CVE-2025-55182

● Known-exploited CRITICAL ⚠ Exploit

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, rea...

Affects 2 products across 2 vendors.

CVSS 3.110.0
EPSS99.8%
Percentile100th
PatchUnknown
Known-exploited since2025-12-05
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, no authentication required, no user interaction needed, can impact systems beyond the vulnerable component, full confidentiality impact, full integrity impact, full availability impact.
CWE Weakness Definitions
CWE-502: Deserialization of Untrusted Data

Software deserializes untrusted data without validation, allowing crafted objects to execute arbitrary code.

Related Attack Patterns (CAPEC)
CAPEC-586 Object Injection
via CWE-502

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ AI Analysis — automated analysis, not human-reviewed

A critical pre-authentication remote code execution vulnerability exists in React Server Components, affecting versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0. This vulnerability allows an attacker to execute arbitrary code on the server by sending a specially crafted payload via HTTP requests. Given the high CVSS score and the availability of public exploits, immediate action is required to mitigate the risk.

BSID: BS-2025-GLOBAL-270251-C • Model: Qwen/Qwen2.5-72B-Instruct-AWQ • Confidence: HIGH

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2025-55182?
A critical pre-authentication remote code execution vulnerability exists in React Server Components, affecting versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0. This vulnerability allows an attacker to execute arbitrary code on the server by sending a specially crafted payload via HTTP requests. Given the high CVSS score and the availability of public exploits, immediate action is required to mitigate the risk.
What is the CVSS score for CVE-2025-55182?
CVE-2025-55182 has CVSS 10.0 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS: 99.8%.
Is CVE-2025-55182 actively exploited?
Yes. CVE-2025-55182 is in the CISA known-exploited catalog (added 2025-12-05). Active exploitation confirmed. Immediate patching required.
How do I remediate CVE-2025-55182?
Priority: IMMEDIATE. Advisory: https://www.facebook.com/security/advisories/cve-2025-55182 PSIRT: [email protected]
What systems are affected by CVE-2025-55182?
CVE-2025-55182 affects Facebook React; Vercel Next.Js.
What NERC-CIP standard applies to CVE-2025-55182?
NERC CIP CIP-007 CIP-007-R2: This CVE violates CIP-007-R2 as it allows unauthorized access to the system, which could compromise the integrity and availability of critical assets.
What IEC 62443 requirement maps to CVE-2025-55182?
IEC 62443 SR 7.6: This CVE maps to SR 7.6 because it involves a vulnerability that can be exploited remotely, leading to unauthorized control of the system, which is a significant risk to operational integrity and safety.
Vulnerability Details
CVE IDCVE-2025-55182
BSIDBS-2025-GLOBAL-270251-C BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Published2025-12-03
Last Modified2026-10-18
ICS Relevance15%
Weakness (CWE)
Deserialization of Untrusted Data
SourceNVD
Official Description

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

The vulnerability arises from unsafe deserialization of payloads in HTTP requests to Server Function endpoints. An attacker can exploit this by sending a maliciously crafted payload, leading to remote code execution on the server without authentication. This can result in full control over the affected system, potentially leading to data theft, service disruption, and further attacks within the network.

Exploitation Likelihood: CRITICAL

Affected Products
VendorProductAffected Versions
Facebook React 19.0.0 19.1.0 19.1.1 19.2.0
Vercel Next.Js 14.3.0 15.6.0 ≥ 15.0.0, < 15.0.5 ≥ 15.1.0, < 15.1.9 ≥ 15.2.0, < 15.2.6 ≥ 15.3.0, < 15.3.6
+3 more≥ 15.4.0, < 15.4.8 ≥ 15.5.0, < 15.5.7 ≥ 16.0.0, < 16.0.7
Remediation
View Vendor Advisory →

Remediation Priority: IMMEDIATE

Vendor PSIRT: [email protected]
Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 324 Days
CISA known-exploited● Active Exploitation Confirmed (added 2025-12-05)
Public Exploit⚠ Available — Reference
PoC CodeNot confirmed
● Compensating Controls — AI-drafted, review before deploying MEDIUM CONFIDENCE

Implement strict input validation and sanitization for all HTTP requests to Server Function endpoints. Consider using a Web Application Firewall (WAF) to filter out suspicious requests.

No reliable network detection signature exists for this vulnerability class — apply the compensating controls above and the vendor patch. A network rule is only drafted when a concrete on-the-wire signature can be grounded in the advisory.

NERC CIP: CIP-007 CIP-007-R2
This CVE violates CIP-007-R2 as it allows unauthorized access to the system, which could compromise the integrity and availability of critical assets.
IEC 62443: SR 7.6
This CVE maps to SR 7.6 because it involves a vulnerability that can be exploited remotely, leading to unauthorized control of the system, which is a significant risk to operational integrity and safety.

Drafted by AI and not validated for your network. Test in an isolated environment before any production deployment. Compensating control only - does not replace vendor patch.

AI Enrichment Record — provenance & audit hash
ModelQwen/Qwen2.5-72B-Instruct-AWQ
ConfidenceHIGH
Enriched At2026-05-24
SHA-512 Audit Hash0c41d2d326205b3fb4628e0aeb871b6524bdd87f203f0358ce0acdd682e7292592aa348065ea6be0e5ff260085ea6a3c1046bc578a72a6199d2a14d9fc68790e
Related CVEs affecting Facebook
CVE-2016-6872 9.8 Integer overflow in StringUtil::implode in Facebook HHVM before 3.15.0 allows... CVE-2016-6873 9.8 Self recursion in compact in Facebook HHVM before 3.15.0 allows attackers to ... CVE-2016-6871 9.8 Integer overflow in bcmath in Facebook HHVM before 3.15.0 allows attackers to... CVE-2016-6870 9.8 Out-of-bounds write in the (1) mb_detect_encoding, (2) mb_send_mail, and (3) ... CVE-2016-6874 9.8 The array_*_recursive functions in Facebook HHVM before 3.15.0 allows attacke...
View all Facebook CVEs →

This Vulnerability Is Being Actively Exploited

CVE-2025-55182 is on the CISA known-exploited list - confirmed active exploitation in the wild. BreachSpider flags known-exploited CVEs on the ICS assets they affect, with known-exploited status synced daily from CISA.

Create a free account →