Critical
Security advisory
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2025-55182
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 05:27 UTC · Revision 1
Source evidence
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.
osv:CVE-2025-55182
Complete source record
{
"id": "1e504ab89d970c79c883971f844c2d7e307543b4a3038dd25500a5a199ad7be9",
"url": "https://osv.dev/vulnerability/CVE-2025-55182",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2025-55182",
"summary": "A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.",
"evidence": "osv:CVE-2025-55182",
"products": [],
"severity": "critical",
"structured": {
"id": "CVE-2025-55182",
"aliases": [
"CVE-2025-55182",
"GHSA-fv66-9v8q-g76r"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/react/react",
"type": "GIT",
"events": [
{
"introduced": "7aa5dda3b3e4c2baa905a59b922ae7ec14734b24"
},
{
"last_affected": "ae74234eae6ebd62f19190731278e20bc1c37d51"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:facebook:react:19.0.0:*:*:*:*:*:*:*",
"range": [
{
"introduced": "19.0.0"
},
{
"last_affected": "19.0.0"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:facebook:react:19.1.0:*:*:*:*:*:*:*",
"range": [
{
"introduced": "19.1.0"
},
{
"last_affected": "19.1.0"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:facebook:react:19.1.1:*:*:*:*:*:*:*",
"range": [
{
"introduced": "19.1.1"
},
{
"last_affected": "19.1.1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:facebook:react:19.2.0:*:*:*:*:*:*:*",
"range": [
{
"introduced": "19.2.0"
},
{
"last_affected": "19.2.0"
}
],
"source": "CPE_STRING"
}
]
}
}
],
"versions": [
"19.0.0",
"19.1.0",
"19.1.1",
"19.2.0",
"v19.0.0",
"v19.2.0",
"v19.1.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-55182.json"
}
},
{
"ranges": [
{
"repo": "https://github.com/vercel/next.js",
"type": "GIT",
"events": [
{
"introduced": "51bfe3c1863b191f4b039bc230e8ed5c57b0baf3"
},
{
"fixed": "3d663f2141a05adb975de4e9dae4c49780791881"
},
{
"introduced": "dafcd43fac3ef9d0ffd94f9c94fd61db4449df25"
},
{
"fixed": "aeb69d97f8aad106f4760ff04f6d3aaa33597635"
},
{
"introduced": "b0416fbb44d1d148b6322ed79b6448d588260e49"
},
{
"fixed": "25ba2c26f42dc33a72c7ff39710fcad9b19d9658"
},
{
"introduced": "b2ff04995be722a5c93225e16e1c7fcc8bb53f91"
},
{
"fixed": "2f026aae46027d9575494fb3aecbd0d75fd674f0"
},
{
"introduced": "7ad467409b67691ae4f5dc4dc47f1a247c4ba988"
},
{
"fixed": "49668475daba15ef8cea1d8e469dc0f9a765b635"
},
{
"introduced": "7e08c8223d64bc2add7a0e5a323cbce0a84bb292"
},
{
"fixed": "3eaf68b09b2b6b8c0c8e080a9713e131a78dc529"
},
{
"introduced": "950609f96f694c5475d18cd2d72a0052ca04d4b9"
},
{
"fixed": "7492122a3bbc6655b64ccba04076c73ab418cdcc"
},
{
"last_affected": "950609f96f694c5475d18cd2d72a0052ca04d4b9"
},
{
"introduced": "74be1f68c2ed99671d66e3e7f1337b997e74f464"
},
{
"last_affected": "33759e0be7d31f8a5d59544267f7ec9b914f37e5"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.0.0"
},
{
"fixed": "15.0.5"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.1.0"
},
{
"fixed": "15.1.9"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.2.0"
},
{
"fixed": "15.2.6"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.3.0"
},
{
"fixed": "15.3.6"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.4.0"
},
{
"fixed": "15.4.8"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.5.0"
},
{
"fixed": "15.5.7"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*",
"range": [
{
"introduced": "16.0.0"
},
{
"fixed": "16.0.7"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:16.0.0:-:*:*:*:node.js:*:*",
"range": [
{
"introduced": "16.0.0-NA"
},
{
"last_affected": "16.0.0-NA"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:14.3.0:canary77:*:*:*:node.js:*:*",
"range": [
{
"introduced": "14.3.0-canary77"
},
{
"last_affected": "14.3.0-canary77"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:14.3.0:canary78:*:*:*:node.js:*:*",
"range": [
{
"introduced": "14.3.0-canary78"
},
{
"last_affected": "14.3.0-canary78"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:14.3.0:canary79:*:*:*:node.js:*:*",
