Skip to content

CVE · Exploited · On CISA KEV

CVE-2025-55182

Meta React Server Components Remote Code Execution Vulnerability

10.0
CVSS 3.1
3
stories
DEC 5
added to KEV
Severity
10.0 Critical · vendor score
Vendor
Meta
Product
React Server Components
Published
Dec 3, 2025
Added to KEV
Dec 5, 2025
KEV deadline
Dec 12, 2025
Ransomware use
Known
Weakness
CWE-502
Part of React2Shell →

What it is

Meta React Server Components contains a remote code execution vulnerability that could allow unauthenticated remote code execution by exploiting a flaw in how React decodes payloads sent to React Server Function endpoints. Please note CVE-2025-66478 has been rejected, but it is associated with CVE-2025- 55182.

From CISA's Known Exploited Vulnerabilities catalog

Decipher coverage · 3 stories

Newest first ↑
  1. VulnerabilitiesCritical Flaw CVE-2025-55182 Affects React Server ComponentsAll developers using React Server Components are urged to upgrade immediately, and some apps that don’t include React Server Function endpoints could be vulnerable, as well.DENNIS FISHER · 2 MIN
  2. IntrusionsBroad Exploit Activity Targets React2Shell FlawThe vulnerability was disclosed publicly on Dec. 3 and researchers and threat intelligence teams immediately began seeing opportunistic and targeted exploitation attempts.DENNIS FISHER · 3 MIN
  3. VulnerabilitiesReact2Shell Attacks Continue to BuildAfter a peak of more than 430,000 attack sessions in late December, daily volumes targeting React2Shell have stabilized in the 300,000 to 400,000 range.DENNIS FISHER · 1 MIN

Official references

7 sources

Registries

RegistryNVDScore, weakness and every referenceRegistryCVE.orgThe official CVE recordRegistryCISA KEVKnown exploited, with the federal deadline

Advisories, fixes & analysis

Fixreact.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-componentsVendor advisoryfacebook.com/security/advisories/cve-2025-55182Fixopenwall.com/lists/oss-security/2025/12/03/4Analysisaws.amazon.com/blogs/security/china-nexus-cyber-threat-groups-rapidly-exploit-react2shell-vulnerability-cve-2025-55182