CVE-2025-55182

10.0

CRITICAL CVSS 3.1

Meta React Server Components Remote Code Execution Vulnerability - [Actively Exploited]

Description

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.

INFO

Published Date :

Dec. 3, 2025, 4:15 p.m.

Last Modified :

Dec. 6, 2025, 2 a.m.

Remotely Exploit :

No

Source :

[email protected]

CISA Notification

CISA KEV (Known Exploited Vulnerabilities)

For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild.

Due Date: Dec 12, 2025

Alert Date: Dec 05, 2025 | 92 days ago

Description :

Meta React Server Components contains a remote code execution vulnerability that could allow unauthenticated remote code execution by exploiting a flaw in how React decodes payloads sent to React Server Function endpoints. Please note CVE-2025-66478 has been rejected, but it is associated with CVE-2025- 55182.

Required Action :

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Known Ransomware Campaign Use:

Known Detected Feb 26, 2026

Notes :

Check for signs of potential compromise on all internet accessible REACT instances after applying mitigations. For more information, please see: https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components ; https://github.com/vercel-labs/fix-react2shell-next?tab=readme-ov-file ; https://nvd.nist.gov/vuln/detail/CVE-2025-55182

Affected Products

The following products are affected by CVE-2025-55182 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID	Vendor	Product	Action
1	Vercel	next.js
1	Facebook	react

: Total Affected Vendor : 2 | Products : 2

CVSS Scores

The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.

Version	Severity	Source
CVSS 3.1	CRITICAL	4fc57720-52fe-4431-a0fb-3d2c8747b827
CVSS 3.1	CRITICAL	[email protected]
CVSS 3.1	CRITICAL	MITRE-CVE

Solution

Update React Server Components to a patched version to fix unsafe deserialization.

Update React Server Components to a secure version.
Remove vulnerable packages like react-server-dom-parcel.
Apply security patches for affected packages.
Validate server function endpoint security.

Public PoC/Exploit Available at Github

CVE-2025-55182 has a 970 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2025-55182.

URL	Resource
https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components	PatchVendor Advisory
https://www.facebook.com/security/advisories/cve-2025-55182	Vendor Advisory
http://www.openwall.com/lists/oss-security/2025/12/03/4	Mailing ListPatchThird Party Advisory
https://news.ycombinator.com/item?id=46136026	Issue Tracking
https://aws.amazon.com/blogs/security/china-nexus-cyber-threat-groups-rapidly-exploit-react2shell-vulnerability-cve-2025-55182/	Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-55182	US Government Resource

CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2025-55182 is associated with the following CWEs:

CWE-502: Deserialization of Untrusted Data

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2025-55182 weaknesses.

CAPEC-586: Object Injection Object Injection

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

wnaspy/CVE-POC-WEAPON

Tập hợp bộ khai thác nhằm vào các tổ chức <(")

Shell Python

Updated: 17 hours, 43 minutes ago

0 stars 0 fork 0 watcher

Born at : March 6, 2026, 6:56 a.m. This repo has been linked 5 different CVEs too.

luoqichen/CVE-2025-55182-POC

None

Updated: 20 hours, 34 minutes ago

0 stars 0 fork 0 watcher

Born at : March 6, 2026, 4:33 a.m. This repo has been linked 1 different CVEs too.

ClementG91/Claude-NextJs-PentestKit

None

Python

Updated: 1 day, 11 hours ago

0 stars 0 fork 0 watcher

Born at : March 5, 2026, 2:16 p.m. This repo has been linked 3 different CVEs too.

gabrielbelli/ctfthmvalentine2026

None

Python

Updated: 2 days, 1 hour ago

0 stars 0 fork 0 watcher

Born at : March 4, 2026, 11:40 p.m. This repo has been linked 1 different CVEs too.

DeDnY/CVE-2025-55182-in-docker

CVE-2025-55182-in-docker

Dockerfile JavaScript

Updated: 3 days, 16 hours ago

0 stars 0 fork 0 watcher

Born at : March 3, 2026, 8:57 a.m. This repo has been linked 1 different CVEs too.

Voltiban/Voltiban

None

Updated: 3 days, 17 hours ago

0 stars 0 fork 0 watcher

Born at : March 3, 2026, 7:38 a.m. This repo has been linked 1 different CVEs too.

wargaintibumi/react2int-shell

None

Python

Updated: 3 days, 8 hours ago

0 stars 0 fork 0 watcher

Born at : March 3, 2026, 6:38 a.m. This repo has been linked 1 different CVEs too.