"range": [
{
"introduced": "14.3.0-canary79"
},
{
"last_affected": "14.3.0-canary79"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:14.3.0:canary80:*:*:*:node.js:*:*",
"range": [
{
"introduced": "14.3.0-canary80"
},
{
"last_affected": "14.3.0-canary80"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:14.3.0:canary81:*:*:*:node.js:*:*",
"range": [
{
"introduced": "14.3.0-canary81"
},
{
"last_affected": "14.3.0-canary81"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:14.3.0:canary82:*:*:*:node.js:*:*",
"range": [
{
"introduced": "14.3.0-canary82"
},
{
"last_affected": "14.3.0-canary82"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:14.3.0:canary83:*:*:*:node.js:*:*",
"range": [
{
"introduced": "14.3.0-canary83"
},
{
"last_affected": "14.3.0-canary83"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:14.3.0:canary84:*:*:*:node.js:*:*",
"range": [
{
"introduced": "14.3.0-canary84"
},
{
"last_affected": "14.3.0-canary84"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:14.3.0:canary85:*:*:*:node.js:*:*",
"range": [
{
"introduced": "14.3.0-canary85"
},
{
"last_affected": "14.3.0-canary85"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:14.3.0:canary86:*:*:*:node.js:*:*",
"range": [
{
"introduced": "14.3.0-canary86"
},
{
"last_affected": "14.3.0-canary86"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:14.3.0:canary87:*:*:*:node.js:*:*",
"range": [
{
"introduced": "14.3.0-canary87"
},
{
"last_affected": "14.3.0-canary87"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:15.6.0:-:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.6.0-NA"
},
{
"last_affected": "15.6.0-NA"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:15.6.0:canary0:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.6.0-canary0"
},
{
"last_affected": "15.6.0-canary0"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:15.6.0:canary1:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.6.0-canary1"
},
{
"last_affected": "15.6.0-canary1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:15.6.0:canary10:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.6.0-canary10"
},
{
"last_affected": "15.6.0-canary10"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:15.6.0:canary11:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.6.0-canary11"
},
{
"last_affected": "15.6.0-canary11"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:15.6.0:canary12:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.6.0-canary12"
},
{
"last_affected": "15.6.0-canary12"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:15.6.0:canary13:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.6.0-canary13"
},
{
"last_affected": "15.6.0-canary13"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:15.6.0:canary14:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.6.0-canary14"
},
{
"last_affected": "15.6.0-canary14"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:15.6.0:canary15:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.6.0-canary15"
},
{
"last_affected": "15.6.0-canary15"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:15.6.0:canary16:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.6.0-canary16"
},
{
"last_affected": "15.6.0-canary16"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:15.6.0:canary17:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.6.0-canary17"
},
{
"last_affected": "15.6.0-canary17"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:15.6.0:canary18:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.6.0-canary18"
},
{
"last_affected": "15.6.0-canary18"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:15.6.0:canary19:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.6.0-canary19"
},
{
"last_affected": "15.6.0-canary19"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:15.6.0:canary2:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.6.0-canary2"
},
{
"last_affected": "15.6.0-canary2"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:15.6.0:canary20:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.6.0-canary20"
