CVE-2025-55182
Dec. 10, 2025, 2 a.m.
10.0
Critical
Description
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.
Product(s) Impacted
| Vendor | Product | Versions |
|---|---|---|
|
|
|
| Vercel |
|
|
Weaknesses
Common security weaknesses mapped to this vulnerability.
CWE-502
Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
*CPE(s)
Affected systems and software identified for this CVE.
| Type | Vendor | Product | Version | Update | Edition | Language | Software Edition | Target Software | Target Hardware | Other Information |
|---|---|---|---|---|---|---|---|---|---|---|
| a | react | 19.0.0 | / | / | / | / | / | / | / | |
| a | react | 19.1.0 | / | / | / | / | / | / | / | |
| a | react | 19.1.1 | / | / | / | / | / | / | / | |
| a | react | 19.2.0 | / | / | / | / | / | / | / | |
| a | vercel | next.js | / | / | / | / | / | node.js | / | / |
| a | vercel | next.js | / | / | / | / | / | node.js | / | / |
| a | vercel | next.js | / | / | / | / | / | node.js | / | / |
| a | vercel | next.js | / | / | / | / | / | node.js | / | / |
| a | vercel | next.js | / | / | / | / | / | node.js | / | / |
| a | vercel | next.js | / | / | / | / | / | node.js | / | / |
| a | vercel | next.js | / | / | / | / | / | node.js | / | / |
| a | vercel | next.js | 14.3.0 | canary77 | / | / | / | node.js | / | / |
| a | vercel | next.js | 14.3.0 | canary78 | / | / | / | node.js | / | / |
| a | vercel | next.js | 14.3.0 | canary79 | / | / | / | node.js | / | / |
| a | vercel | next.js | 14.3.0 | canary80 | / | / | / | node.js | / | / |
| a | vercel | next.js | 14.3.0 | canary81 | / | / | / | node.js | / | / |
| a | vercel | next.js | 14.3.0 | canary82 | / | / | / | node.js | / | / |
| a | vercel | next.js | 14.3.0 | canary83 | / | / | / | node.js | / | / |
| a | vercel | next.js | 14.3.0 | canary84 | / | / | / | node.js | / | / |
| a | vercel | next.js | 14.3.0 | canary85 | / | / | / | node.js | / | / |
| a | vercel | next.js | 14.3.0 | canary86 | / | / | / | node.js | / | / |
| a | vercel | next.js | 14.3.0 | canary87 | / | / | / | node.js | / | / |
| a | vercel | next.js | 15.6.0 | - | / | / | / | node.js | / | / |
| a | vercel | next.js | 15.6.0 | canary0 | / | / | / | node.js | / | / |
| a | vercel | next.js | 15.6.0 | canary1 | / | / | / | node.js | / | / |
| a | vercel | next.js | 15.6.0 | canary10 | / | / | / | node.js | / | / |
| a | vercel | next.js | 15.6.0 | canary11 | / | / | / | node.js | / | / |
| a | vercel | next.js | 15.6.0 | canary12 | / | / | / | node.js | / | / |
| a | vercel | next.js | 15.6.0 | canary13 | / | / | / | node.js | / | / |
| a | vercel | next.js | 15.6.0 | canary14 | / | / | / | node.js | / | / |
| a | vercel | next.js | 15.6.0 | canary15 | / | / | / | node.js | / | / |
| a | vercel | next.js | 15.6.0 | canary16 | / | / | / | node.js | / | / |
| a | vercel | next.js | 15.6.0 | canary17 | / | / | / | node.js | / | / |
| a | vercel | next.js | 15.6.0 | canary18 | / | / | / | node.js | / | / |
| a | vercel | next.js | 15.6.0 | canary19 | / | / | / | node.js | / | / |
| a | vercel | next.js | 15.6.0 | canary2 | / | / | / | node.js | / | / |
| a | vercel | next.js | 15.6.0 | canary20 | / | / | / | node.js | / | / |
| a | vercel | next.js | 15.6.0 | canary21 | / | / | / | node.js | / | / |
| a | vercel | next.js | 15.6.0 | canary22 | / | / | / | node.js | / | / |
| a | vercel | next.js | 15.6.0 | canary23 | / | / | / | node.js | / | / |
| a | vercel | next.js | 15.6.0 | canary24 | / | / | / | node.js | / | / |
| a | vercel | next.js | 15.6.0 | canary25 | / | / | / | node.js | / | / |
| a | vercel | next.js | 15.6.0 | canary26 | / | / | / | node.js | / | / |
| a | vercel | next.js | 15.6.0 | canary27 | / | / | / | node.js | / | / |
| a | vercel | next.js | 15.6.0 | canary28 | / | / | / | node.js | / | / |
| a | vercel | next.js | 15.6.0 | canary29 | / | / | / | node.js | / | / |
| a | vercel | next.js | 15.6.0 | canary3 | / | / | / | node.js | / | / |
| a | vercel | next.js | 15.6.0 | canary30 | / | / | / | node.js | / | / |
| a | vercel | next.js | 15.6.0 | canary31 | / | / | / | node.js | / | / |
| a | vercel | next.js | 15.6.0 | canary32 | / | / | / | node.js | / | / |
| a | vercel | next.js | 15.6.0 | canary33 | / | / | / | node.js | / | / |
| a | vercel | next.js | 15.6.0 | canary34 | / | / | / | node.js | / | / |
| a | vercel | next.js | 15.6.0 | canary35 | / | / | / | node.js | / | / |
| a | vercel | next.js | 15.6.0 | canary36 | / | / | / | node.js | / | / |
| a | vercel | next.js | 15.6.0 | canary37 | / | / | / | node.js | / | / |
