CVE-2025-55182: React Server Components are Vulnerable to RCE
Impact There is an unauthenticated remote code execution vulnerability in React Server Components. We recommend upgrading immediately. The vulnerability is present in versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 of: react-server-dom-webpack react-server-dom-parcel react-server-dom-turbopack Patches A fix was introduced in versions 19.0.1, 19.1.2, and 19.2.1.
Published Dec 3, 2025 · Updated Dec 9, 2025
Affected packages
react-server-dom-webpack
- Ecosystem
- npm
- Affected
- >= 19.1.0, < 19.1.2
- Fixed in
- 19.1.2
- Check
npm ls react-server-dom-webpack
react-server-dom-webpack
- Ecosystem
- npm
- Affected
- = 19.2.0
- Fixed in
- 19.2.1
- Check
npm ls react-server-dom-webpack
react-server-dom-turbopack
- Ecosystem
- npm
- Affected
- >= 19.1.0, < 19.1.2
- Fixed in
- 19.1.2
- Check
npm ls react-server-dom-turbopack
react-server-dom-turbopack
- Ecosystem
- npm
- Affected
- = 19.2.0
- Fixed in
- 19.2.1
- Check
npm ls react-server-dom-turbopack
react-server-dom-parcel
- Ecosystem
- npm
- Affected
- >= 19.1.0, < 19.1.2
- Fixed in
- 19.1.2
- Check
npm ls react-server-dom-parcel
react-server-dom-parcel
- Ecosystem
- npm
- Affected
- = 19.2.0
- Fixed in
- 19.2.1
- Check
npm ls react-server-dom-parcel
react-server-dom-turbopack
- Ecosystem
- npm
- Affected
- = 19.0.0
- Fixed in
- 19.0.1
- Check
npm ls react-server-dom-turbopack
react-server-dom-parcel
- Ecosystem
- npm
- Affected
- = 19.0.0
- Fixed in
- 19.0.1
- Check
npm ls react-server-dom-parcel
react-server-dom-webpack
- Ecosystem
- npm
- Affected
- = 19.0.0
- Fixed in
- 19.0.1
- Check
npm ls react-server-dom-webpack
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
Impact
There is an unauthenticated remote code execution vulnerability in React Server Components.
We recommend upgrading immediately.
The vulnerability is present in versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 of:
Patches
A fix was introduced in versions 19.0.1, 19.1.2, and 19.2.1. If you are using any of the above packages please upgrade to any of the fixed versions immediately.
If your app’s React code does not use a server, your app is not affected by this vulnerability. If your app does not use a framework, bundler, or bundler plugin that supports React Server Components, your app is not affected by this vulnerability.
References
See the blog post for more information and upgrade instructions.
Credited to lachlan2k, PiotrBorowski, nozo-moto, leogasparini, mtorp, mnahkies, mswilson, AsapHogFtw.
References
- https://github.com/facebook/react/security/advisories/GHSA-fv66-9v8q-g76r
- https://nvd.nist.gov/vuln/detail/CVE-2025-55182
- https://github.com/facebook/react/pull/35277
- https://github.com/facebook/react/commit/7dc903cd29dac55efb4424853fd0442fef3a8700
- https://github.com/facebook/react/releases/tag/v19.0.1
- https://github.com/facebook/react/releases/tag/v19.1.2
- https://github.com/facebook/react/releases/tag/v19.2.1
- https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components
- https://www.facebook.com/security/advisories/cve-2025-55182
- https://github.com/ejpir/CVE-2025-55182-poc
- https://news.ycombinator.com/item?id=46136026
- https://github.com/advisories/GHSA-fv66-9v8q-g76r
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology