{"id":"CVE-2025-55182","details":"A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.","aliases":["GHSA-fv66-9v8q-g76r"],"modified":"2026-08-27T09:37:41.998390Z","published":"2025-12-03T16:15:56.463Z","references":[{"type":"WEB","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-55182"},{"type":"ADVISORY","url":"https://aws.amazon.com/blogs/security/china-nexus-cyber-threat-groups-rapidly-exploit-react2shell-vulnerability-cve-2025-55182/"},{"type":"ADVISORY","url":"https://www.facebook.com/security/advisories/cve-2025-55182"},{"type":"REPORT","url":"https://news.ycombinator.com/item?id=46136026"},{"type":"FIX","url":"http://www.openwall.com/lists/oss-security/2025/12/03/4"},{"type":"FIX","url":"https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/react/react","events":[{"introduced":"7aa5dda3b3e4c2baa905a59b922ae7ec14734b24"},{"last_affected":"ae74234eae6ebd62f19190731278e20bc1c37d51"}],"database_specific":{"cpe":["cpe:2.3:a:facebook:react:19.0.0:*:*:*:*:*:*:*","cpe:2.3:a:facebook:react:19.1.0:*:*:*:*:*:*:*","cpe:2.3:a:facebook:react:19.1.1:*:*:*:*:*:*:*","cpe:2.3:a:facebook:react:19.2.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"19.0.0"},{"last_affected":"19.0.0"},{"introduced":"19.1.0"},{"last_affected":"19.1.0"},{"introduced":"19.1.1"},{"last_affected":"19.1.1"},{"introduced":"19.2.0"},{"last_affected":"19.2.0"}],"source":"CPE_STRING"}}],"versions":["19.0.0","19.1.0","19.1.1","19.2.0","v19.0.0","v19.2.0","v19.1.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-55182.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/vercel/next.js","events":[{"introduced":"51bfe3c1863b191f4b039bc230e8ed5c57b0baf3"},{"fixed":"3d663f2141a05adb975de4e9dae4c49780791881"},{"introduced":"dafcd43fac3ef9d0ffd94f9c94fd61db4449df25"},{"fixed":"aeb69d97f8aad106f4760ff04f6d3aaa33597635"},{"introduced":"b0416fbb44d1d148b6322ed79b6448d588260e49"},{"fixed":"25ba2c26f42dc33a72c7ff39710fcad9b19d9658"},{"introduced":"b2ff04995be722a5c93225e16e1c7fcc8bb53f91"},{"fixed":"2f026aae46027d9575494fb3aecbd0d75fd674f0"},{"introduced":"7ad467409b67691ae4f5dc4dc47f1a247c4ba988"},{"fixed":"49668475daba15ef8cea1d8e469dc0f9a765b635"},{"introduced":"7e08c8223d64bc2add7a0e5a323cbce0a84bb292"},{"fixed":"3eaf68b09b2b6b8c0c8e080a9713e131a78dc529"},{"introduced":"950609f96f694c5475d18cd2d72a0052ca04d4b9"},{"fixed":"7492122a3bbc6655b64ccba04076c73ab418cdcc"},{"last_affected":"950609f96f694c5475d18cd2d72a0052ca04d4b9"},{"introduced":"74be1f68c2ed99671d66e3e7f1337b997e74f464"},{"last_affected":"33759e0be7d31f8a5d59544267f7ec9b914f37e5"}],"database_specific":{"extracted_events":[{"introduced":"15.0.0"},{"fixed":"15.0.5"},{"introduced":"15.1.0"},{"fixed":"15.1.9"},{"introduced":"15.2.0"},{"fixed":"15.2.6"},{"introduced":"15.3.0"},{"fixed":"15.3.6"},{"introduced":"15.4.0"},{"fixed":"15.4.8"},{"introduced":"15.5.0"},{"fixed":"15.5.7"},{"introduced":"16.0.0"},{"fixed":"16.0.7"},{"introduced":"16.0.0-NA"},{"last_affected":"16.0.0-NA"},{"introduced":"14.3.0-canary77"},{"last_affected":"14.3.0-canary77"},{"introduced":"14.3.0-canary78"},{"last_affected":"14.3.0-canary78"},{"introduced":"14.3.0-canary79"},{"last_affected":"14.3.0-canary79"},{"introduced":"14.3.0-canary80"},{"last_affected":"14.3.0-canary80"},{"introduced":"14.3.0-canary81"},{"last_affected":"14.3.0-canary81"},{"introduced":"14.3.0-canary82"},{"last_affected":"14.3.0-canary82"},{"introduced":"14.3.0-canary83"},{"last_affected":"14.3.0-canary83"},{"introduced":"14.3.0-canary84"},{"last_affected":"14.3.0-canary84"},{"introduced":"14.3.0-canary85"},{"last_affected":"14.3.0-canary85"},{"introduced":"14.3.0-canary86"},{"last_affected":"14.3.0-canary86"},{"introduced":"14.3.0-canary87"},{"last_affected":"14.3.0-canary87"},{"introduced":"15.6.0-NA"},{"last_affected":"15.6.0-NA"},{"introduced":"15.6.0-canary0"},{"last_affected":"15.6.0-canary0"},{"introduced":"15.6.0-canary1"},{"last_affected":"15.6.0-canary1"},{"introduced":"15.6.0-canary10"},{"last_affected":"15.6.0-canary10"},{"introduced":"15.6.0-canary11"},{"last_affected":"15.6.0-canary11"},{"introduced":"15.6.0-canary12"},{"last_affected":"15.6.0-canary12"},{"introduced":"15.6.0-canary13"},{"last_affected":"15.6.0-canary13"},{"introduced":"15.6.0-canary14"},{"last_affected":"15.6.0-canary14"},{"introduced":"15.6.0-canary15"},{"last_affected":"15.6.0-canary15"},{"introduced":"15.6.0-canary16"},{"last_affected":"15.6.0-canary16"},{"introduced":"15.6.0-canary17"},{"last_affected":"15.6.0-canary17"},{"introduced":"15.6.0-canary18"},{"last_affected":"15.6.0-canary18"},{"introduced":"15.6.0-canary19"},{"last_affected":"15.6.0-canary19"},{"introduced":"15.6.0-canary2"},{"last_affected":"15.6.0-canary2"},{"introduced":"15.6.0-canary20"},{"last_affected":"15.6.0-canary20"},{"introduced":"15.6.0-canary21"},{"last_affected":"15.6.0-canary21"},{"introduced":"15.6.0-canary22"},{"last_affected":"15.6.0-canary22"},{"introduced":"15.6.0-canary23"},{"last_affected":"15.6.0-canary23"},{"introduced":"15.6.0-canary24"},{"last_affected":"15.6.0-canary24"},{"introduced":"15.6.0-canary25"},{"last_affected":"15.6.0-canary25"},{"introduced":"15.6.0-canary26"},{"last_affected":"15.6.0-canary26"},{"introduced":"15.6.0-canary27"},{"last_affected":"15.6.0-canary27"},{"introduced":"15.6.0-canary28"},{"last_affected":"15.6.0-canary28"},{"introduced":"15.6.0-canary29"},{"last_affected":"15.6.0-canary29"},{"introduced":"15.6.0-canary3"},{"last_affected":"15.6.0-canary3"},{"introduced":"15.6.0-canary30"},{"last_affected":"15.6.0-canary30"},{"introduced":"15.6.0-canary31"},{"last_affected":"15.6.0-canary31"},{"introduced":"15.6.0-canary32"},{"last_affected":"15.6.0-canary32"},{"introduced":"15.6.0-canary33"},{"last_affected":"15.6.0-canary33"},{"introduced":"15.6.0-canary34"},{"last_affected":"15.6.0-canary34"},{"introduced":"15.6.0-canary35"},{"last_affected":"15.6.0-canary35"},{"introduced":"15.6.0-canary36"},{"last_affected":"15.6.0-canary36"},{"introduced":"15.6.0-canary37"},{"last_affected":"15.6.0-canary37"},{"introduced":"15.6.0-canary38"},{"last_affected":"15.6.0-canary38"},{"introduced":"15.6.0-canary39"},{"last_affected":"15.6.0-canary39"},{"introduced":"15.6.0-canary4"},{"last_affected":"15.6.0-canary4"},{"introduced":"15.6.0-canary40"},{"last_affected":"15.6.0-canary40"},{"introduced":"15.6.0-canary41"},{"last_affected":"15.6.0-canary41"},{"introduced":"15.6.0-canary42"},{"last_affected":"15.6.0-canary42"},{"introduced":"15.6.0-canary43"},{"last_affected":"15.6.0-canary43"},{"introduced":"15.6.0-canary44"},{"last_affected":"15.6.0-canary44"},{"introduced":"15.6.0-canary45"},{"last_affected":"15.6.0-canary45"},{"introduced":"15.6.0-canary46"},{"last_affected":"15.6.0-canary46"},{"introduced":"15.6.0-canary47"},{"last_affected":"15.6.0-canary47"},{"introduced":"15.6.0-canary48"},{"last_affected":"15.6.0-canary48"},{"introduced":"15.6.0-canary49"},{"last_affected":"15.6.0-canary49"},{"introduced":"15.6.0-canary5"},{"last_affected":"15.6.0-canary5"},{"introduced":"15.6.0-canary50"},{"last_affected":"15.6.0-canary50"},{"introduced":"15.6.0-canary51"},{"last_affected":"15.6.0-canary51"},{"introduced":"15.6.0-canary52"},{"last_affected":"15.6.0-canary52"},{"introduced":"15.6.0-canary53"},{"last_affected":"15.6.0-canary53"},{"introduced":"15.6.0-canary54"},{"last_affected":"15.6.0-canary54"},{"introduced":"15.6.0-canary55"},{"last_affected":"15.6.0-canary55"},{"introduced":"15.6.0-canary56"},{"last_affected":"15.6.0-canary56"},{"introduced":"15.6.0-canary57"},{"last_affected":"15.6.0-canary57"},{"introduced":"15.6.0-canary6"},{"last_affected":"15.6.0-canary6"},{"introduced":"15.6.0-canary7"},{"last_affected":"15.6.0-canary7"},{"introduced":"15.6.0-canary8"},{"last_affected":"15.6.0-canary8"},{"introduced":"15.6.0-canary9"},{"last_affected":"15.6.0-canary9"}],"source":["CPE_RANGE","CPE_STRING"],"cpe":["cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:16.0.0:-:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:14.3.0:canary77:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:14.3.0:canary78:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:14.3.0:canary79:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:14.3.0:canary80:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:14.3.0:canary81:