All vulnerabilities
CVE-2025-55182GHSA-9qr9-h5gf-34mp

Meta React Server Components Remote Code Execution Vulnerability

Meta React Server ComponentsnpmFrameworks
Open in ThreatlineRecord JSON
CVSS
10.0Critical
ExploitationExploited in the wildAdded to KEV 5 Dec 2025. Known ransomware useCISA KEV
Exploit odds (EPSS)99.8%Chance of exploitation activity in the next 30 days, higher than 99.9% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in15.6.0-canary.58Also 16.1.0-canary.12, 15.0.5 and 6 moreGitHub
Federal deadline12 Dec 2025Remediation due date for US federal agenciesCISA KEV
CISA required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. CISA KEV

What fixes it

  • 15.6.0-canary.58next, npmGitHubnpm install next@15.6.0-canary.58
  • 16.1.0-canary.12next, npmGitHubnpm install next@16.1.0-canary.12
  • 15.0.5next, npmOSVnpm install next@15.0.5
  • 15.1.9next, npmOSVnpm install next@15.1.9
  • 15.2.6next, npmOSVnpm install next@15.2.6
  • 15.3.6next, npmOSVnpm install next@15.3.6
Show all 9 fixed versions
  • 15.4.8next, npmOSVnpm install next@15.4.8
  • 15.5.7next, npmOSVnpm install next@15.5.7
  • 16.0.7next, npmOSVnpm install next@16.0.7

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Timeline

  1. 3 Dec 2025Exploit code publicMetasploit
  2. 3 Dec 2025, 15:40 UTCPublishedCVE List
  3. 5 Dec 2025Added to CISA KEVCISA KEV

Public exploit code and templates 3

  • Exploit moduleUnauthenticated RCE in React Server Components (React2Shell) 3 Dec 2025Metasploit
  • Webapps exploitReact Server 19.2.0 - Remote Code Execution 9 Apr 2026Exploit-DB
  • Scanner templateReact Server Components - Remote Code ExecutionNuclei

Listed so defenders can prioritize. Threatline links to the source and does not host exploit code.

Description

Meta React Server Components contains a remote code execution vulnerability that could allow unauthenticated remote code execution by exploiting a flaw in how React decodes payloads sent to React Server Function endpoints. Please note CVE-2025-66478 has been rejected, but it is associated with CVE-2025- 55182.

Text from CVE List

Affected versions 17

  • react-server-dom-webpackaffected: 19.0.0 through 19.0.0CVE List
  • react-server-dom-webpackaffected: 19.1.0 through 19.1.1CVE List
  • react-server-dom-webpackaffected: 19.2.0 through 19.2.0CVE List
  • react-server-dom-turbopackaffected: 19.0.0 through 19.0.0CVE List
  • react-server-dom-turbopackaffected: 19.1.0 through 19.1.1CVE List
  • react-server-dom-turbopackaffected: 19.2.0 through 19.2.0CVE List
  • react-server-dom-parcelaffected: 19.0.0 through 19.0.0CVE List
  • react-server-dom-parcelaffected: 19.1.0 through 19.1.1CVE List
  • react-server-dom-parcelaffected: 19.2.0 through 19.2.0CVE List
  • next, npm>=14.3.0-canary.77, >=15, >=16GitHub
  • next, npmfrom 14.3.0-canary.77, fixed in 15.0.5OSV
  • next, npmfrom 15.1.0-canary.0, fixed in 15.1.9OSV
  • next, npmfrom 15.2.0-canary.0, fixed in 15.2.6OSV
  • next, npmfrom 15.3.0-canary.0, fixed in 15.3.6OSV
  • next, npmfrom 15.4.0-canary.0, fixed in 15.4.8OSV
  • next, npmfrom 15.5.0-canary.0, fixed in 15.5.7OSV
  • next, npmfrom 16.0.0-canary.0, fixed in 16.0.7OSV

References 7