Skip to content
CVE IDCVE-2025-55182GitHub advisory IDGHSA-fv66-9v8q-g76r

React Server Components are Vulnerable to RCE

CVE-2025-55182 (GitHub advisory GHSA-fv66-9v8q-g76r) is a critical-severity vulnerability with a CVSS 3.1 base score of 10.0, classed as Deserialization of Untrusted Data (CWE-502), in react-server-dom-webpack (npm), react-server-dom-turbopack (npm) and react-server-dom-parcel (npm). It is fixed in 19.0.1, 19.1.2 or 19.2.1, depending on the release line. CISA lists it as a known exploited vulnerability (added 5 Dec 2025).

Critical10.0Known exploitedFix availableGitHub reviewed

Published 3 Dec 2025Updated 4 Aug 2026

10.0CriticalCVSS 3.1
CVE ID
CVE-2025-55182
GHSA ID
GHSA-fv66-9v8q-g76r
EPSS
99.8%higher than 99.9% of CVEs
Weakness (CWE)
  • CWE-502Deserialization of Untrusted Data
KEV status
Known exploitedAdded 5 Dec 2025
Published
3 Dec 2025
Updated
4 Aug 2026
Ecosystem
  • npm
Assigned by (CNA)
Meta

Summary

Source: OSV (GitHub advisory)

Impact

There is an unauthenticated remote code execution vulnerability in React Server Components.

We recommend upgrading immediately.

The vulnerability is present in versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 of:

Patches

A fix was introduced in versions 19.0.1, 19.1.2, and 19.2.1. If you are using any of the above packages please upgrade to any of the fixed versions immediately.

If your app’s React code does not use a server, your app is not affected by this vulnerability. If your app does not use a framework, bundler, or bundler plugin that supports React Server Components, your app is not affected by this vulnerability.

References

See the blog post for more information and upgrade instructions.

Technical details

Source: GitHub Advisory Database

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Critical10.0Base score from GitHub Advisory Database

Attack Vector AV
Network
Attack Complexity AC
Low
Privileges Required PR
None
User Interaction UI
None
Scope S
Changed
Confidentiality C
High
Integrity I
High
Availability A
High

CISA SSVC decision points

Exploitation
active
Exploited in the wild
Automatable
yes
Attackers can automate this at scale
Technical impact
total
Full control of the affected system

CISA Coordinator assessment (SSVC 2.0.3) via CVE.org.

CISA required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Federal agencies must remediate by 12 Dec 2025. Used in ransomware campaigns.

Affected packages

Source: OSV (GitHub advisory)

  • react-server-dom-webpack
    npm
    pkg:npm/react-server-dom-webpack
    Affected versions
    >= 19.1.0, < 19.1.2
    = 19.2.0
    = 19.0.0
    Fixed in
    19.0.1
    19.1.2
    19.2.1
    Show 2 listed versions
    • 19.0.0
    • 19.2.0
  • react-server-dom-turbopack
    npm
    pkg:npm/react-server-dom-turbopack
    Affected versions
    >= 19.1.0, < 19.1.2
    = 19.2.0
    = 19.0.0
    Fixed in
    19.0.1
    19.1.2
    19.2.1
    Show 2 listed versions
    • 19.0.0
    • 19.2.0
  • react-server-dom-parcel
    npm
    pkg:npm/react-server-dom-parcel
    Affected versions
    >= 19.1.0, < 19.1.2
    = 19.2.0
    = 19.0.0
    Fixed in
    19.0.1
    19.1.2
    19.2.1
    Show 2 listed versions
    • 19.0.0
    • 19.2.0

Fix

Source: OSV (GitHub advisory)

Fix available

  • react-server-dom-webpack: upgrade to 19.0.1, 19.1.2 or 19.2.1, depending on your release line
  • react-server-dom-turbopack: upgrade to 19.0.1, 19.1.2 or 19.2.1, depending on your release line
  • react-server-dom-parcel: upgrade to 19.0.1, 19.1.2 or 19.2.1, depending on your release line

Patch commits

  • 7dc903cPatch commitgithub.com/facebook/react

    Patch FlightReplyServer with fixes from ReactFlightClient (#35277)

    +712 −278 across 9 files

    • packages/react-server-dom-esm/src/server/ReactFlightDOMServerNode.js+23 −12
    • packages/react-server-dom-parcel/src/client/ReactFlightClientConfigBundlerParcel.js+6 −1
    • packages/react-server-dom-parcel/src/server/ReactFlightDOMServerNode.js+23 −12
    • packages/react-server-dom-turbopack/src/client/ReactFlightClientConfigBundlerTurbopack.js+6 −1
    • packages/react-server-dom-turbopack/src/server/ReactFlightDOMServerNode.js+23 −12
    • packages/react-server-dom-webpack/src/client/ReactFlightClientConfigBundlerNode.js+6 −1
    • packages/react-server-dom-webpack/src/client/ReactFlightClientConfigBundlerWebpack.js+6 −1
    • packages/react-server-dom-webpack/src/server/ReactFlightDOMServerNode.js+23 −12
    • and 1 more files
  • #35277Pull requestgithub.com/facebook/react

Vulnerability intelligence

References

Credits

Questions about CVE-2025-55182

What is the GHSA ID for CVE-2025-55182?
GitHub tracks CVE-2025-55182 as GHSA-fv66-9v8q-g76r.
What is the CVSS score of CVE-2025-55182?
CVE-2025-55182 has a CVSS 3.1 base score of 10.0 (Critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H.
Which versions are affected by CVE-2025-55182?
react-server-dom-webpack (npm): >= 19.1.0, < 19.1.2; = 19.2.0; = 19.0.0. react-server-dom-turbopack (npm): >= 19.1.0, < 19.1.2; = 19.2.0; = 19.0.0. react-server-dom-parcel (npm): >= 19.1.0, < 19.1.2; = 19.2.0; = 19.0.0.
How do I fix CVE-2025-55182?
Upgrade to 19.0.1, 19.1.2 or 19.2.1, depending on the release line. The fix is in commit 7dc903c and pull request #35277.
What is the Package URL (PURL) for CVE-2025-55182?
The affected packages' PURLs are pkg:npm/react-server-dom-webpack, pkg:npm/react-server-dom-turbopack and pkg:npm/react-server-dom-parcel.
Is CVE-2025-55182 exploited in the wild?
CISA lists it as a known exploited vulnerability (added 5 Dec 2025). CISA's SSVC assessment rates exploitation as "active". EPSS estimates a 99.8% chance of exploitation in the next 30 days, higher than 99.9% of CVEs.

Data sources

Upstream records

  • OSV (GitHub advisory)LoadedRaw JSON
  • GitHub Advisory DatabaseLoadedRaw JSON
  • OSV (CVE record)LoadedRaw JSON
  • CVE.orgLoaded
  • CISA KEV catalogLoaded

Fetched 1 day ago (15 Oct 2026, 04:37 UTC). Records refresh automatically after 24 hours.

Where each part of this page came from

Title and description
OSV (GitHub advisory)
Severity score
GitHub Advisory Database
Weakness (CWE)
GitHub Advisory Database
Affected packages
OSV (GitHub advisory)
Fix
OSV (GitHub advisory)
References
Computed by CVEminer
SSVC
CVE.org
KEV status
CISA KEV catalog
EPSS
GitHub Advisory Database

OSV and GitHub Advisory Database content is licensed CC BY 4.0. Values marked as computed or derived were calculated by CVEminer from the upstream data.