},
{
"last_affected": "15.6.0-canary20"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:15.6.0:canary21:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.6.0-canary21"
},
{
"last_affected": "15.6.0-canary21"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:15.6.0:canary22:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.6.0-canary22"
},
{
"last_affected": "15.6.0-canary22"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:15.6.0:canary23:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.6.0-canary23"
},
{
"last_affected": "15.6.0-canary23"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:15.6.0:canary24:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.6.0-canary24"
},
{
"last_affected": "15.6.0-canary24"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:15.6.0:canary25:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.6.0-canary25"
},
{
"last_affected": "15.6.0-canary25"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:15.6.0:canary26:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.6.0-canary26"
},
{
"last_affected": "15.6.0-canary26"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:15.6.0:canary27:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.6.0-canary27"
},
{
"last_affected": "15.6.0-canary27"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:15.6.0:canary28:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.6.0-canary28"
},
{
"last_affected": "15.6.0-canary28"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:15.6.0:canary29:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.6.0-canary29"
},
{
"last_affected": "15.6.0-canary29"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:15.6.0:canary3:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.6.0-canary3"
},
{
"last_affected": "15.6.0-canary3"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:15.6.0:canary30:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.6.0-canary30"
},
{
"last_affected": "15.6.0-canary30"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:15.6.0:canary31:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.6.0-canary31"
},
{
"last_affected": "15.6.0-canary31"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:15.6.0:canary32:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.6.0-canary32"
},
{
"last_affected": "15.6.0-canary32"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:15.6.0:canary33:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.6.0-canary33"
},
{
"last_affected": "15.6.0-canary33"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:15.6.0:canary34:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.6.0-canary34"
},
{
"last_affected": "15.6.0-canary34"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:15.6.0:canary35:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.6.0-canary35"
},
{
"last_affected": "15.6.0-canary35"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:15.6.0:canary36:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.6.0-canary36"
},
{
"last_affected": "15.6.0-canary36"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:15.6.0:canary37:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.6.0-canary37"
},
{
"last_affected": "15.6.0-canary37"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:15.6.0:canary38:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.6.0-canary38"
},
{
"last_affected": "15.6.0-canary38"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:15.6.0:canary39:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.6.0-canary39"
},
{
"last_affected": "15.6.0-canary39"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:15.6.0:canary4:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.6.0-canary4"
},
{
"last_affected": "15.6.0-canary4"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:15.6.0:canary40:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.6.0-canary40"
},
{
"last_affected": "15.6.0-canary40"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:15.6.0:canary41:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.6.0-canary41"
