What is the CVSS score of CVE-2025-55182?

CVE-2025-55182 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 71.1%.

Is there a public PoC exploit available for CVE-2025-55182?

Yes, a public proof-of-concept exploit is available for CVE-2025-55182. Prioritise patching immediately. EPSS: 71.1%.

How to fix or mitigate CVE-2025-55182?

Within 24 hours: Identify all systems running React Server Components versions 19.0.0, 19.1.0, 19.1.1, or 19.2.0; isolate or restrict network access to affected Server Function endpoints if patching cannot be completed immediately. Within 7 days: Apply vendor patches to all affected systems and verify remediation through testing. Within 30 days: Conduct forensic review of server logs for indicators of exploitation and perform security assessment of patched systems.

React CVE-2025-55182

EUVD-2025-200983 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2025-12-03 cve-assign@fb.com

GHSA-fv66-9v8q-g76r

RCE Deserialization React Facebook Vercel Next Js

10.0

CVSS 3.1 · Vendor: fb

View

Vulnerability Assessment

Weakness	CWE CWE-502 OWASP Top 10:2025 A08:2025 - Software or Data Integrity Failures ASVS 5.0 V1 - Encoding and Sanitization Safe deserialization, type allowlists MITRE ATT&CK 2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Impact	CVSS 10.0 (Critical). EPSS 71.1% — very high exploitation probability. KEV-listed — actively exploited. Public PoC available. Pre-authentication — any HTTP request. React is the most popular web framework. Patch available. Server-side code execution.
Exploit ScenarioDerived	An attacker sends a crafted HTTP POST request to any Server Function endpoint of a React 19 application. The malicious payload is deserialized by the React server runtime, executing arbitrary code on the server. No authentication is required — Server Function endpoints accept requests from any client. The attacker gains: server-level code execution, access to databases and environment variables (API keys, secrets), ability to modify application behavior, and potential access to the hosting infrastructure.

Act Now Prioritize within 24-48h. Why: In CISA KEV with patch available.

Exploited in the wild (CISA KEV) Patch available 71.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 15, 2026

React Server Components in React 19.x contain a critical pre-authentication remote code execution vulnerability (CVE-2025-55182, CVSS 10.0) through unsafe deserialization of HTTP request payloads. With EPSS 71.1% and KEV listing, this vulnerability affects any application using React Server Components with react-server-dom-webpack, react-server-dom-turbopack, or react-server-dom-parcel — enabling complete server compromise through a single HTTP request.

Earlier versions of this analysis (1)

v1 Mar 15, 2026 - 16:14 CVSS 10.0

React Server Components unsafely deserialize payloads from HTTP requests to Server Function endpoints (CWE-502), enabling pre-authentication remote code execution on any application using React 19.x Server Components.

RemediationAI

Upgrade React and all react-server-dom-* packages immediately. This is emergency priority for any application using React Server Components. If unable to upgrade, consider temporarily disabling Server Functions. Audit server logs for exploitation attempts. Rotate all secrets and API keys that may have been exposed.

Affected VersionsENISA

react-server-dom-webpack 19.1.0 ≤19.1.1

react-server-dom-turbopack 19.0.0 ≤19.2.0

react-server-dom-webpack 19.2.0 ≤19.2.0

react-server-dom-webpack 19.0.0 ≤19.0.0

react-server-dom-parcel 19.0.0 ≤19.0.0

react-server-dom-turbopack 19.0.0 ≤19.0.0

react-server-dom-parcel 19.2.0 ≤19.2.0

react-server-dom-turbopack 19.1.0 ≤19.1.1

react-server-dom-parcel 19.0.0 ≤19.2.0

react-server-dom-turbopack 19.2.0 ≤19.2.0

react-server-dom-webpack 19.0.0 ≤19.2.0

react-server-dom-parcel 19.1.0 ≤19.1.1

Affected Packages

npm react-server-dom-parcel fix: 19.0.1, 19.1.2, 19.2.1

npm react-server-dom-turbopack fix: 19.0.1, 19.1.2, 19.2.1

npm react-server-dom-webpack fix: 19.0.1, 19.1.2, 19.2.1

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 3 packages in npm

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

React Server Components (RSC) introduced in React 19 allow server-side rendering and Server Functions (formerly Server Actions). The vulnerability exists in the deserialization of HTTP request bodies sent to Server Function endpoints. The deserializer processes attacker-controlled data without proper validation, enabling code execution on the server. This affects three official RSC packages: react-server-dom-webpack, react-server-dom-turbopack, and react-server-dom-parcel. Given React's dominance in web development, the potential impact is enormous.

Know when React gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (fb) PRIMARY 10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Red Hat 10.0 CRITICAL

Primary rating from Vendor (fb).

CVSS VectorVendor: fb

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Mar 15, 2026 - 16:14 nvd

Patch available

Added to CISA KEV

Dec 10, 2025 - 02:00 cisa

CISA KEV

PoC Detected

Dec 10, 2025 - 02:00 vuln.today

Public exploit code

CVE Published

Dec 03, 2025 - 16:15 nvd

CRITICAL 10.0

DescriptionCVE.org

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

10 npm packages depend on react-server-dom-webpack (6 direct, 4 indirect)

Ecosystem-wide dependent count for version 19.0.0.

Executive ViewAI

Why It Matters

A critical remote code execution vulnerability affecting React Server Components allows unauthenticated attackers to execute arbitrary code on affected systems with a 71% exploitation probability. Organizations using the vulnerable React versions (19.0.0-19.2.0) face immediate risk of complete system compromise, data breach, and service disruption.

Business Impact: Severe

Compensating Controls

Apply vendor patch. If immediate patching is not feasible: implement Web Application Firewall (WAF) rules to block suspicious deserialization payloads to Server Function endpoints; restrict network access to Server Function endpoints to trusted sources only; disable Server Functions if not operationally required; monitor for exploitation attempts in HTTP request logs.

Threat Intelligence Overview

Threat Score

9.1/10

Composite threat intelligence

EPSS Score

71.1%

Top 1% exploitable

EUVD KEV

Listed

EU Exploited Vulnerability

Threat Intel

1 sources

Exploit

POC

Public exploit code exists

Data Quality

12 sources

Confidence: High

EUVD

NVD

CVE.org

CISA KEV

EPSS CERT-EU POC (2) THREAT Vendor CIRCL

Exploit-DB

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV Yes

Public POC Yes

EPSS 71.1%

Patch available Yes

Active threat Yes

Deciding rule

In CISA KEV with patch available

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Immediate

Exploitation· derived

Active

System Exposure· derived

Open

Automatable· derived

Yes

Human Impact

Very High

Priority Score

216

Low Medium High Critical

KEV: +50

EPSS: +71

CVSS: +50

PoC: +20

Weaponized: +15

Threat intel: +10

Gov advisory: 0

Attack Technique

Insecure Deserialization CRITICAL

Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.

Remote Code Execution CRITICAL

Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.