10

CVE-2025-55182

Warnung
Medienbericht
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Facebook ≫ React Version 19.0.0
Facebook ≫ React Version 19.1.0
Facebook ≫ React Version 19.1.1
Facebook ≫ React Version 19.2.0
Vercel ≫ Next.Js SwPlatform node.js Version >= 15.0.0 < 15.0.5
Vercel ≫ Next.Js SwPlatform node.js Version >= 15.1.0 < 15.1.9
Vercel ≫ Next.Js SwPlatform node.js Version >= 15.2.0 < 15.2.6
Vercel ≫ Next.Js SwPlatform node.js Version >= 15.3.0 < 15.3.6
Vercel ≫ Next.Js SwPlatform node.js Version >= 15.4.0 < 15.4.8
Vercel ≫ Next.Js SwPlatform node.js Version >= 15.5.0 < 15.5.7
Vercel ≫ Next.Js SwPlatform node.js Version >= 16.0.0 < 16.0.7
Vercel ≫ Next.Js Version 14.3.0 Update canary77 SwPlatform node.js
Vercel ≫ Next.Js Version 14.3.0 Update canary78 SwPlatform node.js
Vercel ≫ Next.Js Version 14.3.0 Update canary79 SwPlatform node.js
Vercel ≫ Next.Js Version 14.3.0 Update canary80 SwPlatform node.js
Vercel ≫ Next.Js Version 14.3.0 Update canary81 SwPlatform node.js
Vercel ≫ Next.Js Version 14.3.0 Update canary82 SwPlatform node.js
Vercel ≫ Next.Js Version 14.3.0 Update canary83 SwPlatform node.js
Vercel ≫ Next.Js Version 14.3.0 Update canary84 SwPlatform node.js
Vercel ≫ Next.Js Version 14.3.0 Update canary85 SwPlatform node.js
Vercel ≫ Next.Js Version 14.3.0 Update canary86 SwPlatform node.js
Vercel ≫ Next.Js Version 14.3.0 Update canary87 SwPlatform node.js
Vercel ≫ Next.Js Version 15.6.0 Update - SwPlatform node.js
Vercel ≫ Next.Js Version 15.6.0 Update canary0 SwPlatform node.js
Vercel ≫ Next.Js Version 15.6.0 Update canary1 SwPlatform node.js
Vercel ≫ Next.Js Version 15.6.0 Update canary10 SwPlatform node.js
Vercel ≫ Next.Js Version 15.6.0 Update canary11 SwPlatform node.js
Vercel ≫ Next.Js Version 15.6.0 Update canary12 SwPlatform node.js
Vercel ≫ Next.Js Version 15.6.0 Update canary13 SwPlatform node.js
Vercel ≫ Next.Js Version 15.6.0 Update canary14 SwPlatform node.js
Vercel ≫ Next.Js Version 15.6.0 Update canary15 SwPlatform node.js
Vercel ≫ Next.Js Version 15.6.0 Update canary16 SwPlatform node.js
Vercel ≫ Next.Js Version 15.6.0 Update canary17 SwPlatform node.js
Vercel ≫ Next.Js Version 15.6.0 Update canary18 SwPlatform node.js
Vercel ≫ Next.Js Version 15.6.0 Update canary19 SwPlatform node.js
Vercel ≫ Next.Js Version 15.6.0 Update canary2 SwPlatform node.js
Vercel ≫ Next.Js Version 15.6.0 Update canary20 SwPlatform node.js
Vercel ≫ Next.Js Version 15.6.0 Update canary21 SwPlatform node.js
Vercel ≫ Next.Js Version 15.6.0 Update canary22 SwPlatform node.js
Vercel ≫ Next.Js Version 15.6.0 Update canary23 SwPlatform node.js
Vercel ≫ Next.Js Version 15.6.0 Update canary24 SwPlatform node.js
Vercel ≫ Next.Js Version 15.6.0 Update canary25 SwPlatform node.js
Vercel ≫ Next.Js Version 15.6.0 Update canary26 SwPlatform node.js
Vercel ≫ Next.Js Version 15.6.0 Update canary27 SwPlatform node.js
Vercel ≫ Next.Js Version 15.6.0 Update canary28 SwPlatform node.js
Vercel ≫ Next.Js Version 15.6.0 Update canary29 SwPlatform node.js
Vercel ≫ Next.Js Version 15.6.0 Update canary3 SwPlatform node.js
Vercel ≫ Next.Js Version 15.6.0 Update canary30 SwPlatform node.js
Vercel ≫ Next.Js Version 15.6.0 Update canary31 SwPlatform node.js
Vercel ≫ Next.Js Version 15.6.0 Update canary32 SwPlatform node.js
Vercel ≫ Next.Js Version 15.6.0 Update canary33 SwPlatform node.js
Vercel ≫ Next.Js Version 15.6.0 Update canary34 SwPlatform node.js
Vercel ≫ Next.Js Version 15.6.0 Update canary35 SwPlatform node.js
Vercel ≫ Next.Js Version 15.6.0 Update canary36 SwPlatform node.js
Vercel ≫ Next.Js Version 15.6.0 Update canary37 SwPlatform node.js
Vercel ≫ Next.Js Version 15.6.0 Update canary38 SwPlatform node.js
Vercel ≫ Next.Js Version 15.6.0 Update canary39 SwPlatform node.js
Vercel ≫ Next.Js Version 15.6.0 Update canary4 SwPlatform node.js
Vercel ≫ Next.Js Version 15.6.0 Update canary40 SwPlatform node.js
Vercel ≫ Next.Js Version 15.6.0 Update canary41 SwPlatform node.js
Vercel ≫ Next.Js Version 15.6.0 Update canary42 SwPlatform node.js
Vercel ≫ Next.Js Version 15.6.0 Update canary43 SwPlatform node.js
Vercel ≫ Next.Js Version 15.6.0 Update canary44 SwPlatform node.js
Vercel ≫ Next.Js Version 15.6.0 Update canary45 SwPlatform node.js
Vercel ≫ Next.Js Version 15.6.0 Update canary46 SwPlatform node.js
Vercel ≫ Next.Js Version 15.6.0 Update canary47 SwPlatform node.js
Vercel ≫ Next.Js Version 15.6.0 Update canary48 SwPlatform node.js
Vercel ≫ Next.Js Version 15.6.0 Update canary49 SwPlatform node.js
Vercel ≫ Next.Js Version 15.6.0 Update canary5 SwPlatform node.js
Vercel ≫ Next.Js Version 15.6.0 Update canary50 SwPlatform node.js
Vercel ≫ Next.Js Version 15.6.0 Update canary51 SwPlatform node.js
Vercel ≫ Next.Js Version 15.6.0 Update canary52 SwPlatform node.js
Vercel ≫ Next.Js Version 15.6.0 Update canary53 SwPlatform node.js
Vercel ≫ Next.Js Version 15.6.0 Update canary54 SwPlatform node.js
Vercel ≫ Next.Js Version 15.6.0 Update canary55 SwPlatform node.js
Vercel ≫ Next.Js Version 15.6.0 Update canary56 SwPlatform node.js
Vercel ≫ Next.Js Version 15.6.0 Update canary57 SwPlatform node.js
Vercel ≫ Next.Js Version 15.6.0 Update canary6 SwPlatform node.js
Vercel ≫ Next.Js Version 15.6.0 Update canary7 SwPlatform node.js
Vercel ≫ Next.Js Version 15.6.0 Update canary8 SwPlatform node.js
Vercel ≫ Next.Js Version 15.6.0 Update canary9 SwPlatform node.js
Vercel ≫ Next.Js Version 16.0.0 Update - SwPlatform node.js

