# CVE-2025-55182: React Server Components are Vulnerable to RCE

> CVE-2025-55182 (GitHub advisory GHSA-fv66-9v8q-g76r) is a critical-severity vulnerability with a CVSS 3.1 base score of 10.0, classed as Deserialization of Untrusted Data (CWE-502), in react-server-dom-webpack (npm), react-server-dom-turbopack (npm) and react-server-dom-parcel (npm). It is fixed in 19.0.1, 19.1.2 or 19.2.1, depending on the release line. CISA lists it as a known exploited vulnerability (added 5 Dec 2025).

Canonical page: https://cveminer.com/vulnerabilities/CVE-2025-55182

| Field | Value |
| --- | --- |
| CVE | CVE-2025-55182 |
| GHSA | GHSA-fv66-9v8q-g76r |
| Severity | Critical |
| CVSS 3.1 | 10.0 `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H` (GitHub Advisory Database) |
| CWE | CWE-502 Deserialization of Untrusted Data |
| EPSS | 99.8% (higher than 99.9% of CVEs) |
| CISA KEV | Listed 5 Dec 2025, due 12 Dec 2025 |
| SSVC | exploitation active, automatable yes, technical impact total |
| Published | 3 Dec 2025 |
| Modified | 4 Aug 2026 |

## Description

##### Impact

There is an unauthenticated remote code execution vulnerability in React Server Components.

We recommend upgrading immediately.

The vulnerability is present in versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 of:
* [react-server-dom-webpack](https://www.npmjs.com/package/react-server-dom-webpack)
* [react-server-dom-parcel](https://www.npmjs.com/package/react-server-dom-parcel)
* [react-server-dom-turbopack](https://www.npmjs.com/package/react-server-dom-turbopack?activeTab=readme)

##### Patches

A fix was introduced in versions [19.0.1](https://github.com/facebook/react/releases/tag/v19.0.1), [19.1.2](https://github.com/facebook/react/releases/tag/v19.1.2), and [19.2.1](https://github.com/facebook/react/releases/tag/v19.2.1). If you are using any of the above packages please upgrade to any of the fixed versions immediately.

If your app’s React code does not use a server, your app is not affected by this vulnerability. If your app does not use a framework, bundler, or bundler plugin that supports React Server Components, your app is not affected by this vulnerability.

##### References

See the [blog post](https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components) for more information and upgrade instructions.

## Affected packages

| Package | Ecosystem | PURL | Vulnerable versions | Fixed in |
| --- | --- | --- | --- | --- |
| react-server-dom-webpack | npm | `pkg:npm/react-server-dom-webpack` | >= 19.1.0, < 19.1.2; = 19.2.0; = 19.0.0 | 19.0.1, 19.1.2, 19.2.1 |
| react-server-dom-turbopack | npm | `pkg:npm/react-server-dom-turbopack` | >= 19.1.0, < 19.1.2; = 19.2.0; = 19.0.0 | 19.0.1, 19.1.2, 19.2.1 |
| react-server-dom-parcel | npm | `pkg:npm/react-server-dom-parcel` | >= 19.1.0, < 19.1.2; = 19.2.0; = 19.0.0 | 19.0.1, 19.1.2, 19.2.1 |

## Fix commits

- Patch: https://github.com/facebook/react/commit/7dc903cd29dac55efb4424853fd0442fef3a8700
- Pull request: https://github.com/facebook/react/pull/35277

## Questions

**What is the GHSA ID for CVE-2025-55182?**

GitHub tracks CVE-2025-55182 as GHSA-fv66-9v8q-g76r.

**What is the CVSS score of CVE-2025-55182?**

CVE-2025-55182 has a CVSS 3.1 base score of 10.0 (Critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H.

**Which versions are affected by CVE-2025-55182?**

react-server-dom-webpack (npm): >= 19.1.0, < 19.1.2; = 19.2.0; = 19.0.0. react-server-dom-turbopack (npm): >= 19.1.0, < 19.1.2; = 19.2.0; = 19.0.0. react-server-dom-parcel (npm): >= 19.1.0, < 19.1.2; = 19.2.0; = 19.0.0.

**How do I fix CVE-2025-55182?**

Upgrade to 19.0.1, 19.1.2 or 19.2.1, depending on the release line. The fix is in commit 7dc903c and pull request #35277.

**What is the Package URL (PURL) for CVE-2025-55182?**

The affected packages' PURLs are pkg:npm/react-server-dom-webpack, pkg:npm/react-server-dom-turbopack and pkg:npm/react-server-dom-parcel.

**Is CVE-2025-55182 exploited in the wild?**

CISA lists it as a known exploited vulnerability (added 5 Dec 2025). CISA's SSVC assessment rates exploitation as "active". EPSS estimates a 99.8% chance of exploitation in the next 30 days, higher than 99.9% of CVEs.

## References

- https://github.com/facebook/react/pull/35277 (fix)
- https://github.com/facebook/react/commit/7dc903cd29dac55efb4424853fd0442fef3a8700 (fix)
- https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components (fix)
- http://www.openwall.com/lists/oss-security/2025/12/03/4 (fix)
- https://github.com/facebook/react/security/advisories/GHSA-fv66-9v8q-g76r (advisory)
- https://nvd.nist.gov/vuln/detail/CVE-2025-55182 (advisory)
- https://www.facebook.com/security/advisories/cve-2025-55182 (advisory)
- https://aws.amazon.com/blogs/security/china-nexus-cyber-threat-groups-rapidly-exploit-react2shell-vulnerability-cve-2025-55182/ (advisory)
- https://github.com/advisories/GHSA-fv66-9v8q-g76r (advisory)
- https://news.ycombinator.com/item?id=46136026 (report)
- https://github.com/ejpir/CVE-2025-55182-poc (evidence)
- https://github.com/facebook/react (package)
- https://github.com/facebook/react/releases/tag/v19.0.1
- https://github.com/facebook/react/releases/tag/v19.1.2
- https://github.com/facebook/react/releases/tag/v19.2.1
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-55182

---

Source: CVEminer (https://cveminer.com/vulnerabilities/CVE-2025-55182), compiled from OSV (GitHub advisory), GitHub Advisory Database, OSV (CVE record), CVE.org, CISA KEV catalog. OSV and GitHub Advisory Database content is licensed CC BY 4.0.