Ashu-Dhiman/pcap-detection-rules

This project demonstrates hands-on experience in writing and testing Snort IDS rules for detecting real-world network attacks. Currently includes custom rule development and will be expanded into a complete threat detection rule set for intrusion detection systems.

Updated: 4 days, 18 hours ago

0 stars 0 fork 0 watcher

Born at : March 2, 2026, 7:07 a.m. This repo has been linked 1 different CVEs too.

Hamza-El-Mourabit/csiachall1

None

Dockerfile TypeScript CSS Batchfile Shell Python JavaScript

Updated: 6 days, 1 hour ago

0 stars 0 fork 0 watcher

Born at : Feb. 28, 2026, 11:36 p.m. This repo has been linked 2 different CVEs too.

InferiorAK/CVE-2025-55182-React2Shell-Async-Scanner

Async RCE scanner for CVE-2025-55182 / CVE-2025-66478 — prototype-pollution → code execution via React Server Actions.

cve-2025-55182 cve-2025-66478 nextjs-rce-exploit rce react2shell react2shell-scanner

Python

Updated: 3 days, 11 hours ago

0 stars 0 fork 0 watcher

Born at : Feb. 28, 2026, 8:09 p.m. This repo has been linked 2 different CVEs too.

Ashu-Dhiman/LLM-Honeypot

Hands-on cybersecurity portfolio covering honeypot engineering, detection engineering, Wazuh-ELK pipelines, WordPress hardening and PCAP threat analysis.

Python CSS HTML JavaScript

Updated: 4 days, 18 hours ago

0 stars 0 fork 0 watcher

Born at : Feb. 27, 2026, 6:40 a.m. This repo has been linked 1 different CVEs too.

androidteacher/REACT-CVE-2025-55182-Lab

Lab with PoC

Dockerfile JavaScript CSS Python

Updated: 1 week, 1 day ago

0 stars 0 fork 0 watcher

Born at : Feb. 26, 2026, 5:23 p.m. This repo has been linked 1 different CVEs too.

MrMahile/MassScanning-CVE-2025-55182

A lightweight orchestrator and worker scanner setup for running large/continuous scans across split input files. This repository contains orchestration scripts, a Docker-based worker image, and helper scripts to run scans repeatedly and collect results.

Python Shell Dockerfile

Updated: 1 week, 1 day ago

0 stars 0 fork 0 watcher

Born at : Feb. 26, 2026, 4:57 p.m. This repo has been linked 1 different CVEs too.

revasec/CVE-2025-55182-Interactive-mode

None

Python

Updated: 1 week, 2 days ago

0 stars 0 fork 0 watcher

Born at : Feb. 25, 2026, 5:34 p.m. This repo has been linked 1 different CVEs too.

AndreiAvadanei/1day

None

Dockerfile Python CSS TypeScript JavaScript Shell

Updated: 1 week, 2 days ago

0 stars 0 fork 0 watcher

Born at : Feb. 25, 2026, 4:09 p.m. This repo has been linked 10 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2025-55182 vulnerability anywhere in the article.

Hackread - Cybersecurity News, Data Breaches, AI and More

900+ Certificates Used by Fortune 500, Governments Exposed by Key Leaks

A massive security gap has been brought to light by the research firm GitGuardian in partnership with Google. The study reveals that the private keys used to protect some of the world’s most important ...

Published Date: Mar 06, 2026 (8 hours, 32 minutes ago)

CybersecurityNews

Suspected DPRK Threat Actors Compromise Crypto Firms, Steal Keys and Cloud Assets in Coordinated Attacks

A coordinated campaign targeting cryptocurrency organizations has drawn attention from the security community, with evidence pointing to threat actors potentially linked to North Korea’s state-sponsor ...

Published Date: Mar 05, 2026 (1 day, 7 hours ago)

Daily CyberSecurity

Suspected North Korean Actors Target the Cryptocurrency Supply Chain

Web-app exploitation | Image: Ctrl-Alt-Intel Cybersecurity researchers at Ctrl-Alt-Intel have released a detailed investigation into a systematic campaign targeting the heart of the cryptocurrency ind ...

