Vulnerability in React Server Components and Next.js
React released security updates for a vulnerability in React Server Components The vulnerability, registered as CVE-2025-55182, also affects Next.js with App Router
T-Update
This live blog contains information about a vulnerability in React Server Components and Next.js. React has released security updates to address this vulnerability.
This blog is last updated on 5 December 2025
Update on 5 December 2025
Public proof-of-concept code for CVE-2025-55182 is now available, increasing the risk of exploitation.
Update on 4 December 2025
Critical Vulnerability in React Server Components and Next.js
React has released updates for a vulnerability in React Server Components. The vulnerability afffects React versions 19.0, 19.1.0, 19.1.1, and 19.2.0 of:
- react-server-dom-webpack
- react-server-dom-parcel
- react-server-dom-turbopack
The vulnerability also affects Next.js with App Router. The vulnerability exists in Next.js versions 14.3.0-canary, 15.x, and 16.x and is fixed in the following patched versions: 14.3.0-canary.88, 15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7, and 16.0.7.
The following CVE applies
Active Exploitation
There does not appear to be an active exploit or PoC for this vulnerability at this time. However, it is possible to verify the presence of this vulnerability using a crafted HTTP request.
Background
React has fixed a critical vulnerability in React Server Components. The vulnerability is present in React versions 19.0, 19.1.0, 19.1.1, and 19.2.0. The vulnerability also affects Next.js with App Router. The vulnerability is present in Next.js versions 14.3.0-canary, 15.x, and 16.x and is fixed in the following patched versions: 14.3.0-canary.88, 15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7, and 16.0.7.
Risk
An unauthenticated attacker could send a malicious HTTP request to any Server Function endpoint, which, when processed by React, could lead to remote code execution on the server. However, even if a Server Function endpoint is not implemented, exploitation could still be possible via React Server Components. This flaw could allow attackers to remotely execute arbitrary code, severely compromising the integrity of affected applications.
Advice
React has released security updates to address the vulnerability. It is advised to install these updates as soon as possible. See the React instructions for more information.
If you are using the packages mentioned above, upgrade immediately. This vulnerability has been fixed in versions 19.0.1, 19.1.2, and 19.2.1. If your application's React code does not use a server, your application is not vulnerable to this vulnerability. Also, if your application does not use a framework, bundler, or bundler plugin that supports React Server Components, your application is not affected.
The following React frameworks and bundlers are affected:
- Next
- ReactRouter
- Waku
- @parcel/rsc
- @vitejs/plugin-rsc
- rwsdk
The vulnerability also affects Next.js with App Router. The vulnerability exists in Next.js versions 14.3.0-canary, 15.x, and 16.x and is fixed in the following patched versions: 14.3.0-canary.88, 15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7, and 16.0.7.
Sources
- https://advisories.ncsc.nl/2025/ncsc-2025-0380.html
- https://nvd.nist.gov/vuln/detail/CVE-2025-55182
- https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components
- https://www.wiz.io/blog/critical-vulnerability-in-react-cve-2025-55182
- https://react2shell.com/
- https://slcyber.io/research-center/high-fidelity-detection-mechanism-for-rsc-next-js-rce-cve-2025-55182-cve-2025-66478/
Sign up to receive T-Updates
Receive the latest vulnerabilities in your email every Wednesday
More than 1,000 organisations have already joined us.
