This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] React Server Components fixes a critical vulnerability

React versions 19.0.1, 19.1.2 and 19.2.1 fix a critical, actively exploited vulnerability in React Server Components (packages react-server-dom-parcel, react-server-dom-turbopack and react-server-dom-webpack). The affected frameworks are next, react-router, waku, @parcel/rsc, @vitejs/plugin-rsc and rwsdk [1][2].

React Server Components - RCE (CVE-2025-55182)
CVSS 10.0 (Critical)

An unauthenticated remote attacker can execute code on the server by sending a specially crafted HTTP request [1][2]. The vulnerability is already being actively exploited [3][4]. Applications supporting React Server Components may be vulnerable even if they do not implement any React Server Function endpoint [2]. Detailed information on the vulnerability and fixes can be found at [2]. PoCs are available at [5]

The vulnerability is present in products:

  • react-server-dom-webpack; ==19.0.0; >=19.1.0, <=19.1.1; ==19.2.0;
  • react-server-dom-turbopack; ==19.0.0; >=19.1.0, <=19.1.1; ==19.2.0;
  • react-server-dom-parcel; ==19.0.0; >=19.1.0, <=19.1.1; ==19.2.0;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 3. 12. 2025.

By CESNET, z.s.p.o. Michaela Ručková on 8. 12. 2025.

CESNET, z.s.p.o. Logo