| a | vercel | next.js | 15.6.0 | canary38 | / | / | / | node.js | / | / |
| a | vercel | next.js | 15.6.0 | canary39 | / | / | / | node.js | / | / |
| a | vercel | next.js | 15.6.0 | canary4 | / | / | / | node.js | / | / |
| a | vercel | next.js | 15.6.0 | canary40 | / | / | / | node.js | / | / |
| a | vercel | next.js | 15.6.0 | canary41 | / | / | / | node.js | / | / |
| a | vercel | next.js | 15.6.0 | canary42 | / | / | / | node.js | / | / |
| a | vercel | next.js | 15.6.0 | canary43 | / | / | / | node.js | / | / |
| a | vercel | next.js | 15.6.0 | canary44 | / | / | / | node.js | / | / |
| a | vercel | next.js | 15.6.0 | canary45 | / | / | / | node.js | / | / |
| a | vercel | next.js | 15.6.0 | canary46 | / | / | / | node.js | / | / |
| a | vercel | next.js | 15.6.0 | canary47 | / | / | / | node.js | / | / |
| a | vercel | next.js | 15.6.0 | canary48 | / | / | / | node.js | / | / |
| a | vercel | next.js | 15.6.0 | canary49 | / | / | / | node.js | / | / |
| a | vercel | next.js | 15.6.0 | canary5 | / | / | / | node.js | / | / |
| a | vercel | next.js | 15.6.0 | canary50 | / | / | / | node.js | / | / |
| a | vercel | next.js | 15.6.0 | canary51 | / | / | / | node.js | / | / |
| a | vercel | next.js | 15.6.0 | canary52 | / | / | / | node.js | / | / |
| a | vercel | next.js | 15.6.0 | canary53 | / | / | / | node.js | / | / |
| a | vercel | next.js | 15.6.0 | canary54 | / | / | / | node.js | / | / |
| a | vercel | next.js | 15.6.0 | canary55 | / | / | / | node.js | / | / |
| a | vercel | next.js | 15.6.0 | canary56 | / | / | / | node.js | / | / |
| a | vercel | next.js | 15.6.0 | canary57 | / | / | / | node.js | / | / |
| a | vercel | next.js | 15.6.0 | canary6 | / | / | / | node.js | / | / |
| a | vercel | next.js | 15.6.0 | canary7 | / | / | / | node.js | / | / |
| a | vercel | next.js | 15.6.0 | canary8 | / | / | / | node.js | / | / |
| a | vercel | next.js | 15.6.0 | canary9 | / | / | / | node.js | / | / |
| a | vercel | next.js | 16.0.0 | - | / | / | / | node.js | / | / |
References
Tags
CVSS Score
CVSS Data - 3.1
- Attack Vector: NETWORK
- Attack Complexity: LOW
- Privileges Required: NONE
- Scope: CHANGED
- Confidentiality Impact: HIGH
- Integrity Impact: HIGH
- Availability Impact: HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Timeline
Published: Dec. 3, 2025, 4:15 p.m.
Last Modified: Dec. 10, 2025, 2 a.m.
Last Modified: Dec. 10, 2025, 2 a.m.
Status : Analyzed
CVE has had analysis completed and all data associations made.
More infoSource
Relations
Here is the list of observables linked to the vulnerability CVE-2025-55182 using threat intelligence.
- T1562.001
- T1190
- T1133
- T1505.003
- T1078
- Account Discovery
- PowerShell
- T1105
- T1021.001
- T1569.002
- JavaScript
- T1071.001
- Registry Run Keys / Startup Folder
- T1059
- T1498
- Tool
- T1552.001
- Email Collection
- T1005
- T1070.004
- T1041
- T1003
- Query Registry
- Symmetric Cryptography
- System Network Configuration Discovery
- Cloud Infrastructure Discovery
- Unsecured Credentials
- Indicator Removal
- Clear Command History
- System Owner/User Discovery
- T1021.004
- Disable or Modify System Firewall
- Exploitation for Credential Access
- Virtualization/Sandbox Evasion
- T1083
- Cloud Accounts
- Bootkit
- T1571
- Kernel Modules and Extensions
- Scheduled Task/Job
- T1543.002
- Timestomp
- T1046
- System Binary Proxy Execution
- Domain Account
- T1095
- System Checks
- Data Encoding
- Standard Encoding
- T1055
- T1090
- Default Accounts
- T1074
- T1496
- Exploitation of Remote Services
- Software Packing
- Virtual Private Server
- T1082
- T1102
- T1213
- Malware
- Domains
- Deobfuscate/Decode Files or Information
- T1053.003
- Impair Defenses
- Digital Certificates
- T1057
- Masquerade Task or Service
- Bidirectional Communication
- T1021
- Dynamic Resolution
- Exfiltration to Cloud Storage
- T1573
- Steal Web Session Cookie
- T1027
- Unix Shell Configuration Modification
- Credentials from Password Stores
- Input Capture
- Domain Accounts
- T1036
- Exploitation for Defense Evasion
- Permission Groups Discovery
- Lazarus Group, Kimsuky
- Earth Lamia, Jackpot Panda
- China-nexus
- WebBrowserPassView
- RondoDox
- Kaiji
- ANGRYREBEL.LINUX
- Sliver
- HISONIC
- Mirai
- BADCALL - S0245
- EtherRAT
- PeerBlight
- HttpTroy
- BLINDINGCAN - S0520
- ZinFoq
- ShadowPad - S0596
- Gafgyt
- CowTunnel
- Quasar RAT
- SNOWLIGHT
- VShell
- GobRAT
- XMRig
- MailPassView
- MINOCAT
- ShadowPad
- Supershell
- COMPOOD
- React Server Components
- React Server Components
Linked Attack Reports
*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.