Critical Security Vulnerability in React Server Components · React
Source Reddit NetSec
Exploited in the wild · KEV due 12 Dec 2025 · public exploit available (Metasploit, Exploit-DB) : apply the vendor's fix or mitigations to react-server-dom-webpack now.
Data as of 26 Oct 2026, 08:30 UTC
- KEV deadline
- US federal agencies must patch by this date; a sensible deadline for everyone else.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HExploitation evidence
t = 0 is the CVE’s publication on cve.org
Disclosed: evidence found.
CVE published 3 Dec 2025
Detectable: evidence found.
nuclei template: React Server Components - Remote Code Execution
Weaponised: evidence found.
1 Metasploit module · 1 Exploit-DB entry, 127 days after disclosure
Exploited in the wildExploited: evidence found.
Listed in CISA KEV 2 days after disclosure
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
Timeline
CVE ID reserved
by Meta
, 117 days before disclosure
CVE published
on cve.org
, t = 0
In Threat Radar
record ingested
, 14 minutes after disclosure
Added to CISA KEV (opens in a new tab)
exploitation confirmed · ransomware use known
, 2 days after disclosure
KEV remediation due
US federal deadline
, 9 days after disclosure
First Exploit-DB entry (opens in a new tab)
React Server 19.2.0 - Remote Code Execution
, 127 days after disclosure
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), CISA KEV (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Metareact-server-dom-webpack | Affected
| Fixed in– |
| Metareact-server-dom-turbopack | Affected
| Fixed in– |
| Metareact-server-dom-parcel | Affected
| Fixed in– |
npmreact-server-dom-parcelpkg:npm/react-server-dom-parcelOther threats | Affected
| Fixed in– |
npmreact-server-dom-turbopackpkg:npm/react-server-dom-turbopackOther threats | Affected
| Fixed in– |
npmreact-server-dom-webpackpkg:npm/react-server-dom-webpackOther threats | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
A fix is available and has been released in react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack versions 19.0.1, 19.1.2, and 19.2.1. Users should immediately upgrade to these patched versions. Additionally, affected React frameworks and bundlers such as next, react-router, waku, @parcel/rsc, @vitejs/plugin-rsc, and rwsdk should be updated according to the vendor's instructions. Hosting provider mitigations exist but are temporary; do not rely on them as a sole defense. Applications not using React Server Components or Server Function endpoints are not affected. Follow the official React blog and vendor advisories for detailed upgrade instructions and further updates.
Description
A critical unauthenticated remote code execution vulnerability (CVE-2025-55182) exists in React Server Components affecting react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack versions 19.0, 19.1.0, 19.1.1, and 19.2.0. The flaw allows attackers to exploit how React decodes payloads sent to Server Function endpoints, potentially executing arbitrary code on the server. A fix was released in versions 19.0.1, 19.1.2, and 19.2.1, and immediate upgrading is strongly recommended. Several popular React frameworks and bundlers are also affected and require updates. Hosting providers have applied temporary mitigations, but these are not a substitute for patching. Additional related vulnerabilities have been disclosed with separate CVEs.