CVE-2025-55182
Dec. 10, 2025, 2 a.m.
10.0
Critical
Description
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.
Product(s) Impacted
| Vendor | Product | Versions |
|---|---|---|
|
|
|
| Vercel |
|
|
Weaknesses
Common security weaknesses mapped to this vulnerability.
CWE-502
Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
*CPE(s)
Affected systems and software identified for this CVE.
| Type | Vendor | Product | Version | Update | Edition | Language | Software Edition | Target Software | Target Hardware | Other Information |
|---|---|---|---|---|---|---|---|---|---|---|
| a | react | 19.0.0 | / | / | / | / | / | / | / | |
| a | react | 19.1.0 | / | / | / | / | / | / | / | |
| a | react | 19.1.1 | / | / | / | / | / | / | / | |
| a | react | 19.2.0 | / | / | / | / | / | / | / | |
| a | vercel | next.js | / | / | / | / | / | node.js | / | / |
| a | vercel | next.js | / | / | / | / | / | node.js | / | / |
| a | vercel | next.js | / | / | / | / | / | node.js | / | / |
| a | vercel | next.js | / | / | / | / | / | node.js | / | / |
| a | vercel | next.js | / | / | / | / | / | node.js | / | / |
| a | vercel | next.js | / | / | / | / | / | node.js | / | / |
| a | vercel | next.js | / | / | / | / | / | node.js | / | / |
| a | vercel | next.js | 14.3.0 | canary77 | / | / | / | node.js | / | / |
| a | vercel | next.js | 14.3.0 | canary78 | / | / | / | node.js | / | / |
| a | vercel | next.js | 14.3.0 | canary79 | / | / | / | node.js | / | / |
| a | vercel | next.js | 14.3.0 | canary80 | / | / | / | node.js | / | / |
| a | vercel | next.js | 14.3.0 | canary81 | / | / | / | node.js | / | / |
| a | vercel | next.js | 14.3.0 | canary82 | / | / | / | node.js | / | / |
| a | vercel | next.js | 14.3.0 | canary83 | / | / | / | node.js | / | / |
| a | vercel | next.js | 14.3.0 | canary84 | / | / | / | node.js | / | / |
| a | vercel | next.js | 14.3.0 | canary85 | / | / | / | node.js | / | / |
| a | vercel | next.js | 14.3.0 | canary86 | / | / | / | node.js | / | / |
| a | vercel | next.js | 14.3.0 | canary87 | / | / | / | node.js | / | / |
| a | vercel | next.js | 15.6.0 | - | / | / | / | node.js | / | / |
| a | vercel | next.js | 15.6.0 | canary0 | / | / | / | node.js | / | / |
| a | vercel | next.js | 15.6.0 | canary1 | / | / | / | node.js | / | / |
| a | vercel | next.js | 15.6.0 | canary10 | / | / | / | node.js | / | / |
| a | vercel | next.js | 15.6.0 | canary11 | / | / | / | node.js | / | / |
| a | vercel | next.js | 15.6.0 | canary12 | / | / | / | node.js | / | / |
| a | vercel | next.js | 15.6.0 | canary13 | / | / | / | node.js | / | / |
| a | vercel | next.js | 15.6.0 | canary14 | / | / | / | node.js | / | / |
| a | vercel | next.js | 15.6.0 | canary15 | / | / | / | node.js | / | / |
| a | vercel | next.js | 15.6.0 | canary16 | / | / | / | node.js | / | / |
| a | vercel | next.js | 15.6.0 | canary17 | / | / | / | node.js | / | / |
| a | vercel | next.js | 15.6.0 | canary18 | / | / | / | node.js | / | / |
| a | vercel | next.js | 15.6.0 | canary19 | / | / | / | node.js | / | / |
| a | vercel | next.js | 15.6.0 | canary2 | / | / | / | node.js | / | / |
| a | vercel | next.js | 15.6.0 | canary20 | / | / | / | node.js | / | / |
| a | vercel | next.js | 15.6.0 | canary21 | / | / | / | node.js | / | / |
| a | vercel | next.js | 15.6.0 | canary22 | / | / | / | node.js | / | / |
| a | vercel | next.js | 15.6.0 | canary23 | / | / | / | node.js | / | / |
