CVE
CVE-2025-55182
Meta · react-server-dom-parcel; Meta · react-server-dom-turbopack; +1 more
- First Reported
- Dec 3, 2025
- Latest Reported
- Nov 8, 2026
CVE Enrichment
- CVSS
- 10.0 CRITICAL
- EPSS
- 99.80%
- EPSS Percentile
- 99.96%
- CISA KEV
- YES — Known Exploited Vulnerability
Description
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.
Technical Details
- CVSS Version
- 3.1
- CNA / NVD Source
- [email protected]
- Published
- 03-Dec-2025 23:15
- Last Modified
- 19-Oct-2026 00:10
- EPSS Date
- 2026-10-22
- CWE
- CWE-502
CVSS Vector
CVSS:3.1 AV:N /
AC:L /
PR:N /
UI:N /
S:C /
C:H /
I:H /
A:H
CISA KEV Details
- Date Added
- 2025-12-05
- Remediation Due
- 2025-12-12
- Known Ransomware Campaign Use
- Known
- Required Action
- Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Notes
- Check for signs of potential compromise on all internet accessible REACT instances after applying mitigations. For more information, please see: https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components ; https://github.com/vercel-labs/fix-react2shell-next?tab=readme-ov-file ; https://nvd.nist.gov/vuln/detail/CVE-2025-55182
CNA Products / Version Status
- Meta · react-server-dom-parcel
Source: CNA · [email protected]
Default status: unaffected
19.0.0 ≤ version ≤ 19.0.0 — affected (semver)
19.1.0 ≤ version ≤ 19.1.1 — affected (semver)
19.2.0 ≤ version ≤ 19.2.0 — affected (semver)
- Meta · react-server-dom-turbopack
Source: CNA · [email protected]
Default status: unaffected
19.0.0 ≤ version ≤ 19.0.0 — affected (semver)
19.1.0 ≤ version ≤ 19.1.1 — affected (semver)
19.2.0 ≤ version ≤ 19.2.0 — affected (semver)
- Meta · react-server-dom-webpack
Source: CNA · [email protected]
Default status: unaffected
19.0.0 ≤ version ≤ 19.0.0 — affected (semver)
19.1.0 ≤ version ≤ 19.1.1 — affected (semver)
19.2.0 ≤ version ≤ 19.2.0 — affected (semver)
Affected Products / Versions
- facebook / react
Source: NVD CPE · affected
Version / affected range: 19.0.0
cpe:2.3:a:facebook:react:19.0.0:*:*:*:*:*:*:* - facebook / react
Source: NVD CPE · affected
Version / affected range: 19.1.0
cpe:2.3:a:facebook:react:19.1.0:*:*:*:*:*:*:* - facebook / react
Source: NVD CPE · affected
Version / affected range: 19.1.1
cpe:2.3:a:facebook:react:19.1.1:*:*:*:*:*:*:* - facebook / react
Source: NVD CPE · affected
Version / affected range: 19.2.0
cpe:2.3:a:facebook:react:19.2.0:*:*:*:*:*:*:* - vercel / next.js
Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 15.0.0 · before (exclusive) 15.0.5
cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:* - vercel / next.js
Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 15.1.0 · before (exclusive) 15.1.9
cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:* - vercel / next.js
Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 15.2.0 · before (exclusive) 15.2.6
cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:* - vercel / next.js
Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 15.3.0 · before (exclusive) 15.3.6
cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:* - vercel / next.js
Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 15.4.0 · before (exclusive) 15.4.8
cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:* - vercel / next.js
Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 15.5.0 · before (exclusive) 15.5.7
cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:* - vercel / next.js
Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 16.0.0 · before (exclusive) 16.0.7
cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:* - vercel / next.js
Source: NVD CPE · affected
Version / affected range: 14.3.0
cpe:2.3:a:vercel:next.js:14.3.0:canary77:*:*:*:node.js:*:* - vercel / next.js
