React Server Components contain an unauthenticated remote code execution vulnerability (CVE-2025-55182) due to improper deserialization of payloads sent to Server Function endpoints. This vulnerability affects react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack versions 19.0, 19.1.0, 19.1.1, and 19.2.0. An attacker can craft malicious HTTP requests that, when processed by the server, lead to arbitrary code execution. The React team released patched versions 19.0.1, 19.1.2, and 19.2.1 to remediate the issue. Frameworks and bundlers such as next, react-router, waku, @parcel/rsc, @vitejs/plugin-rsc, and rwsdk are also impacted and require updates. Hosting providers have implemented temporary mitigations, but these do not replace the need for immediate upgrades. The vulnerability was responsibly disclosed by Lachlan Davidson and confirmed by Meta security researchers. Additional vulnerabilities related to denial of service and source code exposure have been disclosed with CVEs 2025-55183, 2025-55184, 2025-67779, and 2026-23864.

This vulnerability allows unauthenticated remote code execution on servers running vulnerable React Server Components packages, potentially leading to full compromise of the server environment. The flaw affects multiple React server-side rendering packages and frameworks that depend on them, increasing the attack surface. Exploitation requires sending crafted HTTP requests to Server Function endpoints. Even applications not explicitly using Server Function endpoints may be vulnerable if they support React Server Components. The severity is critical due to the ease of exploitation and the potential impact on server integrity and confidentiality.

A fix is available and has been released in react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack versions 19.0.1, 19.1.2, and 19.2.1. Users should immediately upgrade to these patched versions. Additionally, affected React frameworks and bundlers such as next, react-router, waku, @parcel/rsc, @vitejs/plugin-rsc, and rwsdk should be updated according to the vendor's instructions. Hosting provider mitigations exist but are temporary; do not rely on them as a sole defense. Applications not using React Server Components or Server Function endpoints are not affected. Follow the official React blog and vendor advisories for detailed upgrade instructions and further updates.