{"id":"EUVD-2025-200983","enisaUuid":"eb14558b-5fca-315c-afc9-27fac2c6315b","description":"A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.","datePublished":"Dec 3, 2025, 3:40:56 PM","dateUpdated":"Oct 7, 2026, 5:58:00 PM","baseScore":10.0,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","references":"https://www.facebook.com/security/advisories/cve-2025-55182\nhttps://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components\n","aliases":"CVE-2025-55182\nGHSA-fv66-9v8q-g76r\n","assigner":"Meta","epss":99.8,"exploitedSince":"Dec 5, 2025, 12:00:00 AM","enisaIdProduct":[{"id":"01ffc27a-13d1-3738-9331-3c08d36b1685","product":{"name":"react-server-dom-webpack","vendor":{"name":"Meta"}},"product_version":"19.1.0 ≤19.1.1"},{"id":"4a5e4cae-fa63-3b91-81c9-c941470ce4e2","product":{"name":"react-server-dom-webpack","vendor":{"name":"Meta"}},"product_version":"19.2.0 ≤19.2.0"},{"id":"5a51bbf8-03c2-331e-ab69-d50c14da08a8","product":{"name":"react-server-dom-webpack","vendor":{"name":"Meta"}},"product_version":"19.0.0 ≤19.0.0"},{"id":"5ec8bada-5cc4-3f82-abb0-5e740e8d3f77","product":{"name":"react-server-dom-parcel","vendor":{"name":"Meta"}},"product_version":"19.0.0 ≤19.0.0"},{"id":"66f20a26-b394-337b-831d-cd20f4bd6532","product":{"name":"react-server-dom-turbopack","vendor":{"name":"Meta"}},"product_version":"19.0.0 ≤19.0.0"},{"id":"9f7d7923-827d-3788-b6a3-e820642f0ced","product":{"name":"react-server-dom-parcel","vendor":{"name":"Meta"}},"product_version":"19.2.0 ≤19.2.0"},{"id":"d5c59f83-5fb0-3d3b-a240-0501007c9141","product":{"name":"react-server-dom-turbopack","vendor":{"name":"Meta"}},"product_version":"19.1.0 ≤19.1.1"},{"id":"ec436e61-c335-3cdc-b48f-ddd236236988","product":{"name":"react-server-dom-turbopack","vendor":{"name":"Meta"}},"product_version":"19.2.0 ≤19.2.0"},{"id":"fd694ef4-09df-3f0c-b645-b215161aabcc","product":{"name":"react-server-dom-parcel","vendor":{"name":"Meta"}},"product_version":"19.1.0 ≤19.1.1"}],"enisaIdVendor":[{"id":"bac051a9-3c69-3934-8fa8-6f6adf92a62b","vendor":{"name":"Meta"}}],"enisaIdVulnerability":[{"id":"c89ccd92-a8e6-336d-972c-3515a8253ff4","vulnerability":{"id":"GHSA-fv66-9v8q-g76r","description":"React Server Components are Vulnerable to RCE","datePublished":"Dec 3, 2025, 7:07:39 PM","dateUpdated":"Dec 9, 2025, 4:53:23 PM","baseScore":0.0,"references":"https://github.com/facebook/react/security/advisories/GHSA-fv66-9v8q-g76r\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-55182\nhttps://github.com/facebook/react/pull/35277\nhttps://github.com/facebook/react/commit/7dc903cd29dac55efb4424853fd0442fef3a8700\nhttps://github.com/ejpir/CVE-2025-55182-poc\nhttps://github.com/facebook/react\nhttps://github.com/facebook/react/releases/tag/v19.0.1\nhttps://github.com/facebook/react/releases/tag/v19.1.2\nhttps://github.com/facebook/react/releases/tag/v19.2.1\nhttps://news.ycombinator.com/item?id\u003d46136026\nhttps://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components\nhttps://www.facebook.com/security/advisories/cve-2025-55182\nhttp://www.openwall.com/lists/oss-security/2025/12/03/4\n","enisa_id":"EUVD-2025-200983\n","aliases":"CVE-2025-55182\nGHSA-fv66-9v8q-g76r\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:51:54 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"fb56bd39-839a-382c-ab0d-96f90bc9ffda","vulnerability":{"id":"CVE-2025-55182","description":"A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.","datePublished":"Dec 3, 2025, 3:40:56 PM","dateUpdated":"Oct 7, 2026, 5:58:00 