Actively exploited in the wild
Meta React Server Components Remote Code Execution Vulnerability
Meta - React Server Components · Listed in the CISA KEV since 2025-12-05. This indicates confirmed attacks in production environments.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2025-55182
CriticalCVSS 10.0KEVExploitation Probability (EPSS)
Very high risk100th percentile - higher than 100% of all known CVEs
Summary
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0, including packages react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.
Risk Assessment
An attacker can remotely execute arbitrary code on the server, potentially leading to full control of the application and data.
Recommendation
Update React Server Components packages to patched versions. Restrict access to Server Function endpoints.
Other vulnerabilities in React Server Components
See all- CVE-2025-67779High
Vulnerability in React Server Components versions 19.0.2, 19.1.3 and 19.2.2 is an incomplete fix for CVE-2025-55184 and still allows unsafe deserialization of payloads from HTTP requests to Server Function endpoints, causing an infinite loop that hangs the server process.
- CVE-2025-55184High
Pre-authentication denial of service vulnerability in React Server Components versions 19.0.0, 19.0.1, 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack, allows unsafe deserialization of payloads from HTTP requests to Server Function endpoints, causing an infinite loop that hangs the server process.
- CVE-2025-55183Medium
An information leak vulnerability exists in specific configurations of React Server Components versions 19.0.0, 19.0.1, 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the packages react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. A specifically crafted HTTP request sent to a vulnerable Server Function may unsafely return the source code of any Server Function.
- CVE-2026-23869High
A denial of service vulnerability in React Server Components (react-server-dom-parcel, react-server-dom-turbopack, react-server-dom-webpack) versions 19.0.0-19.0.4, 19.1.0-19.1.5, and 19.2.0-19.2.4. Specially crafted HTTP requests to Server Function endpoints cause excessive CPU usage for about a minute, ending in a catchable error.
- CVE-2026-23864High
Multiple denial of service vulnerabilities have been found in React Server Components packages (react-server-dom-parcel, react-server-dom-turbopack, react-server-dom-webpack). Specially crafted HTTP requests to Server Function endpoints can cause server crashes, out-of-memory exceptions, or excessive CPU usage.
Original NVD description (English source)
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS