CVE-2025-55182:
Critical pre-authentication remote code execution vulnerability in React Server Components versions 19.0.0 to 19.2.0.
Score
A numerical rating that indicates how dangerous this vulnerability is.
10.0Critical- Published Date:Dec 3, 2025
- CISA KEV Date:Dec 5, 2025
- Industries Affected:20
2 DaysThreat Predictions
- EPSS Score:65.1
- EPSS Percentile:98%
Exploitability
- Score:3.9
- Attack Vector:NETWORK
- Attack Complexity:LOW
- Privileges Required:NONE
- User Interaction:NONE
- Scope:CHANGED
Impact
- Score:6.0
- Confidentiality Impact:HIGH
- Integrity Impact:HIGH
- Availability Impact:HIGH
Description Preview
Critical pre-authentication remote code execution vulnerability in React Server Components versions 19.0.0 to 19.2.0.
Overview
The vulnerability (CVE-2025-55182) in React Server Components poses a critical security risk with a CVSS v3.1 base score of 10.0. It allows unauthenticated remote attackers to execute arbitrary code on affected servers with minimal complexity. The attack vector is network-based, requiring no user interaction or privileges. The scope is changed, indicating potential impact beyond the vulnerable component. The vulnerability affects confidentiality, integrity, and availability, all rated as high impact. Given its critical nature and ease of exploitation, immediate attention and remediation are crucial for all users of affected React Server Components versions.
Remediation
- While specific remediation steps are not provided in the CVE information, general best practices for addressing such vulnerabilities include:
- 1. Immediately update to a patched version of React Server Components when available.
- 2. If an update is not immediately possible, consider temporarily disabling or isolating affected components.
- 3. Implement strong input validation and sanitization for all data received by server functions.
- 4. Use secure deserialization practices and avoid deserializing untrusted data.
- 5. Monitor systems for any signs of exploitation attempts.
- 6. Conduct a thorough security audit of your application, focusing on server-side code handling client requests.
- Organizations should closely follow official React security advisories for specific patching instructions and additional mitigation strategies.
References
- [1] React. (2025, December 3). Critical Security Vulnerability in React Server Components. React Blog. https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components
- [2] Facebook. (2025, December 3). Security Advisory: CVE-2025-55182. Facebook Security. https://www.facebook.com/security/advisories/cve-2025-55182
- [3] oss-security. (2025, December 3). [CVE-2025-55182] Critical RCE in React Server Components. Openwall. http://www.openwall.com/lists/oss-security/2025/12/03/4
Armis Early Warning
Armis Early Warning provides proactive threat intelligence and early detection capabilities.Click here to learn more.
- Armis Alert Date:*No Data*
- CISA KEV Date:Dec 5, 2025
- Days Early:2 Days
Industries Affected
Below is a list of industries most commonly impacted or potentially at risk based on intelligence.
