10

CVE-2025-55182

Warnung
Medienbericht
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Facebook ≫ React Version19.0.0
Facebook ≫ React Version19.1.0
Facebook ≫ React Version19.1.1
Facebook ≫ React Version19.2.0
Vercel ≫ Next.Js SwPlatformnode.js Version >= 15.0.0 < 15.0.5
Vercel ≫ Next.Js SwPlatformnode.js Version >= 15.1.0 < 15.1.9
Vercel ≫ Next.Js SwPlatformnode.js Version >= 15.2.0 < 15.2.6
Vercel ≫ Next.Js SwPlatformnode.js Version >= 15.3.0 < 15.3.6
Vercel ≫ Next.Js SwPlatformnode.js Version >= 15.4.0 < 15.4.8
Vercel ≫ Next.Js SwPlatformnode.js Version >= 15.5.0 < 15.5.7
Vercel ≫ Next.Js SwPlatformnode.js Version >= 16.0.0 < 16.0.7
Vercel ≫ Next.Js Version14.3.0 Updatecanary77 SwPlatformnode.js
Vercel ≫ Next.Js Version14.3.0 Updatecanary78 SwPlatformnode.js
Vercel ≫ Next.Js Version14.3.0 Updatecanary79 SwPlatformnode.js
Vercel ≫ Next.Js Version14.3.0 Updatecanary80 SwPlatformnode.js
Vercel ≫ Next.Js Version14.3.0 Updatecanary81 SwPlatformnode.js
Vercel ≫ Next.Js Version14.3.0 Updatecanary82 SwPlatformnode.js
Vercel ≫ Next.Js Version14.3.0 Updatecanary83 SwPlatformnode.js
Vercel ≫ Next.Js Version14.3.0 Updatecanary84 SwPlatformnode.js
Vercel ≫ Next.Js Version14.3.0 Updatecanary85 SwPlatformnode.js
Vercel ≫ Next.Js Version14.3.0 Updatecanary86 SwPlatformnode.js
Vercel ≫ Next.Js Version14.3.0 Updatecanary87 SwPlatformnode.js
Vercel ≫ Next.Js Version15.6.0 Update- SwPlatformnode.js
Vercel ≫ Next.Js Version15.6.0 Updatecanary0 SwPlatformnode.js
Vercel ≫ Next.Js Version15.6.0 Updatecanary1 SwPlatformnode.js
Vercel ≫ Next.Js Version15.6.0 Updatecanary10 SwPlatformnode.js
Vercel ≫ Next.Js Version15.6.0 Updatecanary11 SwPlatformnode.js
Vercel ≫ Next.Js Version15.6.0 Updatecanary12 SwPlatformnode.js
Vercel ≫ Next.Js Version15.6.0 Updatecanary13 SwPlatformnode.js
Vercel ≫ Next.Js Version15.6.0 Updatecanary14 SwPlatformnode.js
Vercel ≫ Next.Js Version15.6.0 Updatecanary15 SwPlatformnode.js
Vercel ≫ Next.Js Version15.6.0 Updatecanary16 SwPlatformnode.js
Vercel ≫ Next.Js Version15.6.0 Updatecanary17 SwPlatformnode.js
Vercel ≫ Next.Js Version15.6.0 Updatecanary18 SwPlatformnode.js
Vercel ≫ Next.Js Version15.6.0 Updatecanary19 SwPlatformnode.js
Vercel ≫ Next.Js Version15.6.0 Updatecanary2 SwPlatformnode.js
Vercel ≫ Next.Js Version15.6.0 Updatecanary20 SwPlatformnode.js
Vercel ≫ Next.Js Version15.6.0 Updatecanary21 SwPlatformnode.js
Vercel ≫ Next.Js Version15.6.0 Updatecanary22 SwPlatformnode.js
Vercel ≫ Next.Js Version15.6.0 Updatecanary23 SwPlatformnode.js
Vercel ≫ Next.Js Version15.6.0 Updatecanary24 SwPlatformnode.js
Vercel ≫ Next.Js Version15.6.0 Updatecanary25 SwPlatformnode.js
Vercel ≫ Next.Js Version15.6.0 Updatecanary26 SwPlatformnode.js
Vercel ≫ Next.Js Version15.6.0 Updatecanary27 SwPlatformnode.js
Vercel ≫ Next.Js Version15.6.0 Updatecanary28 SwPlatformnode.js
Vercel ≫ Next.Js Version15.6.0 Updatecanary29 SwPlatformnode.js
Vercel ≫ Next.Js Version15.6.0 Updatecanary3 SwPlatformnode.js
Vercel ≫ Next.Js Version15.6.0 Updatecanary30 SwPlatformnode.js
Vercel ≫ Next.Js Version15.6.0 Updatecanary31 SwPlatformnode.js
Vercel ≫ Next.Js Version15.6.0 Updatecanary32 SwPlatformnode.js
Vercel ≫ Next.Js Version15.6.0 Updatecanary33 SwPlatformnode.js
Vercel ≫ Next.Js Version15.6.0 Updatecanary34 SwPlatformnode.js
Vercel ≫ Next.Js Version15.6.0 Updatecanary35 SwPlatformnode.js
Vercel ≫ Next.Js Version15.6.0 Updatecanary36 SwPlatformnode.js
Vercel ≫ Next.Js Version15.6.0 Updatecanary37 SwPlatformnode.js
Vercel ≫ Next.Js Version15.6.0 Updatecanary38 SwPlatformnode.js
Vercel ≫ Next.Js Version15.6.0 Updatecanary39 SwPlatformnode.js
Vercel ≫ Next.Js Version15.6.0 Updatecanary4 SwPlatformnode.js
Vercel ≫ Next.Js Version15.6.0 Updatecanary40 SwPlatformnode.js
Vercel ≫ Next.Js Version15.6.0 Updatecanary41 SwPlatformnode.js
Vercel ≫ Next.Js Version15.6.0 Updatecanary42 SwPlatformnode.js
Vercel ≫ Next.Js Version15.6.0 Updatecanary43 SwPlatformnode.js
Vercel ≫ Next.Js Version15.6.0 Updatecanary44 SwPlatformnode.js
Vercel ≫ Next.Js Version15.6.0 Updatecanary45 SwPlatformnode.js
Vercel ≫ Next.Js Version15.6.0 Updatecanary46 SwPlatformnode.js
Vercel ≫ Next.Js Version15.6.0 Updatecanary47 SwPlatformnode.js
Vercel ≫ Next.Js Version15.6.0 Updatecanary48 SwPlatformnode.js
Vercel ≫ Next.Js Version15.6.0 Updatecanary49 SwPlatformnode.js
Vercel ≫ Next.Js Version15.6.0 Updatecanary5 SwPlatformnode.js
Vercel ≫ Next.Js Version15.6.0 Updatecanary50 SwPlatformnode.js
Vercel ≫ Next.Js Version15.6.0 Updatecanary51 SwPlatformnode.js
Vercel ≫ Next.Js Version15.6.0 Updatecanary52 SwPlatformnode.js
Vercel ≫ Next.Js Version15.6.0 Updatecanary53 SwPlatformnode.js
Vercel ≫ Next.Js Version15.6.0 Updatecanary54 SwPlatformnode.js
Vercel ≫ Next.Js Version15.6.0 Updatecanary55 SwPlatformnode.js
Vercel ≫ Next.Js Version15.6.0 Updatecanary56 SwPlatformnode.js
Vercel ≫ Next.Js Version15.6.0 Updatecanary57 SwPlatformnode.js
Vercel ≫ Next.Js Version15.6.0 Updatecanary6 SwPlatformnode.js
Vercel ≫ Next.Js Version15.6.0 Updatecanary7 SwPlatformnode.js
Vercel ≫ Next.Js Version15.6.0 Updatecanary8 SwPlatformnode.js
Vercel ≫ Next.Js Version15.6.0 Updatecanary9 SwPlatformnode.js
Vercel ≫ Next.Js Version16.0.0 Update- SwPlatformnode.js