Source: NVD CPE · affected
Version / affected range: 14.3.0
cpe:2.3:a:vercel:next.js:14.3.0:canary78:*:*:*:node.js:*:* - vercel / next.js
Source: NVD CPE · affected
Version / affected range: 14.3.0
cpe:2.3:a:vercel:next.js:14.3.0:canary79:*:*:*:node.js:*:* - vercel / next.js
Source: NVD CPE · affected
Version / affected range: 14.3.0
cpe:2.3:a:vercel:next.js:14.3.0:canary80:*:*:*:node.js:*:* - vercel / next.js
Source: NVD CPE · affected
Version / affected range: 14.3.0
cpe:2.3:a:vercel:next.js:14.3.0:canary81:*:*:*:node.js:*:* - vercel / next.js
Source: NVD CPE · affected
Version / affected range: 14.3.0
cpe:2.3:a:vercel:next.js:14.3.0:canary82:*:*:*:node.js:*:* - vercel / next.js
Source: NVD CPE · affected
Version / affected range: 14.3.0
cpe:2.3:a:vercel:next.js:14.3.0:canary83:*:*:*:node.js:*:* - vercel / next.js
Source: NVD CPE · affected
Version / affected range: 14.3.0
cpe:2.3:a:vercel:next.js:14.3.0:canary84:*:*:*:node.js:*:* - vercel / next.js
Source: NVD CPE · affected
Version / affected range: 14.3.0
cpe:2.3:a:vercel:next.js:14.3.0:canary85:*:*:*:node.js:*:* - vercel / next.js
Source: NVD CPE · affected
Version / affected range: 14.3.0
cpe:2.3:a:vercel:next.js:14.3.0:canary86:*:*:*:node.js:*:* - vercel / next.js
Source: NVD CPE · affected
Version / affected range: 14.3.0
cpe:2.3:a:vercel:next.js:14.3.0:canary87:*:*:*:node.js:*:* - vercel / next.js
Source: NVD CPE · affected
Version / affected range: 15.6.0
cpe:2.3:a:vercel:next.js:15.6.0:-:*:*:*:node.js:*:* - vercel / next.js
Source: NVD CPE · affected
Version / affected range: 15.6.0
cpe:2.3:a:vercel:next.js:15.6.0:canary0:*:*:*:node.js:*:* - vercel / next.js
Source: NVD CPE · affected
Version / affected range: 15.6.0
cpe:2.3:a:vercel:next.js:15.6.0:canary1:*:*:*:node.js:*:* - vercel / next.js
Source: NVD CPE · affected
Version / affected range: 15.6.0
cpe:2.3:a:vercel:next.js:15.6.0:canary10:*:*:*:node.js:*:* - vercel / next.js
Source: NVD CPE · affected
Version / affected range: 15.6.0
cpe:2.3:a:vercel:next.js:15.6.0:canary11:*:*:*:node.js:*:* - vercel / next.js
Source: NVD CPE · affected
Version / affected range: 15.6.0
cpe:2.3:a:vercel:next.js:15.6.0:canary12:*:*:*:node.js:*:* - vercel / next.js
Source: NVD CPE · affected
Version / affected range: 15.6.0
cpe:2.3:a:vercel:next.js:15.6.0:canary13:*:*:*:node.js:*:* - vercel / next.js
Source: NVD CPE · affected
Version / affected range: 15.6.0
cpe:2.3:a:vercel:next.js:15.6.0:canary14:*:*:*:node.js:*:* - vercel / next.js
Source: NVD CPE · affected
Version / affected range: 15.6.0
cpe:2.3:a:vercel:next.js:15.6.0:canary15:*:*:*:node.js:*:* - vercel / next.js
Source: NVD CPE · affected
Version / affected range: 15.6.0
cpe:2.3:a:vercel:next.js:15.6.0:canary16:*:*:*:node.js:*:* - vercel / next.js
Source: NVD CPE · affected
Version / affected range: 15.6.0
cpe:2.3:a:vercel:next.js:15.6.0:canary17:*:*:*:node.js:*:* - vercel / next.js
Source: NVD CPE · affected
Version / affected range: 15.6.0
cpe:2.3:a:vercel:next.js:15.6.0:canary18:*:*:*:node.js:*:* - vercel / next.js
Source: NVD CPE · affected
Version / affected range: 15.6.0
cpe:2.3:a:vercel:next.js:15.6.0:canary19:*:*:*:node.js:*:* - vercel / next.js
Source: NVD CPE · affected
Version / affected range: 15.6.0
cpe:2.3:a:vercel:next.js:15.6.0:canary2:*:*:*:node.js:*:* - vercel / next.js
Source: NVD CPE · affected
Version / affected range: 15.6.0
cpe:2.3:a:vercel:next.js:15.6.0:canary20:*:*:*:node.js:*:* - vercel / next.js
Source: NVD CPE · affected
Version / affected range: 15.6.0
cpe:2.3:a:vercel:next.js:15.6.0:canary21:*:*:*:node.js:*:* - vercel / next.js
Source: NVD CPE · affected
Version / affected range: 15.6.0
