Vulnerability

CERT-In Vulnerability Note CIVN-2025-0352
Remote Code Execution Vulnerability in React Server Components

Original Issue Date:December 05, 2025

Severity Rating: CRITICAL

Software Affected

react-server-dom-webpack versions 19.0, 19.1.0, 19.1.1, and 19.2.0
react-server-dom-parcel versions 19.0, 19.1.0, 19.1.1, and 19.2.0
react-server-dom-turbopack versions 19.0, 19.1.0, 19.1.1, and 19.2.0
Next.js 15.x
Next.js 16.x
Next.js 14.3.0-canary.77 and later canary releases

Overview

A vulnerability has been reported in React Server Components which could allow an unauthenticated remote attacker to execute arbitrary code on the targeted system.

Target Audience:
Organizations and individuals using the affected React server.

Risk Assessment:
Potential for remote code execution, system compromise and sensitive data exposure.

Impact Assessment:
High risk of system compromise and service disruptions.

Description

React (React.js) is an open-source JavaScript library designed for creating application user interfaces.

This vulnerability exists due to unsafe deserialization of attacker-controlled input inside the React Server Components (RSC) "Flight" protocol. A remote attacker could exploit this vulnerability by sending a specially crafted HTTP request to an endpoint that processes RSC payloads and execute arbitrary code on the targeted system.

Successful exploitation of this vulnerability may result in complete compromise of the vulnerable system.

Note: CVE-2025-55182 is being exploited in the wild.

Solution

Apply appropriate software updates as mentioned by the vendor:
https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components

Vendor Information

React
https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components

References

React
https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components

CVE Name
CVE-2025-55182

Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.

Contact Information

Email: info@cert-in.org.in
Phone: +91-11-22902657

Postal address

Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India