},
{
"last_affected": "15.6.0-canary41"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:15.6.0:canary42:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.6.0-canary42"
},
{
"last_affected": "15.6.0-canary42"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:15.6.0:canary43:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.6.0-canary43"
},
{
"last_affected": "15.6.0-canary43"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:15.6.0:canary44:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.6.0-canary44"
},
{
"last_affected": "15.6.0-canary44"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:15.6.0:canary45:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.6.0-canary45"
},
{
"last_affected": "15.6.0-canary45"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:15.6.0:canary46:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.6.0-canary46"
},
{
"last_affected": "15.6.0-canary46"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:15.6.0:canary47:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.6.0-canary47"
},
{
"last_affected": "15.6.0-canary47"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:15.6.0:canary48:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.6.0-canary48"
},
{
"last_affected": "15.6.0-canary48"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:15.6.0:canary49:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.6.0-canary49"
},
{
"last_affected": "15.6.0-canary49"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:15.6.0:canary5:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.6.0-canary5"
},
{
"last_affected": "15.6.0-canary5"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:15.6.0:canary50:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.6.0-canary50"
},
{
"last_affected": "15.6.0-canary50"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:15.6.0:canary51:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.6.0-canary51"
},
{
"last_affected": "15.6.0-canary51"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:15.6.0:canary52:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.6.0-canary52"
},
{
"last_affected": "15.6.0-canary52"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:15.6.0:canary53:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.6.0-canary53"
},
{
"last_affected": "15.6.0-canary53"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:15.6.0:canary54:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.6.0-canary54"
},
{
"last_affected": "15.6.0-canary54"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:15.6.0:canary55:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.6.0-canary55"
},
{
"last_affected": "15.6.0-canary55"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:15.6.0:canary56:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.6.0-canary56"
},
{
"last_affected": "15.6.0-canary56"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:15.6.0:canary57:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.6.0-canary57"
},
{
"last_affected": "15.6.0-canary57"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:15.6.0:canary6:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.6.0-canary6"
},
{
"last_affected": "15.6.0-canary6"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:15.6.0:canary7:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.6.0-canary7"
},
{
"last_affected": "15.6.0-canary7"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:15.6.0:canary8:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.6.0-canary8"
},
{
"last_affected": "15.6.0-canary8"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vercel:next.js:15.6.0:canary9:*:*:*:node.js:*:*",
"range": [
{
"introduced": "15.6.0-canary9"
},
{
"last_affected": "15.6.0-canary9"
}
],
"source": "CPE_STRING"
}
]
}
}
],
"versions": [
"14.3.0-canary77",
"14.3.0-canary78",
"14.3.0-canary79",
"14.3.0-canary80",
"14.3.0-canary81",
"14.3.0-canary82",
"14.3.0-canary83",
"14.3.0-canary84",
"14.3.0-canary85",
"14.3.0-canary86",
"14.3.0-canary87",
"15.6.0-NA",
"15.6.0-canary1",