cpe:2.3:a:vercel:next.js:15.6.0:canary22:*:*:*:node.js:*:* - vercel / next.js
Source: NVD CPE · affected
Version / affected range: 15.6.0
cpe:2.3:a:vercel:next.js:15.6.0:canary23:*:*:*:node.js:*:* - vercel / next.js
Source: NVD CPE · affected
Version / affected range: 15.6.0
cpe:2.3:a:vercel:next.js:15.6.0:canary24:*:*:*:node.js:*:* - vercel / next.js
Source: NVD CPE · affected
Version / affected range: 15.6.0
cpe:2.3:a:vercel:next.js:15.6.0:canary25:*:*:*:node.js:*:* - vercel / next.js
Source: NVD CPE · affected
Version / affected range: 15.6.0
cpe:2.3:a:vercel:next.js:15.6.0:canary26:*:*:*:node.js:*:* - vercel / next.js
Source: NVD CPE · affected
Version / affected range: 15.6.0
cpe:2.3:a:vercel:next.js:15.6.0:canary27:*:*:*:node.js:*:* - vercel / next.js
Source: NVD CPE · affected
Version / affected range: 15.6.0
cpe:2.3:a:vercel:next.js:15.6.0:canary28:*:*:*:node.js:*:* - vercel / next.js
Source: NVD CPE · affected
Version / affected range: 15.6.0
cpe:2.3:a:vercel:next.js:15.6.0:canary29:*:*:*:node.js:*:* - vercel / next.js
Source: NVD CPE · affected
Version / affected range: 15.6.0
cpe:2.3:a:vercel:next.js:15.6.0:canary3:*:*:*:node.js:*:* - vercel / next.js
Source: NVD CPE · affected
Version / affected range: 15.6.0
cpe:2.3:a:vercel:next.js:15.6.0:canary30:*:*:*:node.js:*:* - vercel / next.js
Source: NVD CPE · affected
Version / affected range: 15.6.0
cpe:2.3:a:vercel:next.js:15.6.0:canary31:*:*:*:node.js:*:* - vercel / next.js
Source: NVD CPE · affected
Version / affected range: 15.6.0
cpe:2.3:a:vercel:next.js:15.6.0:canary32:*:*:*:node.js:*:* - vercel / next.js
Source: NVD CPE · affected
Version / affected range: 15.6.0
cpe:2.3:a:vercel:next.js:15.6.0:canary33:*:*:*:node.js:*:* - vercel / next.js
Source: NVD CPE · affected
Version / affected range: 15.6.0
cpe:2.3:a:vercel:next.js:15.6.0:canary34:*:*:*:node.js:*:* - vercel / next.js
Source: NVD CPE · affected
Version / affected range: 15.6.0
cpe:2.3:a:vercel:next.js:15.6.0:canary35:*:*:*:node.js:*:* - vercel / next.js
Source: NVD CPE · affected
Version / affected range: 15.6.0
cpe:2.3:a:vercel:next.js:15.6.0:canary36:*:*:*:node.js:*:* - vercel / next.js
Source: NVD CPE · affected
Version / affected range: 15.6.0
cpe:2.3:a:vercel:next.js:15.6.0:canary37:*:*:*:node.js:*:* - vercel / next.js
Source: NVD CPE · affected
Version / affected range: 15.6.0
cpe:2.3:a:vercel:next.js:15.6.0:canary38:*:*:*:node.js:*:* - vercel / next.js
Source: NVD CPE · affected
Version / affected range: 15.6.0
cpe:2.3:a:vercel:next.js:15.6.0:canary39:*:*:*:node.js:*:* - vercel / next.js
Source: NVD CPE · affected
Version / affected range: 15.6.0
cpe:2.3:a:vercel:next.js:15.6.0:canary4:*:*:*:node.js:*:* - vercel / next.js
Source: NVD CPE · affected
Version / affected range: 15.6.0
cpe:2.3:a:vercel:next.js:15.6.0:canary40:*:*:*:node.js:*:* - vercel / next.js
Source: NVD CPE · affected
Version / affected range: 15.6.0
cpe:2.3:a:vercel:next.js:15.6.0:canary41:*:*:*:node.js:*:* - vercel / next.js
Source: NVD CPE · affected
Version / affected range: 15.6.0
cpe:2.3:a:vercel:next.js:15.6.0:canary42:*:*:*:node.js:*:* - vercel / next.js
Source: NVD CPE · affected
Version / affected range: 15.6.0
cpe:2.3:a:vercel:next.js:15.6.0:canary43:*:*:*:node.js:*:* - vercel / next.js
Source: NVD CPE · affected
Version / affected range: 15.6.0
cpe:2.3:a:vercel:next.js:15.6.0:canary44:*:*:*:node.js:*:* - vercel / next.js
Source: NVD CPE · affected
Version / affected range: 15.6.0
cpe:2.3:a:vercel:next.js:15.6.0:canary45:*:*:*:node.js:*:* - vercel / next.js
Source: NVD CPE · affected
Version / affected range: 15.6.0
cpe:2.3:a:vercel:next.js:15.6.0:canary46:*:*:*:node.js:*:* - vercel / next.js