PM","status":"PUBLISHED","baseScore":10.0,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","references":"https://www.facebook.com/security/advisories/cve-2025-55182\nhttps://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components\n","enisa_id":"EUVD-2025-200983\n","assigner":"Meta","epss":99.8,"dataProcessed":"Oct 29, 2026, 7:12:57 AM","exploitedSince":"Dec 5, 2025, 12:00:00 AM","vulnerabilityProduct":[{"id":"04bd87e3-72b1-38f6-80d5-6a53f4b56617","product":{"name":"react-server-dom-parcel","vendor":{"name":"Meta"}},"product_version":"19.1.0 ≤19.1.1"},{"id":"12d504bb-f20a-3ef3-b387-10cf32209d88","product":{"name":"react-server-dom-parcel","vendor":{"name":"Meta"}},"product_version":"19.2.0 ≤19.2.0"},{"id":"423ad9fe-962e-3068-83bd-cd2dbd92bbfe","product":{"name":"react-server-dom-turbopack","vendor":{"name":"Meta"}},"product_version":"19.1.0 ≤19.1.1"},{"id":"73165ff1-4064-35f5-b689-66c24e4abdc5","product":{"name":"react-server-dom-turbopack","vendor":{"name":"Meta"}},"product_version":"19.2.0 ≤19.2.0"},{"id":"912de532-fc37-33cd-afdf-f9fa033b5d99","product":{"name":"react-server-dom-webpack","vendor":{"name":"Meta"}},"product_version":"19.1.0 ≤19.1.1"},{"id":"a14da1b5-05a3-330b-8336-6437409a78f8","product":{"name":"react-server-dom-turbopack","vendor":{"name":"Meta"}},"product_version":"19.0.0 ≤19.0.0"},{"id":"ad03a1c9-e3e0-37aa-ac81-3f48f1b85edb","product":{"name":"react-server-dom-parcel","vendor":{"name":"Meta"}},"product_version":"19.0.0 ≤19.0.0"},{"id":"f2415576-dc18-3c24-bf7d-4a5ea3e18f9b","product":{"name":"react-server-dom-webpack","vendor":{"name":"Meta"}},"product_version":"19.2.0 ≤19.2.0"},{"id":"f67bcf0a-953d-3336-b9cb-e308a4b13d96","product":{"name":"react-server-dom-webpack","vendor":{"name":"Meta"}},"product_version":"19.0.0 ≤19.0.0"}],"vulnerabilityVendor":[{"id":"568c5868-061b-374f-995f-cda5de84e9b4","vendor":{"name":"Meta"}}]}}],"enisaIdAdvisory":[{"id":"a0498aac-e5d4-3a39-b3a3-800439d4969f","advisory":{"id":"cisco-sa-react-flight-TYw32Ddb","description":"Remote Code Execution Vulnerability in React and Next.js Frameworks: December 2025","summary":"On December 3, 2025, the React team released a security advisory regarding a vulnerability, CVE-2025-55182, in the React server that could allow an unauthenticated, remote attacker to perform remote code execution on an affected device or system.\r\n\r\nFor a description of this vulnerability, see the public React Security Advisory [\"https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components\"].\r\n\r\nCisco\u0027s standard practice is to update integrated third-party software components to later versions as they become available.\r\n\r\n","datePublished":"Dec 4, 2025, 4:00:00 PM","dateUpdated":"Dec 17, 2025, 10:37:17 PM","baseScore":0.0,"references":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-react-flight-TYw32Ddb\n","aliases":"CVE-2025-55182\n","source":{"id":10,"name":"csaf_cisco"},"advisoryProduct":[]}},{"id":"aaf0dafe-fdb6-3c07-9095-deb8774a4b81","advisory":{"id":"NCSC-2025-0380","description":"Kwetsbaarheden verholpen in React Server Components","datePublished":"Dec 3, 2025, 8:11:57 PM","dateUpdated":"Dec 5, 2025, 12:13:36 PM","baseScore":0.0,"references":"","aliases":"CVE-2025-55182\nCVE-2025-66478\n","source":{"id":19,"name":"csaf_ncscnl"},"advisoryProduct":[{"id":"30636ce1-80c1-3b7a-9fb7-8b2ac7456cc7","product":{"name":"react-server-dom-turbopack","vendor":{"name":"Meta"}}},{"id":"354bf84b-7a92-3641-8657-f7c03f9882c0","product":{"name":"react-server-dom-webpack","vendor":{"name":"Meta"}}},{"id":"7c6a362f-0ba4-375e-8ee1-e7e4328d2222","product":{"name":"vers:unknown/*","vendor":{"name":"Cisco"}}},{"id":"bd8f827f-f5a7-3640-a142-2e878de16904","product":{"name":"react-server-dom-parcel","vendor":{"name":"Meta"}}}]}},{"id":"ed69df90-d20d-3dac-814f-6c6e34a024f3","advisory":{"id":"WID-SEC-W-2025-2738","description":"Vercel