CVE-2025-55182: Meta React Server Components Remote Code Execution Vulnerability
Impact
There is an unauthenticated remote code execution vulnerability in React Server Components.
We recommend upgrading immediately.
The vulnerability is present in versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 of: react-server-dom-webpack react-server-dom-parcel react-server-dom-turbopack
Patches
A fix was introduced in versions 19.0.1, 19.1.2, and 19.2.1. If you are using any of the above packages please upgrade to any of the fixed versions immediately.
If your app’s React code does not use a server, your app is not affected by this vulnerability. If your app does not use a framework, bundler, or bundler plugin that supports React Server Components, your app is not affected by this vulnerability.
References
See the blog post for more information and upgrade instructions.
Other sources
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.
— NVD
Meta React Server Components contains a remote code execution vulnerability that could allow unauthenticated remote code execution by exploiting a flaw in how React decodes payloads sent to React Server Function endpoints. Please note CVE-2025-66478 has been rejected, but it is associated with CVE-2025- 55182.
— CISA
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/react-server-dom-webpackto a version that resolves this vulnerability.Fixed in 19.0.1 - Upgrade
Upgrade
npm/react-server-dom-parcelto a version that resolves this vulnerability.Fixed in 19.0.1 - Upgrade
Upgrade
npm/react-server-dom-turbopackto a version that resolves this vulnerability.Fixed in 19.0.1 - Upgrade
Upgrade
npm/react-server-dom-parcelto a version that resolves this vulnerability.Fixed in 19.2.1 - Upgrade
Upgrade
npm/react-server-dom-parcelto a version that resolves this vulnerability.Fixed in 19.1.2 - Upgrade
Upgrade
npm/react-server-dom-turbopackto a version that resolves this vulnerability.Fixed in 19.2.1 - Upgrade
Upgrade
npm/react-server-dom-turbopackto a version that resolves this vulnerability.Fixed in 19.1.2 - Upgrade
Upgrade
npm/react-server-dom-webpackto a version that resolves this vulnerability.Fixed in 19.2.1 - Upgrade
Upgrade
npm/react-server-dom-webpackto a version that resolves this vulnerability.Fixed in 19.1.2 - Upgrade
Upgrade
react-server-dom-parcelto a version that resolves this vulnerability.Fixed in 19.0.1 - Upgrade
Upgrade
react-server-dom-turbopackto a version that resolves this vulnerability.Fixed in 19.1.2 - Upgrade
Upgrade
react-server-dom-webpackto a version that resolves this vulnerability.Fixed in 19.2.1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-55182?
CVE-2025-55182 is classified as a critical vulnerability due to its potential for pre-authentication remote code execution.
How do I fix CVE-2025-55182?
To mitigate CVE-2025-55182, upgrade your React Server Components to version 19.2.1 or later.
What components are affected by CVE-2025-55182?
CVE-2025-55182 affects React Server Components versions 19.0.0 to 19.2.0, including packages like react-server-dom-parcel and react-server-dom-webpack.
What types of attacks can exploit CVE-2025-55182?
CVE-2025-55182 can be exploited to execute remote code on vulnerable systems prior to user authentication.
How can I confirm if I am using a vulnerable version related to CVE-2025-55182?
Check your project's package.json file to see if you are using React Server Components versions 19.0.0 through 19.2.0.