05.12.2025: CISA Known Exploited Vulnerabilities (KEV) Catalog

Meta React Server Components Remote Code Execution Vulnerability

Schwachstelle

Meta React Server Components contains a remote code execution vulnerability that could allow unauthenticated remote code execution by exploiting a flaw in how React decodes payloads sent to React Server Function endpoints.

Beschreibung

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Erforderliche Maßnahmen
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 99.56% 0.999
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
cve-assign@fb.com 10 3.9 6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CWE-502 Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Für Zugriff zu Vulnerability Intelligence ist ein VulnDex Zugang erforderlich.
VulnDex Intel
Media Report
02.07.2026 10:14
Für Zugriff zu Vulnerability Intelligence ist ein VulnDex Zugang erforderlich.
VulnDex Intel
Media Report
01.07.2026 23:14
Für Zugriff zu Vulnerability Intelligence ist ein VulnDex Zugang erforderlich.
VulnDex Intel
Media Report
01.07.2026 22:29
Für Zugriff zu Vulnerability Intelligence ist ein VulnDex Zugang erforderlich.
VulnDex Intel
Media Report
26.06.2026 21:08
Für Zugriff zu Vulnerability Intelligence ist ein VulnDex Zugang erforderlich.
VulnDex Intel
Media Report
07.05.2026 20:40
Für Zugriff zu Vulnerability Intelligence ist ein VulnDex Zugang erforderlich.
VulnDex Intel
Media Report
07.05.2026 20:40
Für Zugriff zu Vulnerability Intelligence ist ein VulnDex Zugang erforderlich.
VulnDex Intel
Media Report
01.05.2026 16:59
Für Zugriff zu Vulnerability Intelligence ist ein VulnDex Zugang erforderlich.
VulnDex Intel
Media Report
10.04.2026 15:19
Für Zugriff zu Vulnerability Intelligence ist ein VulnDex Zugang erforderlich.
VulnDex Intel
Media Report
10.04.2026 15:19
Für Zugriff zu Vulnerability Intelligence ist ein VulnDex Zugang erforderlich.
VulnDex Intel
Media Report
10.04.2026 15:18
Für Zugriff zu Vulnerability Intelligence ist ein VulnDex Zugang erforderlich.
VulnDex Intel
Media Report
05.04.2026 16:50
Für Zugriff zu Vulnerability Intelligence ist ein VulnDex Zugang erforderlich.
VulnDex Intel
Media Report
17.03.2026 22:20
Für Zugriff zu Vulnerability Intelligence ist ein VulnDex Zugang erforderlich.
VulnDex Intel
Media Report
15.12.2025 09:32
Für Zugriff zu Vulnerability Intelligence ist ein VulnDex Zugang erforderlich.
VulnDex Intel
Media Report
05.12.2025 11:29
Für Zugriff zu Vulnerability Intelligence ist ein VulnDex Zugang erforderlich.
VulnDex Intel
Media Report
04.12.2025 10:44
https://www.facebook.com/security/advisories/cve-2025-55182
Vendor Advisory
https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components
Patch
Vendor Advisory
http://www.openwall.com/lists/oss-security/2025/12/03/4
Patch
Third Party Advisory
Mailing List
https://news.ycombinator.com/item?id=46136026
Issue Tracking
https://aws.amazon.com/blogs/security/china-nexus-cyber-threat-groups-rapidly-exploit-react2shell-vulnerability-cve-2025-55182/
Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-55182
US Government Resource