05.12.2025: CISA Known Exploited Vulnerabilities (KEV) Catalog

Meta React Server Components Remote Code Execution Vulnerability

Schwachstelle

Meta React Server Components contains a remote code execution vulnerability that could allow unauthenticated remote code execution by exploiting a flaw in how React decodes payloads sent to React Server Function endpoints.

Beschreibung

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Erforderliche Maßnahmen
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 99.62% 0.999
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
Facebook 10 3.9 6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CWE-502 Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Für Zugriff zu Vulnerability Intelligence ist ein VulnDex Zugang erforderlich.
VulnDex Intel
Media Report
27.07.2026 23:22
Für Zugriff zu Vulnerability Intelligence ist ein VulnDex Zugang erforderlich.
VulnDex Intel
Media Report
02.07.2026 10:14
Für Zugriff zu Vulnerability Intelligence ist ein VulnDex Zugang erforderlich.
VulnDex Intel
Media Report
01.07.2026 23:14
Für Zugriff zu Vulnerability Intelligence ist ein VulnDex Zugang erforderlich.
VulnDex Intel
Media Report
01.07.2026 22:29
Für Zugriff zu Vulnerability Intelligence ist ein VulnDex Zugang erforderlich.
VulnDex Intel
Media Report
26.06.2026 21:08
Für Zugriff zu Vulnerability Intelligence ist ein VulnDex Zugang erforderlich.
VulnDex Intel
Media Report
07.05.2026 20:40
Für Zugriff zu Vulnerability Intelligence ist ein VulnDex Zugang erforderlich.
VulnDex Intel
Media Report
07.05.2026 20:40
Für Zugriff zu Vulnerability Intelligence ist ein VulnDex Zugang erforderlich.
VulnDex Intel
Media Report
01.05.2026 16:59
Für Zugriff zu Vulnerability Intelligence ist ein VulnDex Zugang erforderlich.
VulnDex Intel
Media Report
10.04.2026 15:19
Für Zugriff zu Vulnerability Intelligence ist ein VulnDex Zugang erforderlich.
VulnDex Intel
Media Report
10.04.2026 15:19
Für Zugriff zu Vulnerability Intelligence ist ein VulnDex Zugang erforderlich.
VulnDex Intel
Media Report
10.04.2026 15:18
Für Zugriff zu Vulnerability Intelligence ist ein VulnDex Zugang erforderlich.
VulnDex Intel
Media Report
05.04.2026 16:50
Für Zugriff zu Vulnerability Intelligence ist ein VulnDex Zugang erforderlich.
VulnDex Intel
Media Report
17.03.2026 22:20
Für Zugriff zu Vulnerability Intelligence ist ein VulnDex Zugang erforderlich.
VulnDex Intel
Media Report
15.12.2025 09:32
Für Zugriff zu Vulnerability Intelligence ist ein VulnDex Zugang erforderlich.
VulnDex Intel
Media Report
05.12.2025 11:29
Für Zugriff zu Vulnerability Intelligence ist ein VulnDex Zugang erforderlich.
VulnDex Intel
Media Report
04.12.2025 10:44
https://www.facebook.com/security/advisories/cve-2025-55182
Vendor Advisory
https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components
Patch
Vendor Advisory
http://www.openwall.com/lists/oss-security/2025/12/03/4
Patch
Third Party Advisory
Mailing List
https://news.ycombinator.com/item?id=46136026
Issue Tracking
https://aws.amazon.com/blogs/security/china-nexus-cyber-threat-groups-rapidly-exploit-react2shell-vulnerability-cve-2025-55182/
Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-55182
US Government Resource