Published Date: Mar 05, 2026 (2 days, 1 hour ago)

The Cloudflare Blog

Introducing the 2026 Cloudflare Threat Report

Introducing the 2026 Cloudflare Threat Report2026-03-035 min readToday’s threat landscape is more varied and chilling than ever: Sophisticated nation-state actors. Hyper-volumetric DDoS attacks. Deepf ...

Published Date: Mar 03, 2026 (3 days, 11 hours ago)

Hackread - Cybersecurity News, Data Breaches, AI and More

Report Finds Just 1% of Security Flaws Drive Most Cyberattacks in 2025

While thousands of security flaws are reported every year, a new investigation has found that the vast majority are never actually used. Instead, a small group of “routinely targeted” flaws are doing ...

Published Date: Feb 26, 2026 (1 week, 1 day ago)

Daily CyberSecurity

The Three-Year Shadow: Critical CVSS 10 Cisco SD-WAN Zero-Day Exploited by UAT-8616

Cisco Talos has issued a high-alert warning regarding the active exploitation of CVE-2026-20127, a critical vulnerability affecting the Cisco Catalyst SD-WAN Controller. This CVSS 10 vulnerability all ...

Published Date: Feb 26, 2026 (1 week, 1 day ago)

Help Net Security

Edge systems take the brunt of internet-wide exploitation attempts

Internet-facing VPNs, routers, and remote access services absorbed sustained exploitation attempts throughout the second half of 2025, with nearly 3 billion malicious sessions recorded over 162 days. ...

Published Date: Feb 25, 2026 (1 week, 2 days ago)

Daily CyberSecurity

Machine-Speed Intrusions: How One Hacker Used DeepSeek and Claude to Scale a Global Campaign

A report by threat researcher @goyaramen reveals a sophisticated software pipeline that embeds Large Language Models (LLMs) directly into a malicious intrusion workflow, allowing a likely lone operato ...

Published Date: Feb 24, 2026 (1 week, 3 days ago)

The Hacker News

Wormable XMRig Campaign Uses BYOVD Exploit and Time-Based Logic Bomb

Cybersecurity researchers have disclosed details of a new cryptojacking campaign that uses pirated software bundles as lures to deploy a bespoke XMRig miner program on compromised hosts. "Analysis of ...

Published Date: Feb 23, 2026 (1 week, 4 days ago)

Daily CyberSecurity

The Rise of Vibecoding: AI-Generated Malware Exploits React2Shell

A new class of cyberattack has been caught in the wild, one where the code isn’t written by a human hand, but generated entirely by artificial intelligence. Darktrace has released a report detailing a ...

Published Date: Feb 12, 2026 (3 weeks, 2 days ago)

CybersecurityNews

ILOVEPOOP Toolkit Exploiting React2Shell Vulnerability to Deploy Malicious Payload

The cybersecurity sector has been impacted by the sudden appearance of “React2Shell” (CVE-2025-55182), a critical vulnerability affecting Next.js and React Server Components. Following its public disc ...

Published Date: Feb 10, 2026 (3 weeks, 3 days ago)

The Hacker News

TeamPCP Worm Exploits Cloud Infrastructure to Build Criminal Infrastructure

Cybersecurity researchers have called attention to a "massive campaign" that has systematically targeted cloud native environments to set up malicious infrastructure for follow-on exploitation. The ac ...

Published Date: Feb 09, 2026 (3 weeks, 4 days ago)

Hackread - Cybersecurity News, Data Breaches, AI and More

17% of 3rd-Party Add-Ons for OpenClaw Used in Crypto Theft and macOS Malware

Bitdefender Labs reveals that 17% of OpenClaw AI skills analyzed in February 2026 are malicious. With over 160,000 stars on GitHub, OpenClaw is being exploited to steal crypto keys and install macOS m ...

Published Date: Feb 06, 2026 (1 month ago)

The Hacker News

Hackers Exploit React2Shell to Hijack Web Traffic via Compromised NGINX Servers

Cybersecurity researchers have disclosed details of an active web traffic hijacking campaign that has targeted NGINX installations and management panels like Baota (BT) in an attempt to route it throu ...

Published Date: Feb 05, 2026 (1 month ago)

CybersecurityNews

Chrome Vulnerabilities Let Attackers Execute Arbitrary Code and Crash System

Chrome Vulnerabilities Arbitrary Code Google has released a critical security update for the Chrome Stable channel, addressing two high-severity vulnerabilities that expose users to potential arbitrar ...