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:14.3.0:canary82:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:14.3.0:canary83:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:14.3.0:canary84:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:14.3.0:canary85:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:14.3.0:canary86:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:14.3.0:canary87:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:15.6.0:-:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:15.6.0:canary0:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:15.6.0:canary1:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:15.6.0:canary10:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:15.6.0:canary11:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:15.6.0:canary12:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:15.6.0:canary13:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:15.6.0:canary14:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:15.6.0:canary15:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:15.6.0:canary16:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:15.6.0:canary17:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:15.6.0:canary18:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:15.6.0:canary19:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:15.6.0:canary2:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:15.6.0:canary20:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:15.6.0:canary21:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:15.6.0:canary22:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:15.6.0:canary23:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:15.6.0:canary24:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:15.6.0:canary25:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:15.6.0:canary26:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:15.6.0:canary27:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:15.6.0:canary28:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:15.6.0:canary29:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:15.6.0:canary3:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:15.6.0:canary30:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:15.6.0:canary31:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:15.6.0:canary32:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:15.6.0:canary33:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:15.6.0:canary34:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:15.6.0:canary35:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:15.6.0:canary36:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:15.6.0:canary37:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:15.6.0:canary38:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:15.6.0:canary39:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:15.6.0:canary4:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:15.6.0:canary40:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:15.6.0:canary41:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:15.6.0:canary42:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:15.6.0:canary43:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:15.6.0:canary44:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:15.6.0:canary45:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:15.6.0:canary46:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:15.6.0:canary47:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:15.6.0:canary48:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:15.6.0:canary49:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:15.6.0:canary5:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:15.6.0:canary50:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:15.6.0:canary51:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:15.6.0:canary52:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:15.6.0:canary53:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:15.6.0:canary54:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:15.6.0:canary55:