CVE-2025-55182

Description

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.

PUBLISHED Reserved 2025-08-08 | Published 2025-12-03 | Updated 2025-12-04 | Assigner Meta

Problem types

Deserialization of Untrusted Data (CWE-502)

Product status

References

www.openwall.com/lists/oss-security/2025/12/03/4

news.ycombinator.com/item?id=46136026

github.com/ejpir/CVE-2025-55182-poc

www.facebook.com/security/advisories/cve-2025-55182

react.dev/...curity-vulnerability-in-react-server-components

cve.org (CVE-2025-55182)

nvd.nist.gov (CVE-2025-55182)

Download JSON