⚠️ CISA Known Exploited Vulnerability

Active Threat

This vulnerability is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. Active exploitation has been observed in the wild. This poses significant risk to federal enterprises and should be prioritized for immediate patching.

View CISA KEV Catalog

CVE-2025-55182

Critical CISA KEV

Low Medium High Critical

10.0

CVSS Score

Published: Dec 03, 2025

Last Modified: Dec 10, 2025

CWE: CWE-502

Vulnerability Description

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.

CVSS Metrics

Common Vulnerability Scoring System

Vector String:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Known Affected Software

7 configuration(s) from 2 vendor(s)

react

Version:

19.2.0

CPE:

cpe:2.3:a:facebook:react:19.2.0:*:*:*:*:*:*:*

react

Version:

19.0.0

CPE:

cpe:2.3:a:facebook:react:19.0.0:*:*:*:*:*:*:*

react

Version:

19.1.0

CPE:

cpe:2.3:a:facebook:react:19.1.0:*:*:*:*:*:*:*

react

Version:

19.1.1

CPE:

cpe:2.3:a:facebook:react:19.1.1:*:*:*:*:*:*:*

next.js

Version:

15.6.0

CPE:

cpe:2.3:a:vercel:next.js:15.6.0:canary59:*:*:*:node.js:*:*

next.js

Version:

16.0.0

CPE:

cpe:2.3:a:vercel:next.js:16.0.0:-:*:*:*:node.js:*:*

next.js

Version:

14.3.0

CPE:

cpe:2.3:a:vercel:next.js:14.3.0:canary0:*:*:*:node.js:*:*

This vulnerability affects 7 software configuration(s). Ensure you patch all affected systems.

Available Security Patches

2 patches available from vendors

View All Patches

Oracle

CPUAPR2026

Oracle Critical Patch Update Advisory - April 2026

Severity

Critical

Released

Apr 21, 2026

Restart Required

Security Update

View Details Vendor Page

Cisco

cisco-sa-react-flight-TYw32Ddb

Remote Code Execution Vulnerability in React and Next.js Frameworks: December 2025

Severity

Critical

Released

Jan 22, 2026

Security Update

View Details Vendor Page

Browse All Security Patches

References & Resources

Severity Details

10.0

out of 10.0

Critical

CISA KEV Status

Active Exploitation

Listed in CISA's Known Exploited Vulnerabilities catalog

View on CISA KEV

Weakness Type (CWE)

CWE-502 Top 25 #15

Deserialization of Untrusted Data

Description: The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Exploit Likelihood: Medium
Typical Severity: Medium
OWASP Top 10: A08:2021-Software/Data Integrity Failures
Abstraction Level: Base