Next.js und React Server Components (React2Shell): Schwachstelle ermöglicht Codeausführung","summary":"Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Vercel Next.js und React ausnutzen, um beliebigen Programmcode auszuführen.","datePublished":"Dec 3, 2025, 11:00:00 PM","dateUpdated":"Dec 4, 2025, 11:00:00 PM","baseScore":0.0,"references":"https://wid.cert-bund.de/.well-known/csaf/white/2025/wid-sec-w-2025-2738.json\nhttps://wid.cert-bund.de/portal/wid/securityadvisory?name\u003dWID-SEC-2025-2738\n","aliases":"CVE-2025-55182\nCVE-2025-66478\n","source":{"id":8,"name":"csaf_certbund"},"advisoryProduct":[{"id":"0db9724b-044b-3ab4-9eb8-11cbc6a5f625","product":{"name":"15.0.5","vendor":{"name":"vercel"}}},{"id":"176be642-c5d6-3737-bc9d-f90829f035ba","product":{"name":"Vercel Next.js 15.2.6","vendor":{"name":"vercel"}}},{"id":"18ec93a3-58fd-3933-92b0-32dc7969845b","product":{"name":"Vercel Next.js \u003c15.4.8","vendor":{"name":"vercel"}}},{"id":"195711a2-5fc7-3578-9cae-faaaf5b55cbd","product":{"name":"next.js","vendor":{"name":"vercel"}}},{"id":"202b8269-c37c-3a90-95a9-1025455d55d0","product":{"name":"Vercel Next.js 15.1.9","vendor":{"name":"vercel"}}},{"id":"3c3b657b-5c0c-3c73-aeb5-f4d63930bfb9","product":{"name":"15.4.8","vendor":{"name":"vercel"}}},{"id":"3f69e912-209b-3460-91f1-49a75f02b763","product":{"name":"Vercel Next.js \u003c15.1.9","vendor":{"name":"vercel"}}},{"id":"4b8c2371-9c5c-3240-a8d2-d7fc2198f1b2","product":{"name":"19.0.1","vendor":{"name":"open source"}}},{"id":"4f27b54d-22a6-3e86-ae7f-367d1248a72f","product":{"name":"19.1.2","vendor":{"name":"open source"}}},{"id":"56c0b5a2-5fc1-3b76-bbb9-bd2e0f5bd20e","product":{"name":"Vercel Next.js \u003c16.0.7","vendor":{"name":"vercel"}}},{"id":"5c55baa3-4572-32de-bd38-c2f3e9cca1e4","product":{"name":"Vercel Next.js \u003c15.2.6","vendor":{"name":"vercel"}}},{"id":"6b39c737-8211-3b32-af3c-f7a1aa3f093b","product":{"name":"React","vendor":{"name":"@clerk"}}},{"id":"6fcdd4f7-0117-3384-b8c1-69a9bf1874f9","product":{"name":"Vercel Next.js \u003c15.3.6","vendor":{"name":"vercel"}}},{"id":"7bf61018-5f9d-39d4-8a3c-a50bd9741afc","product":{"name":"16.0.7","vendor":{"name":"vercel"}}},{"id":"83fa609e-4e88-320d-a94f-4e67bb9b8041","product":{"name":"15.5.7","vendor":{"name":"vercel"}}},{"id":"853a4822-1d09-3b95-8207-d4efcc36959f","product":{"name":"15.2.6","vendor":{"name":"vercel"}}},{"id":"acf0d1b6-af5b-3a87-8488-0e05e7bd4780","product":{"name":"Vercel Next.js 16.0.7","vendor":{"name":"vercel"}}},{"id":"b967f8c2-f614-333f-8597-2ce357bbed10","product":{"name":"15.3.6","vendor":{"name":"vercel"}}},{"id":"b96a6ca9-c394-34b9-915d-1c67c7b82f16","product":{"name":"Vercel Next.js 15.4.8","vendor":{"name":"vercel"}}},{"id":"c0e6f4bf-8cc7-3209-ade7-b391369172a5","product":{"name":"Vercel Next.js 15.5.7","vendor":{"name":"vercel"}}},{"id":"ca041cae-6768-349c-b657-2fb074b55655","product":{"name":"19.2.1","vendor":{"name":"open source"}}},{"id":"d905d173-242b-33f8-96fc-061735809c25","product":{"name":"15.1.9","vendor":{"name":"vercel"}}},{"id":"e50d5a67-fb0c-34f3-a2f1-bc3da498f20f","product":{"name":"Vercel Next.js 15.3.6","vendor":{"name":"vercel"}}},{"id":"e54ceadc-6d9c-321d-b669-58d681cddfc8","product":{"name":"Vercel Next.js 15.0.5","vendor":{"name":"vercel"}}},{"id":"fa3e1a4f-b691-3e18-8146-8e8e965bc2b9","product":{"name":"Vercel Next.js \u003c15.5.7","vendor":{"name":"vercel"}}},{"id":"fa68f8fa-103c-3453-8bfb-3942258d120b","product":{"name":"Vercel Next.js \u003c15.0.5","vendor":{"name":"vercel"}}}]}}]}