Source: NVD CPE · affected
Version / affected range: 15.6.0
cpe:2.3:a:vercel:next.js:15.6.0:canary47:*:*:*:node.js:*:* - vercel / next.js
Source: NVD CPE · affected
Version / affected range: 15.6.0
cpe:2.3:a:vercel:next.js:15.6.0:canary48:*:*:*:node.js:*:* - vercel / next.js
Source: NVD CPE · affected
Version / affected range: 15.6.0
cpe:2.3:a:vercel:next.js:15.6.0:canary49:*:*:*:node.js:*:* - vercel / next.js
Source: NVD CPE · affected
Version / affected range: 15.6.0
cpe:2.3:a:vercel:next.js:15.6.0:canary5:*:*:*:node.js:*:* - vercel / next.js
Source: NVD CPE · affected
Version / affected range: 15.6.0
cpe:2.3:a:vercel:next.js:15.6.0:canary50:*:*:*:node.js:*:* - vercel / next.js
Source: NVD CPE · affected
Version / affected range: 15.6.0
cpe:2.3:a:vercel:next.js:15.6.0:canary51:*:*:*:node.js:*:* - vercel / next.js
Source: NVD CPE · affected
Version / affected range: 15.6.0
cpe:2.3:a:vercel:next.js:15.6.0:canary52:*:*:*:node.js:*:* - vercel / next.js
Source: NVD CPE · affected
Version / affected range: 15.6.0
cpe:2.3:a:vercel:next.js:15.6.0:canary53:*:*:*:node.js:*:* - vercel / next.js
Source: NVD CPE · affected
Version / affected range: 15.6.0
cpe:2.3:a:vercel:next.js:15.6.0:canary54:*:*:*:node.js:*:* - vercel / next.js
Source: NVD CPE · affected
Version / affected range: 15.6.0
cpe:2.3:a:vercel:next.js:15.6.0:canary55:*:*:*:node.js:*:* - vercel / next.js
Source: NVD CPE · affected
Version / affected range: 15.6.0
cpe:2.3:a:vercel:next.js:15.6.0:canary56:*:*:*:node.js:*:* - vercel / next.js
Source: NVD CPE · affected
Version / affected range: 15.6.0
cpe:2.3:a:vercel:next.js:15.6.0:canary57:*:*:*:node.js:*:* - vercel / next.js
Source: NVD CPE · affected
Version / affected range: 15.6.0
cpe:2.3:a:vercel:next.js:15.6.0:canary6:*:*:*:node.js:*:* - vercel / next.js
Source: NVD CPE · affected
Version / affected range: 15.6.0
cpe:2.3:a:vercel:next.js:15.6.0:canary7:*:*:*:node.js:*:* - vercel / next.js
Source: NVD CPE · affected
Version / affected range: 15.6.0
cpe:2.3:a:vercel:next.js:15.6.0:canary8:*:*:*:node.js:*:* - vercel / next.js
Source: NVD CPE · affected
Version / affected range: 15.6.0
cpe:2.3:a:vercel:next.js:15.6.0:canary9:*:*:*:node.js:*:* - vercel / next.js
Source: NVD CPE · affected
Version / affected range: 16.0.0
cpe:2.3:a:vercel:next.js:16.0.0:-:*:*:*:node.js:*:*
References
- [email protected]
- [email protected]
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- 134c704f-9b21-4f2e-91b3-4a467353bcc0
- CISA Advisory
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.
Reported Context (49)
- vulnerabilities, such as a critical remote code execution (RCE) in React Server Components (CVE-2025-55182, commonly referred to as React2Shell) and a critical platform evaluation injection vulnerability in Google Cloud Report Highlights Software Exploitation and Identity-Led Cloud Threats
- React2Shell (CVE-2025-55182) How Log4Shell, React2Shell, PHP2Shell and Node2Shell Enable Remote Code Execution
- exploit brokers, while CVE-2025-5777, CVE-2025-53770 and CVE-2025-55182 were Intel 471's 2026 Outlook Reports 63% Rise in Extortion Breach Events
- (CVE-2025-55182 / CVE-2025-66478), enabling and human security expertise to deliver rapid, Edgescan 2026 Report Highlights High-Risk Application Flaws and Remediation Backlogs
- Threat actors broadly targeted CVE-2025-55182 due to its widespread Figure 33: Post-exploitation stage of React2Shell attack path Huntress 2026 Threat Report Finds RMM Abuse Rose 277% in 2025
CVE (233)
Malware (129)
People (36)
Threat Actors (144)
MITRE ATT&CK (167)
Vendors (103)
Products (290)
Tools (98)
Industries (63)
Countries (46)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.