{"id":"EUVD-2025-200983","revision":"b624b37030f644a0b008dd72371921fa","records":[{"revision":"b624b37030f644a0b008dd72371921fa","observedAt":"2026-11-01T00:11:22.843+00:00","statement":{"source":"euvd","id":"EUVD-2025-200983","aliases":["CVE-2025-55182","GHSA-fv66-9v8q-g76r"],"title":"A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-d…","description":"A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","score":10,"severity":null}],"references":["https://www.facebook.com/security/advisories/cve-2025-55182","https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-200983","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Dec 3, 2025, 3:40:56 PM","dateUpdated":"Oct 7, 2026, 5:58:00 PM"},"relatedAdvisories":[{"id":"cisco-sa-react-flight-TYw32Ddb","title":"Remote Code Execution Vulnerability in React and Next.js Frameworks: December 2025","vulnerabilityIds":["CVE-2025-55182"]},{"id":"NCSC-2025-0380","title":"Kwetsbaarheden verholpen in React Server Components","vulnerabilityIds":["CVE-2025-55182","CVE-2025-66478"]},{"id":"WID-SEC-W-2025-2738","title":"Vercel Next.js und React Server Components (React2Shell): Schwachstelle ermöglicht Codeausführung","vulnerabilityIds":["CVE-2025-55182","CVE-2025-66478"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2025-200983","identifiers":["EUVD-2025-200983","CVE-2025-55182","GHSA-fv66-9v8q-g76r"]},"retained":false,"historicalAffected":[]}],"coverage":[]}