-34mp","source_modified_at":"2026-09-10T03:50:31.796397588Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"next","ecosystem":"npm","purl":"pkg:npm/next"},"version":"15.1.9"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-9qr9-h5gf-34mp","source_modified_at":"2026-09-10T03:50:31.796397588Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"next","ecosystem":"npm","purl":"pkg:npm/next"},"version":"15.2.6"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-9qr9-h5gf-34mp","source_modified_at":"2026-09-10T03:50:31.796397588Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"next","ecosystem":"npm","purl":"pkg:npm/next"},"version":"15.3.6"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-9qr9-h5gf-34mp","source_modified_at":"2026-09-10T03:50:31.796397588Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"next","ecosystem":"npm","purl":"pkg:npm/next"},"version":"15.4.8"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-9qr9-h5gf-34mp","source_modified_at":"2026-09-10T03:50:31.796397588Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"next","ecosystem":"npm","purl":"pkg:npm/next"},"version":"15.5.7"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-9qr9-h5gf-34mp","source_modified_at":"2026-09-10T03:50:31.796397588Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"next","ecosystem":"npm","purl":"pkg:npm/next"},"version":"16.0.7"}],"cvss":10,"severity":"Critical","kev":{"listed":true,"date_added":"2025-12-05","due_date":"2025-12-12","required_action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomware_campaign_use":"Known"},"epss":{"probability":0.99802,"percentile":0.99958,"score_date":"2026-10-23"},"published_at":"2025-12-03T15:40:56.894Z","modified_at":"2026-10-07T17:58:00.859Z","provenance":[{"source":"CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23T17:00:09.9001Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2025-55182","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-07T17:58:00.859Z"},{"source":"GitHub Advisory Database","url":"https://github.com/vercel/next.js/security/advisories/GHSA-9qr9-h5gf-34mp","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2025-12-17T16:42:23Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-9qr9-h5gf-34mp","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-09-10T03:50:31.796397588Z"},{"source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/react2shell_unauth_rce_cve_2025_55182.rb","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2025-12-03"},{"source":"Exploit-DB","url":"https://www.exploit-db.com/exploits/52506","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-04-09"},{"source":"Nuclei","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-55182.yaml","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":null},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-55182","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CISA KEV","CVE List","GitHub Advisory Database","OSV","Metasploit","Exploit-DB","Nuclei","EPSS"],"references":[{"url":"https://github.com/vercel-labs/fix-react2shell-next?tab=readme-ov-file","source":"CISA KEV"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-55182","source":"CISA KEV"},{"source":"CVE List","url":"https://www.facebook.com/security/advisories/cve-2025-55182","tags":["x_refsource_CONFIRM"]},{"source":"CVE List","url":"https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components","tags":["x_refsource_CONFIRM"]},{"source":"CVE List","url":"https://aws.amazon.com/blogs/security/china-nexus-cyber-threat-groups-rapidly-exploit-react2shell-vulnerability-cve-2025-55182/","tags":["media-coverage"]},{"source":"CVE List","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-55182","tags":["government-resource"]},{"source":"CVE List","url":"https://news.ycombinator.com/item?id=46136026"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"active","automatable":"yes","technical_impact":"total","assessed_at":"2026-08-04T03:56:02.696515Z"},"exploits":[{"source":"Metasploit","kind":"Exploit module","name":"Unauthenticated RCE in React Server Components (React2Shell)","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/react2shell_unauth_rce_cve_2025_55182.rb","date":"2025-12-03","added":"2026-06-02","check":true},{"source":"Exploit-DB","kind":"Webapps exploit","name":"React Server 19.2.0 - Remote Code Execution","url":"https://www.exploit-db.com/exploits/52506","date":"2026-04-09","added":"2026-04-09","verified":false},{"source":"Nuclei","kind":"Scanner template","name":"React Server Components - Remote Code Execution","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-55182.yaml"}],"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-07T17:58:00.859Z","content_hash":"3278a8b8a655fc77edecdb14efc446843577612e8e8d6ce1e87c853cfe7b1ded"}}