CVE-2025-55182

This vulnerability lets an attacker send specially crafted network requests to your server’s React Server Components “server function” endpoints. If your app is running one of the affected React Server Components versions, that attacker can cause your server to execute code of their choice. In plain terms, it’s like leaving a door unlocked that allows someone to not just enter, but also run commands as if they were inside your business systems.

This matters if you run applications built on React Server Components and you use react-server-dom-parcel, react-server-dom-turbopack, or react-server-dom-webpack versions 19.0.0, 19.1.0, 19.1.1, or 19.2.0. It is a pre-authentication remote code execution issue, meaning the attacker does not need to log in first, and no user action is required.
Reachability depends on whether your application is using those vulnerable React Server Components versions and is processing HTTP requests to Server Function endpoints that deserialize payloads.

This is RED because it’s already listed in CISA KEV and has been used in ransomware campaigns, and it allows pre-authentication remote code execution. Attackers can target exposed Server Function endpoints over the network without needing any credentials. Patch planning should be treated as urgent, with immediate action to identify and upgrade affected deployments.

1. Identify exposure in your codebase and deployed environments

• Inventory your application’s dependencies and confirm whether you are using React Server Components (RSC) and the relevant packages: react-server-dom-parcel, react-server-dom-turbopack, react-server-dom-webpack.
• Check whether the installed versions are exactly 19.0.0, 19.1.0, 19.1.1, or 19.2.0.
• For Next.js, confirm whether your Next.js version depends on these packages and whether your build output includes the vulnerable RSC components (the provided fix includes a Next.js fix in 15.0.5).

2. Upgrade to the fixed versions (primary remediation)

• Update react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack to fixed releases:
  • Fixed in 19.0.1, and also fixed in 19.1.2 and 19.2.1 depending on your version line.
• If you are using next.js, apply the Next.js fix: next.js fixed in 15.0.5.
• Follow the React security blog and vendor guidance during upgrade to ensure compatibility with your build/runtime setup.

3. Validate that the vulnerable endpoints are no longer processing unsafe payloads

• After deployment, exercise the “Server Function endpoints” that handle Server Function payloads (for example, endpoints used by your app’s Server Components/Server Actions flow) to confirm they behave normally.
• Ensure your deployment pipeline is pulling the updated packages from trusted sources.

4. If you cannot patch immediately

• Apply the mitigations described by the vendor (React security blog) and implement any recommended compensating controls for your hosting environment until the upgrade completes.
• If your architecture allows it, reduce exposure by restricting network access to the relevant endpoints while you patch (the findings emphasize remote, pre-authentication reachability).

5. Watch for ongoing attempts

• Monitor web server/application logs for anomalous requests targeting Server Function endpoints.
• Review for indicators of compromise (unexpected processes, new cron jobs, unusual outbound connections) because this class of issue enables full code execution when exploited.

6. KEV timeline

• This issue is in CISA KEV with a remediation due date of 2025-12-12.

Severity is effectively critical: remote, pre-authentication remote code execution with no user interaction. The underlying weakness is unsafe deserialization of payloads received over HTTP to React Server Components Server Function endpoints (CWE-502).

Exploitation status: Confirmed real-world exploitation is indicated by inclusion in CISA KEV and KEV “used in ransomware campaigns,” which takes precedence over predictions.

Attack vector: An attacker sends crafted requests to Server Function endpoints that trigger the vulnerable deserialization path; no authentication is required and no victim interaction is needed.

Maturity/exploitability: A public proof-of-concept exists (4 known), indicating weaponization; exploit maturity is therefore high.

EPSS: A very high predicted likelihood is reported, but because KEV confirms real-world exploitation, it should not be used as the primary basis for public urgency.

KEV meaning here: inclusion in CISA KEV means known exploitation has been observed and defenders are expected to remediate on an accelerated timeline.