CVE-2025-55182

What it actually does

This is an unauthenticated remote code execution flaw in React Server Components related to unsafe handling of serialized React Server Component / React Server Flight data. A vulnerable server that processes attacker-controlled component payloads can be coerced into executing code in the context of the application runtime, typically the Node.js process or server-side rendering worker. The affected React Server Component packages include react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0. Applications and frameworks that embed these packages, including Next.js-based deployments using vulnerable React Server Component paths, may be exploitable if the vulnerable server-side component handling code is reachable over the network.

Why it matters to the business

Successful exploitation can give an external attacker control of the web application runtime without requiring login, enabling data theft, credential harvesting, deployment of web shells or malware, lateral movement, service disruption, and ransomware staging. The maximum CVSS score, very high EPSS probability, known exploitation in the wild, KEV listing, ransomware association, and the passed CISA remediation due date of 2025-12-12 make this an emergency-priority vulnerability for any internet-facing React Server Components or Next.js application using affected versions.

How an attack unfolds

An attacker first identifies a React Server Components or framework endpoint that accepts React Server Flight / Server Action style requests. They then send a crafted unauthenticated request containing malicious serialized component data that reaches the vulnerable deserialization path in react-server-dom-webpack, react-server-dom-parcel, or react-server-dom-turbopack. If the application is running an affected version, the server processes the malicious payload and executes attacker-controlled code inside the application runtime. From there, the attacker can run operating system commands as the application user, inspect environment variables and secrets, write files, install persistence, invoke outbound network connections, or deploy ransomware tooling. Public exploitation has been tracked under React2Shell and related React Server Components remote code execution campaign naming, so exposed systems should be treated as likely targeted, not merely theoretically vulnerable.

How to fix it

Upgrade immediately. Replace affected react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 with vendor-fixed releases. For Next.js source-based builds, ensure the code includes the fix identified by commit 3d663f2141a05adb975de4e9dae4c49780791881 or a released version that contains that commit. Regenerate lockfiles, rebuild containers or serverless artifacts, and redeploy rather than only changing package manifests. If immediate upgrade is not possible, temporarily disable or restrict affected React Server Components / Server Action endpoints, place them behind authentication where feasible, block suspicious RSC/Flight request patterns at the WAF or edge, restrict outbound egress from application runtimes, and rotate secrets that may have been exposed. Because this is known exploited and associated with ransomware activity, remediation should include incident response validation, not only patching.

How to confirm the fix worked

Confirm that package-lock.json, yarn.lock, pnpm-lock.yaml, npm ls, SBOMs, container images, and deployed artifacts no longer contain react-server-dom-webpack, react-server-dom-parcel, or react-server-dom-turbopack versions 19.0.0, 19.1.0, 19.1.1, or 19.2.0. For Next.js builds from Git, verify the deployed source includes commit 3d663f2141a05adb975de4e9dae4c49780791881 or a release containing it. Rebuild and redeploy all runtime artifacts, then verify running containers/functions/hosts are using the rebuilt dependency tree rather than stale cached layers. Review application behavior after upgrade with normal React Server Component and Server Action requests. Use software composition analysis, npm/yarn/pnpm dependency inspection, container image scanning, and external attack-surface checks to confirm no internet-facing application still exposes the vulnerable versions.

Typical attack path

1. Scan the internet or a target domain for React Server Components, Next.js, React Server Flight, or Server Action behavior.
2. Fingerprint exposed endpoints using requests that include React Server Component indicators such as RSC traffic, Server Action headers, or _rsc query parameters.
3. Send a crafted unauthenticated React Server Component / Flight payload to a reachable server-side endpoint.
4. Trigger unsafe deserialization or server-side processing in an affected react-server-dom package version.
5. Gain code execution in the application server runtime, commonly the Node.js process.
6. Execute discovery commands, read environment variables, application configuration, cloud credentials, tokens, or source files accessible to the process.
7. Establish persistence or deploy additional tooling such as reverse shells, downloaders, cryptominers, web shells, or ransomware staging components.
8. Use stolen credentials or network access for lateral movement, data exfiltration, service disruption, or extortion.