| a | vercel | next.js | 15.6.0 | canary24 | / | / | / | node.js | / | / |
| a | vercel | next.js | 15.6.0 | canary25 | / | / | / | node.js | / | / |
| a | vercel | next.js | 15.6.0 | canary26 | / | / | / | node.js | / | / |
| a | vercel | next.js | 15.6.0 | canary27 | / | / | / | node.js | / | / |
| a | vercel | next.js | 15.6.0 | canary28 | / | / | / | node.js | / | / |
| a | vercel | next.js | 15.6.0 | canary29 | / | / | / | node.js | / | / |
| a | vercel | next.js | 15.6.0 | canary3 | / | / | / | node.js | / | / |
| a | vercel | next.js | 15.6.0 | canary30 | / | / | / | node.js | / | / |
| a | vercel | next.js | 15.6.0 | canary31 | / | / | / | node.js | / | / |
| a | vercel | next.js | 15.6.0 | canary32 | / | / | / | node.js | / | / |
| a | vercel | next.js | 15.6.0 | canary33 | / | / | / | node.js | / | / |
| a | vercel | next.js | 15.6.0 | canary34 | / | / | / | node.js | / | / |
| a | vercel | next.js | 15.6.0 | canary35 | / | / | / | node.js | / | / |
| a | vercel | next.js | 15.6.0 | canary36 | / | / | / | node.js | / | / |
| a | vercel | next.js | 15.6.0 | canary37 | / | / | / | node.js | / | / |
| a | vercel | next.js | 15.6.0 | canary38 | / | / | / | node.js | / | / |
| a | vercel | next.js | 15.6.0 | canary39 | / | / | / | node.js | / | / |
| a | vercel | next.js | 15.6.0 | canary4 | / | / | / | node.js | / | / |
| a | vercel | next.js | 15.6.0 | canary40 | / | / | / | node.js | / | / |
| a | vercel | next.js | 15.6.0 | canary41 | / | / | / | node.js | / | / |
| a | vercel | next.js | 15.6.0 | canary42 | / | / | / | node.js | / | / |
| a | vercel | next.js | 15.6.0 | canary43 | / | / | / | node.js | / | / |
| a | vercel | next.js | 15.6.0 | canary44 | / | / | / | node.js | / | / |
| a | vercel | next.js | 15.6.0 | canary45 | / | / | / | node.js | / | / |
| a | vercel | next.js | 15.6.0 | canary46 | / | / | / | node.js | / | / |
| a | vercel | next.js | 15.6.0 | canary47 | / | / | / | node.js | / | / |
| a | vercel | next.js | 15.6.0 | canary48 | / | / | / | node.js | / | / |
| a | vercel | next.js | 15.6.0 | canary49 | / | / | / | node.js | / | / |
| a | vercel | next.js | 15.6.0 | canary5 | / | / | / | node.js | / | / |
| a | vercel | next.js | 15.6.0 | canary50 | / | / | / | node.js | / | / |
| a | vercel | next.js | 15.6.0 | canary51 | / | / | / | node.js | / | / |
| a | vercel | next.js | 15.6.0 | canary52 | / | / | / | node.js | / | / |
| a | vercel | next.js | 15.6.0 | canary53 | / | / | / | node.js | / | / |
| a | vercel | next.js | 15.6.0 | canary54 | / | / | / | node.js | / | / |
| a | vercel | next.js | 15.6.0 | canary55 | / | / | / | node.js | / | / |
| a | vercel | next.js | 15.6.0 | canary56 | / | / | / | node.js | / | / |
| a | vercel | next.js | 15.6.0 | canary57 | / | / | / | node.js | / | / |
| a | vercel | next.js | 15.6.0 | canary6 | / | / | / | node.js | / | / |
| a | vercel | next.js | 15.6.0 | canary7 | / | / | / | node.js | / | / |
| a | vercel | next.js | 15.6.0 | canary8 | / | / | / | node.js | / | / |
| a | vercel | next.js | 15.6.0 | canary9 | / | / | / | node.js | / | / |
| a | vercel | next.js | 16.0.0 | - | / | / | / | node.js | / | / |
References
Tags
CVSS Score
CVSS Data - 3.1
- Attack Vector: NETWORK
- Attack Complexity: LOW
- Privileges Required: NONE
- Scope: CHANGED
- Confidentiality Impact: HIGH
- Integrity Impact: HIGH
- Availability Impact: HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Timeline
Published: Dec. 3, 2025, 4:15 p.m.
