CVE-2025-55182: React Server Components pre-auth deserialization RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityCVSS 10.0, pre-authentication network RCE, KEV-listed with known ransomware use, and near-certain EPSS probability make this an emergency patch.

What it is

React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 (react-server-dom-parcel, react-server-dom-turbopack, react-server-dom-webpack) unsafely deserialize HTTP request payloads sent to Server Function endpoints. Because the flaw is pre-authentication and network-reachable, any exposed Server Function endpoint can be driven to remote code execution. It affects React and Next.js deployments using these packages.

Impact

An unauthenticated attacker can execute arbitrary code on the server, leading to full host compromise, data theft, and use of the server as a foothold for lateral movement. CISA KEV lists known ransomware campaign use, so destructive or extortion follow-on is plausible.

Attack surface

Reached over the network via HTTP requests to Server Function endpoints; the CVSS vector shows PR:N and UI:N, so no authentication or user interaction is required. Any internet- or network-exposed React Server Components/Next.js endpoint using the affected packages is in scope.

Exploitation

CISA added it to KEV on 2025-12-05 with a 2025-12-12 due date and flags known ransomware campaign use; EPSS 30-day probability is 0.99802 (99.957th percentile). An AWS advisory reference describes China-nexus groups rapidly exploiting it, indicating active in-the-wild exploitation.

What to do

• Upgrade React Server Components packages (react-server-dom-parcel, react-server-dom-turbopack, react-server-dom-webpack) and Next.js to patched versions per the React vendor advisory.
• If immediate patching is not possible, apply the vendor-recommended mitigations or take affected Server Function endpoints off the network.
• Restrict network access to Server Function endpoints with authentication, WAF rules, or allowlisting until patched.
• Follow CISA BOD 22-01 guidance for cloud services and meet the KEV remediation due date.
• Inventory all React and Next.js deployments to confirm which run the affected 19.0.0, 19.1.0, 19.1.1, or 19.2.0 packages.

Detection

• Monitor HTTP requests to Server Function endpoints for anomalous or oversized serialized payloads consistent with deserialization abuse.
• Alert on unexpected child processes, shells, or outbound connections spawned by Node.js/Next.js server processes.
• Hunt for post-exploitation activity such as web shell drops, credential access, or lateral movement originating from application servers.
• Review logs for scanning or probing of Server Function routes preceding exploitation attempts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.