CVE-2025-55182

CRITICALCVSS 10.0Known Exploited

CISA Known Exploited Vulnerability

Check for signs of potential compromise on all internet accessible REACT instances after applying mitigations. For more information, please see: https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components ; https://github.com/vercel-labs/fix-react2shell-next?tab=readme-ov-file ; https://nvd.nist.gov/vuln/detail/CVE-2025-55182

Remediation deadline: December 12, 2025

Ransomware use: Known

Description

Meta React Server Components contains a remote code execution vulnerability that could allow unauthenticated remote code execution by exploiting a flaw in how React decodes payloads sent to React Server Function endpoints. Please note CVE-2025-66478 has been rejected, but it is associated with CVE-2025- 55182.

Timeline

Published:December 3rd, 2025 4:15 PM

Last modified:August 4th, 2026 5:16 AM

Added to KEV:December 5th, 2025

CVSS Scoring

CVSS v3: 10.0 (CRITICAL)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Affected Software

From NVD CPE configuration data

Vendors

facebookvercel

Products

reactnext.js

Weaknesses (CWE)

CWE-502

References & Reports

Advisories, patches, and third-party reports

Source: NIST NVD · Data may lag official sources by up to one minute