Last Modified: Dec. 10, 2025, 2 a.m.
Last Modified: Dec. 10, 2025, 2 a.m.
Status : Analyzed
CVE has had analysis completed and all data associations made.
More infoSource
cve-assign@fb.com
Relations
Here is the list of observables linked to the vulnerability CVE-2025-55182 using threat intelligence.
- Disable or Modify Tools
- Exploit Public-Facing Application
- External Remote Services
- Web Shell
- Valid Accounts
- Account Discovery
- PowerShell
- Ingress Tool Transfer
- Remote Desktop Protocol
- Service Execution
- JavaScript
- Web Protocols
- Registry Run Keys / Startup Folder
- Command and Scripting Interpreter
- Network Denial of Service
- Tool
- Credentials In Files
- Email Collection
- Data from Local System
- File Deletion
- Exfiltration Over C2 Channel
- OS Credential Dumping
- Query Registry
- Symmetric Cryptography
- System Network Configuration Discovery
- Cloud Infrastructure Discovery
- Unsecured Credentials
- Indicator Removal
- Clear Command History
- System Owner/User Discovery
- SSH
- Disable or Modify System Firewall
- Exploitation for Credential Access
- Virtualization/Sandbox Evasion
- File and Directory Discovery
- Cloud Accounts
- Bootkit
- Non-Standard Port
- Kernel Modules and Extensions
- Scheduled Task/Job
- Systemd Service
- Timestomp
- Network Service Discovery
- System Binary Proxy Execution
- Domain Account
- Non-Application Layer Protocol
- System Checks
- Data Encoding
- Standard Encoding
- Process Injection
- Proxy
- Default Accounts
- Data Staged
- Resource Hijacking
- Exploitation of Remote Services
- Software Packing
- Virtual Private Server
- System Information Discovery
- Web Service
- Data from Information Repositories
- Malware
- Domains
- Deobfuscate/Decode Files or Information
- Cron
- Impair Defenses
- Digital Certificates
- Process Discovery
- Masquerade Task or Service
- Bidirectional Communication
- Remote Services
- Dynamic Resolution
- Exfiltration to Cloud Storage
- Encrypted Channel
- Steal Web Session Cookie
- Obfuscated Files or Information
- Unix Shell Configuration Modification
- Credentials from Password Stores
- Input Capture
- Domain Accounts
- Masquerading
- Exploitation for Defense Evasion
- Permission Groups Discovery
- Lazarus Group, Kimsuky
- Earth Lamia, Jackpot Panda
- China-nexus
- WebBrowserPassView
- RondoDox
- Kaiji
- ANGRYREBEL.LINUX
- Sliver
- HISONIC
- Mirai
- BADCALL - S0245
- EtherRAT
- PeerBlight
- HttpTroy
- BLINDINGCAN - S0520
- ZinFoq
- ShadowPad - S0596
- Gafgyt
- CowTunnel
- Quasar RAT
- SNOWLIGHT
- VShell
- GobRAT
- XMRig
- MailPassView
- MINOCAT
- ShadowPad
- Supershell
- COMPOOD
- React Server Components
- React Server Components
Linked Attack Reports
*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.