"15.6.0-canary10",
"15.6.0-canary11",
"15.6.0-canary12",
"15.6.0-canary13",
"15.6.0-canary14",
"15.6.0-canary15",
"15.6.0-canary16",
"15.6.0-canary17",
"15.6.0-canary18",
"15.6.0-canary19",
"15.6.0-canary2",
"15.6.0-canary20",
"15.6.0-canary21",
"15.6.0-canary22",
"15.6.0-canary23",
"15.6.0-canary24",
"15.6.0-canary25",
"15.6.0-canary26",
"15.6.0-canary27",
"15.6.0-canary28",
"15.6.0-canary29",
"15.6.0-canary3",
"15.6.0-canary30",
"15.6.0-canary31",
"15.6.0-canary32",
"15.6.0-canary33",
"15.6.0-canary34",
"15.6.0-canary35",
"15.6.0-canary36",
"15.6.0-canary37",
"15.6.0-canary38",
"15.6.0-canary39",
"15.6.0-canary4",
"15.6.0-canary40",
"15.6.0-canary41",
"15.6.0-canary42",
"15.6.0-canary43",
"15.6.0-canary44",
"15.6.0-canary45",
"15.6.0-canary46",
"15.6.0-canary47",
"15.6.0-canary48",
"15.6.0-canary49",
"15.6.0-canary5",
"15.6.0-canary50",
"15.6.0-canary51",
"15.6.0-canary52",
"15.6.0-canary53",
"15.6.0-canary54",
"15.6.0-canary55",
"15.6.0-canary56",
"15.6.0-canary57",
"15.6.0-canary6",
"15.6.0-canary7",
"15.6.0-canary8",
"15.6.0-canary9",
"v15.5.6",
"v15.3.5",
"v15.2.5",
"v15.1.8",
"v15.0.4",
"v16.0.0",
"v15.5.5",
"v15.4.7",
"v15.5.4",
"v15.6.0-canary.9",
"v15.6.0-canary.8",
"v15.6.0-canary.7",
"v15.6.0-canary.6",
"v15.6.0-canary.5",
"v15.6.0-canary.4",
"v15.6.0-canary.3",
"v15.5.3",
"v15.6.0-canary.2",
"v15.6.0-canary.1",
"v15.6.0-canary.0",
"v15.5.1-canary.39",
"v15.5.1-canary.38",
"v15.5.1-canary.37",
"v15.5.1-canary.36",
"v15.5.1-canary.35",
"v15.5.1-canary.34",
"v15.5.1-canary.33",
"v15.5.1-canary.32",
"v15.5.1-canary.31",
"v15.5.1-canary.30",
"v15.5.1-canary.29",
"v15.5.1-canary.28",
"v15.5.1-canary.27",
"v15.5.1-canary.26",
"v15.5.1-canary.25",
"v15.5.1-canary.24",
"v15.5.1-canary.23",
"v15.5.1-canary.22",
"v15.5.1-canary.21",
"v15.5.1-canary.20",
"v15.5.1-canary.19",
"v15.5.1-canary.18",
"v15.5.2",
"v15.5.1-canary.17",
"v15.5.1-canary.16",
"v15.5.1-canary.15",
"v15.5.1-canary.14",
"v15.5.1-canary.13",
"v15.5.1-canary.12",
"v15.5.1-canary.11",
"v15.5.1-canary.10",
"v15.5.1",
"v15.5.1-canary.9",
"v15.5.1-canary.8",
"v15.5.0",
"v15.5.1-canary.7",
"v15.5.1-canary.6",
"v15.5.1-canary.5",
"v15.5.1-canary.4",
"v15.5.1-canary.3",
"v15.5.1-canary.2",
"v15.5.1-canary.1",
"v15.5.1-canary.0",
"v15.4.6",
"v15.4.5",
"v15.4.4",
"v15.4.3",
"v15.4.2",
"v15.4.1",
"v15.4.0",
"v15.3.4",
"v15.3.3",
"v15.3.2",
"v15.3.1",
"v15.3.0",
"v15.2.4",
"v15.2.3",
"v15.2.2",
"v15.2.2-canary.6",
"v15.2.2-canary.5",
"v15.2.2-canary.4",
"v15.2.2-canary.3",
"v15.2.2-canary.2",
"v15.2.2-canary.1",
"v15.2.2-canary.0",
"v15.2.1",
"v15.2.1-canary.6",
"v15.2.1-canary.5",
"v15.2.1-canary.4",
"v15.2.1-canary.3",
"v15.2.1-canary.2",
"v15.2.1-canary.1",
"v15.2.1-canary.0",
"v15.2.0",
"v15.1.7",
"v15.1.6",
"v15.1.5",
"v15.1.4",
"v15.1.3",
"v15.1.2",
"v15.1.1",
"v15.1.0",
"v15.0.3",
"v15.0.3-canary.9",
"v15.0.3-canary.8",
"v15.0.3-canary.7",
"v15.0.3-canary.6",
"v15.0.3-canary.5",
"v15.0.3-canary.4",
"v15.0.3-canary.3",
"v15.0.3-canary.2",
"v15.0.3-canary.1",
"v15.0.3-canary.0",
"v15.0.2",
"v15.0.2-canary.11",
"v15.0.2-canary.10",
"v15.0.2-canary.9",
"v15.0.2-canary.8",
"v15.0.2-canary.7",
"v15.0.2-canary.6",
"v15.0.2-canary.5",
"v15.0.2-canary.4",
"v15.0.2-canary.3",
"v15.0.2-canary.2",
"v15.0.2-canary.1",
"v15.0.2-canary.0",
"v15.0.1",
"v15.0.1-canary.3",
"v15.0.1-canary.2",
"v15.0.1-canary.1",
"v15.0.1-canary.0",
"v15.0.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-55182.json"
}
}
],
"modified": "2026-10-24T10:30:28.975549294Z",
"provider": "osv",
"references": [
"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-55182",
"https://aws.amazon.com/blogs/security/china-nexus-cyber-threat-groups-rapidly-exploit-react2shell-vulnerability-cve-2025-55182/",
"https://www.facebook.com/security/advisories/cve-2025-55182",
"https://news.ycombinator.com/item?id=46136026",
"https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components"
],
"provider_metadata": {}
},
"related_cves": [
{
"value": "CVE-2025-55182",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 432181,
"published_at": "2025-12-03T16:15:56.463+00:00"
}