Critical React Server Components Flaw Enables Unauthenticated Remote Code Execution
Summary
CVE-2025-55182 affects React Server Components and frameworks including Next.js. Wiz reports in-the-wild exploitation, credential harvesting and cryptomining; patched releases are available, and upgrading is the definitive mitigation.
Key points
- The flaw is an insecure-deserialization vulnerability in the React Server Components Flight protocol, enabling unauthenticated remote code execution through a crafted HTTP request.
- Wiz says default configurations are vulnerable and reports near-100% exploit reliability in its testing.
- Affected packages include react-server-dom 19.0.x, 19.1.x and 19.2.x, and specified Next.js App Router canary and 15.x/16.x releases; patched versions are listed in the article.
- Wiz reports exploitation since December 5 targeting internet-facing Next.js applications and Kubernetes containers, with credential-harvesting attempts, Sliver installation and cryptomining observed.
- Wiz says its data found vulnerable React or Next.js instances in 39% of cloud environments; GreyNoise reported 95 IP addresses making opportunistic exploitation attempts.
- The article says upgrading React and dependencies to hardened releases is the only definitive mitigation; teams using other RSC frameworks should check for updates.
Article Details
- Vulnerability Types
- Insecure deserialization
- Unauthenticated remote code execution
- Severity
- Critical
- Affected Versions
- react-server-dom*: 19.0.x, 19.1.x, 19.2.x
- Next.js with App Router: 14.3.0-canary.77 and later canary releases, 15.x, 16.x
- Exploitation Status
- active
- Exploit Availability
- public_exploit
- Patch Status
- available
MITRE ATT&CK
T1059.004 · Unix ShellPost-exploitation activity included establishing shells and running a shell script to attempt to install Sliver.T1105 · Ingress Tool TransferA cryptomining campaign downloaded the standard XMRig setup from GitHub.T1190 · Exploit Public-Facing ApplicationAttackers exploited vulnerable, internet-facing Next.js applications by sending crafted HTTP requests.T1496 · Resource HijackingWiz reported campaigns deploying XMRig to mine cryptocurrency on compromised environments.T1552.001 · Credentials In FilesWiz observed attackers harvesting credentials from environment variables and filesystems.T1552.005 · Cloud Instance Metadata APIWiz observed attackers harvesting credentials from cloud instance metadata.
CVE
CVE-2025-55182CVE-2025-55182 is a critical unauthenticated RCE vulnerabilities in the React Server Components (RSC) "Flight" protocol.CVE-2025-66478UPDATE: CVE-2025-66478 has been rejected as a duplicate of CVE-2025-55182. This makes sense, as they both have the same root cause. However, this does not mean that detections of CVE-2025-66478 are false positives; the
Malware
Products
Next.jsDefault configurations are vulnerable – a standard Next.js app created with create-next-app and built for production can be exploited with no code changes by the developer.ReactCVE-2025-55182 is a critical unauthenticated RCE vulnerabilities in the React Server Components (RSC) "Flight" protocol.React Server ComponentsCVE-2025-55182 is a critical unauthenticated RCE vulnerabilities in the React Server Components (RSC) "Flight" protocol.