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:15.6.0:canary56:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:15.6.0:canary57:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:15.6.0:canary6:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:15.6.0:canary7:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:15.6.0:canary8:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:15.6.0:canary9:*:*:*:node.js:*:*"]}}],"versions":["14.3.0-canary77","14.3.0-canary78","14.3.0-canary79","14.3.0-canary80","14.3.0-canary81","14.3.0-canary82","14.3.0-canary83","14.3.0-canary84","14.3.0-canary85","14.3.0-canary86","14.3.0-canary87","15.6.0-NA","15.6.0-canary1","15.6.0-canary10","15.6.0-canary11","15.6.0-canary12","15.6.0-canary13","15.6.0-canary14","15.6.0-canary15","15.6.0-canary16","15.6.0-canary17","15.6.0-canary18","15.6.0-canary19","15.6.0-canary2","15.6.0-canary20","15.6.0-canary21","15.6.0-canary22","15.6.0-canary23","15.6.0-canary24","15.6.0-canary25","15.6.0-canary26","15.6.0-canary27","15.6.0-canary28","15.6.0-canary29","15.6.0-canary3","15.6.0-canary30","15.6.0-canary31","15.6.0-canary32","15.6.0-canary33","15.6.0-canary34","15.6.0-canary35","15.6.0-canary36","15.6.0-canary37","15.6.0-canary38","15.6.0-canary39","15.6.0-canary4","15.6.0-canary40","15.6.0-canary41","15.6.0-canary42","15.6.0-canary43","15.6.0-canary44","15.6.0-canary45","15.6.0-canary46","15.6.0-canary47","15.6.0-canary48","15.6.0-canary49","15.6.0-canary5","15.6.0-canary50","15.6.0-canary51","15.6.0-canary52","15.6.0-canary53","15.6.0-canary54","15.6.0-canary55","15.6.0-canary56","15.6.0-canary57","15.6.0-canary6","15.6.0-canary7","15.6.0-canary8","15.6.0-canary9","v15.5.6","v15.3.5","v15.2.5","v15.1.8","v16.0.6","v15.0.4","v16.0.5","v16.0.4","v16.0.3","v16.0.2","v16.0.1","v16.0.1-canary.6","v16.0.1-canary.5","v16.0.1-canary.4","v16.0.1-canary.3","v16.0.1-canary.2","v16.0.1-canary.1","v16.0.1-canary.0","v16.0.0","v15.5.5","v15.4.7","v15.5.4","v15.6.0-canary.9","v15.6.0-canary.8","v15.6.0-canary.7","v15.6.0-canary.6","v15.6.0-canary.5","v15.6.0-canary.4","v15.6.0-canary.3","v15.5.3","v15.6.0-canary.2","v15.6.0-canary.1","v15.6.0-canary.0","v15.5.1-canary.39","v15.5.1-canary.38","v15.5.1-canary.37","v15.5.1-canary.36","v15.5.1-canary.35","v15.5.1-canary.34","v15.5.1-canary.33","v15.5.1-canary.32","v15.5.1-canary.31","v15.5.1-canary.30","v15.5.1-canary.29","v15.5.1-canary.28","v15.5.1-canary.27","v15.5.1-canary.26","v15.5.1-canary.25","v15.5.1-canary.24","v15.5.1-canary.23","v15.5.1-canary.22","v15.5.1-canary.21","v15.5.1-canary.20","v15.5.1-canary.19","v15.5.1-canary.18","v15.5.2","v15.5.1-canary.17","v15.5.1-canary.16","v15.5.1-canary.15","v15.5.1-canary.14","v15.5.1-canary.13","v15.5.1-canary.12","v15.5.1-canary.11","v15.5.1-canary.10","v15.5.1","v15.5.1-canary.9","v15.5.1-canary.8","v15.5.0","v15.5.1-canary.7","v15.5.1-canary.6","v15.5.1-canary.5","v15.5.1-canary.4","v15.5.1-canary.3","v15.5.1-canary.2","v15.5.1-canary.1","v15.5.1-canary.0","v15.4.6","v15.4.5","v15.4.4","v15.4.3","v15.4.2","v15.4.1","v15.4.0","v15.3.4","v15.3.3","v15.3.2","v15.3.1","v15.3.0","v15.2.4","v15.2.3","v15.2.2","v15.2.2-canary.6","v15.2.2-canary.5","v15.2.2-canary.4","v15.2.2-canary.3","v15.2.2-canary.2","v15.2.2-canary.1","v15.2.2-canary.0","v15.2.1","v15.2.1-canary.6","v15.2.1-canary.5","v15.2.1-canary.4","v15.2.1-canary.3","v15.2.1-canary.2","v15.2.1-canary.1","v15.2.1-canary.0","v15.2.0","v15.1.7","v15.1.6","v15.1.5","v15.1.4","v15.1.3","v15.1.2","v15.1.1","v15.1.0","v15.0.3","v15.0.3-canary.9","v15.0.3-canary.8","v15.0.3-canary.7","v15.0.3-canary.6","v15.0.3-canary.5","v15.0.3-canary.4","v15.0.3-canary.3","v15.0.3-canary.2","v15.0.3-canary.1","v15.0.3-canary.0","v15.0.2","v15.0.2-canary.11","v15.0.2-canary.10","v15.0.2-canary.9","v15.0.2-canary.8","v15.0.2-canary.7","v15.0.2-canary.6","v15.0.2-canary.5","v15.0.2-canary.4","v15.0.2-canary.3","v15.0.2-canary.2","v15.0.2-canary.1","v15.0.2-canary.0","v15.0.1","v15.0.1-canary.3","v15.0.1-canary.2","v15.0.1-canary.1","v15.0.1-canary.0","v15.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-55182.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"}]}