CVE-2025-55182
CISA KEV Active Alert
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.
Attack Parameters
Technical Impact
Affected Configurations
Total: 7 detected entries
Time Line
Key Metrics
Recommended Solution
Related News Articles
3 article(s) mentioning this vulnerability
RondoDox Botnet Exploits Critical React2Shell Flaw to Hijack IoT Devices and Web Servers
Cybersecurity researchers have disclosed a persistent nine-month-long campaign targeting IoT devices and web applications, leveraging the React2Shell (CVE-2025-55182) flaw as…
RondoDox Botnet Exploits React2Shell Flaw to Infect Next.js Servers
RondoDox botnet exploits React2Shell flaw (CVE-2025-55182) to infect Next.js servers with malware and cryptominers.
RondoDox Botnet Exploits React2Shell Flaw to Compromise Next.js Servers
RondoDox botnet exploits React2Shell flaw to infect Next.js servers with malware and cryptominers.
Immediate Action Plan
1. Inventory
Identify all affected systems in your infrastructure.
2. Assessment
Assess exposure and criticality for your organization.
3. Mitigation
Apply patches or available workarounds.
4. Verification
Test and confirm effectiveness of applied measures.
⚠️ MAXIMUM PRIORITY - Immediate action required