Critical

Meta React Server Components Remote Code Execution Vulnerability

Type: advisorySource: CISA Known Exploited VulnerabilitiesKnown exploited1 source record

Meta React Server Components contains a remote code execution vulnerability that could allow unauthenticated remote code execution by exploiting a flaw in how React decodes payloads sent to React Server Function endpoints. Please note CVE-2025-66478 has been rejected, but it is associated with CVE-2025- 55182. CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Announced 5 Dec 2025Source revision 1

Original source ↗

CVE-2025-55182

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2025-55182

React Server Components

Source reference: /product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2025-55182
Source reference: /cveID

Publisher severity

No explicit severity was provided.

Linked CVE context

These ratings describe the referenced vulnerabilities and products. They are not a severity rating for every application using this dependency.

CVE-2025-55182 · Critical

react-server-dom-webpack, react-server-dom-turbopack, react-server-dom-parcel

Event: #289 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 20:43:06 GMT
Publisher date: Fri, 05 Dec 2025 00:00:00 GMT

Read the original announcement