How to detect it

Investigate for prior exploitation across edge, WAF, CDN, reverse proxy, application, container, EDR, and network logs. Focus on unauthenticated POST requests to endpoints associated with React Server Components, React Server Flight, Server Actions, or Next.js app routes, especially requests containing headers or parameters such as RSC, Next-Action, multipart/form-data, text/x-component, or _rsc. Look for HTTP 500 errors, deserialization exceptions, unusual server component parsing errors, or abrupt worker crashes followed by successful suspicious requests. Correlate suspicious web requests with Node.js child process creation, including /bin/sh, bash, cmd.exe, powershell.exe, curl, wget, python, perl, nc, ncat, openssl, or busybox spawned by node. Review environment variable access, unexpected reads of secret/configuration files, unexpected writes under temporary directories, new web-accessible files, modified build artifacts, suspicious npm package installation, and outbound connections to unfamiliar IP addresses or newly registered domains. Because exploitation has been observed in React2Shell-style campaigns and is associated with ransomware activity, also hunt for post-exploitation behavior: credential dumping, cloud metadata service access, archive creation, bulk file reads, encryption tooling, unusual privilege discovery, and lateral movement attempts. If logs show suspicious RSC/Flight requests and runtime command execution close together, treat the application as compromised even if the patch is now applied.

• react-server-dom-webpack@19.0.0
• react-server-dom-webpack@19.1.0
• react-server-dom-webpack@19.1.1
• react-server-dom-webpack@19.2.0
• react-server-dom-parcel@19.0.0
• react-server-dom-parcel@19.1.0
• react-server-dom-parcel@19.1.1
• react-server-dom-parcel@19.2.0
• react-server-dom-turbopack@19.0.0
• react-server-dom-turbopack@19.1.0
• react-server-dom-turbopack@19.1.1
• react-server-dom-turbopack@19.2.0
• RSC: 1
• Next-Action
• _rsc=
• text/x-component
• multipart/form-data
• react-server-dom-webpack
• react-server-dom-parcel
• react-server-dom-turbopack
• /bin/sh -c
• /bin/bash -c
• cmd.exe /c
• powershell.exe -Command
• node -> /bin/sh
• node -> bash
• node -> curl
• node -> wget
• node -> python
• node -> perl
• node -> nc
• node -> ncat
• /tmp/
• /var/tmp/
• curl http://
• wget http://
• curl https://
• wget https://
• 3d663f2141a05adb975de4e9dae4c49780791881

What your security team should do

• Treat all internet-facing vulnerable React Server Components and Next.js deployments as emergency priority due to active exploitation, KEV status, ransomware association, CVSS 10.0 severity, and EPSS 0.99616.
• Immediately inventory applications and container images for react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0.
• Upgrade or rebuild affected applications with fixed dependencies; for Next.js source deployments, ensure inclusion of commit 3d663f2141a05adb975de4e9dae4c49780791881 or a release containing it.
• Prioritize public-facing, privileged, high-data-sensitivity, and cloud-connected applications first, then complete internal exposure remediation.
• Hunt for prior exploitation before and after patching using HTTP logs, application logs, EDR process telemetry, container logs, file integrity data, and outbound network telemetry.
• Rotate application secrets, API keys, session-signing secrets, cloud credentials, and database credentials accessible to any vulnerable runtime where exploitation cannot be confidently ruled out.
• Add temporary WAF and edge detections for suspicious React Server Component / Flight / Server Action traffic while upgrades are being completed.
• Restrict application runtime egress and alert on unexpected child processes spawned by Node.js, especially shells, downloaders, scripting engines, and network utilities.
• Preserve forensic evidence for any suspected compromised server or container before rebuilding or redeploying.
• Track vendor advisories for downstream frameworks and packages that bundle React Server Components, because vulnerable transitive dependencies may remain even when application manifests do not directly reference them.