CVE-2025-55182
Description
CVE-2025-55182 is a critical (CVSS 10.0) RCE vulnerability in React Server Components and Next.js, currently under active exploitation.
CPE
| Product | Version Start | Version End (excl.) | Status |
|---|---|---|---|
| react | 19.0.0 | 19.0.0 | vulnerable |
| react | 19.1.0 | 19.1.0 | vulnerable |
| react | 19.1.1 | 19.1.1 | vulnerable |
| react | 19.2.0 | 19.2.0 | vulnerable |
| next.js | 15.0.0 | 15.0.5 | vulnerable |
| next.js | 15.1.0 | 15.1.9 | vulnerable |
| next.js | 15.2.0 | 15.2.6 | vulnerable |
| next.js | 15.3.0 | 15.3.6 | vulnerable |
| next.js | 15.4.0 | 15.4.8 | vulnerable |
| next.js | 15.5.0 | 15.5.7 | vulnerable |
| next.js | 16.0.0 | 16.0.7 | vulnerable |
| next.js | 14.3.0 | 14.3.0 | vulnerable |
| next.js | 14.3.0 | 14.3.0 | vulnerable |
| next.js | 14.3.0 | 14.3.0 | vulnerable |
| next.js | 14.3.0 | 14.3.0 | vulnerable |
| next.js | 14.3.0 | 14.3.0 | vulnerable |
| next.js | 14.3.0 | 14.3.0 | vulnerable |
| next.js | 14.3.0 | 14.3.0 | vulnerable |
| next.js | 14.3.0 | 14.3.0 | vulnerable |
| next.js | 14.3.0 | 14.3.0 | vulnerable |
| next.js | 14.3.0 | 14.3.0 | vulnerable |
| next.js | 14.3.0 | 14.3.0 | vulnerable |
| next.js | 15.6.0 | 15.6.0 | vulnerable |
| next.js | 15.6.0 | 15.6.0 | vulnerable |
| next.js | 15.6.0 | 15.6.0 | vulnerable |
| next.js | 15.6.0 | 15.6.0 | vulnerable |
| next.js | 15.6.0 | 15.6.0 | vulnerable |
| next.js | 15.6.0 | 15.6.0 | vulnerable |
| next.js | 15.6.0 | 15.6.0 | vulnerable |
| next.js | 15.6.0 | 15.6.0 | vulnerable |
| next.js | 15.6.0 | 15.6.0 | vulnerable |
| next.js | 15.6.0 | 15.6.0 | vulnerable |
| next.js | 15.6.0 | 15.6.0 | vulnerable |
| next.js | 15.6.0 | 15.6.0 | vulnerable |
| next.js | 15.6.0 | 15.6.0 | vulnerable |
| next.js | 15.6.0 | 15.6.0 | vulnerable |
| next.js | 15.6.0 | 15.6.0 | vulnerable |
| next.js | 15.6.0 | 15.6.0 | vulnerable |
| next.js | 15.6.0 | 15.6.0 | vulnerable |
| next.js | 15.6.0 | 15.6.0 | vulnerable |
| next.js | 15.6.0 | 15.6.0 | vulnerable |
| next.js | 15.6.0 | 15.6.0 | vulnerable |
| next.js | 15.6.0 | 15.6.0 | vulnerable |
| next.js | 15.6.0 | 15.6.0 | vulnerable |
| next.js | 15.6.0 | 15.6.0 | vulnerable |
| next.js | 15.6.0 | 15.6.0 | vulnerable |
| next.js | 15.6.0 | 15.6.0 | vulnerable |
| next.js | 15.6.0 | 15.6.0 | vulnerable |
| next.js | 15.6.0 | 15.6.0 | vulnerable |
| next.js | 15.6.0 | 15.6.0 | vulnerable |
| next.js | 15.6.0 | 15.6.0 | vulnerable |
| next.js | 15.6.0 | 15.6.0 | vulnerable |
| next.js | 15.6.0 | 15.6.0 | vulnerable |
| next.js | 15.6.0 | 15.6.0 | vulnerable |
| next.js | 15.6.0 | 15.6.0 | vulnerable |
| next.js | 15.6.0 | 15.6.0 | vulnerable |
| next.js | 15.6.0 | 15.6.0 | vulnerable |
| next.js | 15.6.0 | 15.6.0 | vulnerable |
| next.js | 15.6.0 | 15.6.0 | vulnerable |
| next.js | 15.6.0 | 15.6.0 | vulnerable |
| next.js | 15.6.0 | 15.6.0 | vulnerable |
| next.js | 15.6.0 | 15.6.0 | vulnerable |
| next.js | 15.6.0 | 15.6.0 | vulnerable |
| next.js | 15.6.0 | 15.6.0 | vulnerable |
| next.js | 15.6.0 | 15.6.0 | vulnerable |
| next.js | 15.6.0 | 15.6.0 | vulnerable |
| next.js | 15.6.0 | 15.6.0 | vulnerable |
| next.js | 15.6.0 | 15.6.0 | vulnerable |
| next.js | 15.6.0 | 15.6.0 | vulnerable |
| next.js | 15.6.0 | 15.6.0 | vulnerable |
| next.js | 15.6.0 | 15.6.0 | vulnerable |
| next.js | 15.6.0 | 15.6.0 | vulnerable |
| next.js | 15.6.0 | 15.6.0 | vulnerable |
| next.js | 15.6.0 | 15.6.0 | vulnerable |
| next.js | 15.6.0 | 15.6.0 | vulnerable |
| next.js | 15.6.0 | 15.6.0 | vulnerable |
| next.js | 15.6.0 | 15.6.0 | vulnerable |
| next.js | 15.6.0 | 15.6.0 | vulnerable |
| next.js | 15.6.0 | 15.6.0 | vulnerable |
| next.js | 15.6.0 | 15.6.0 | vulnerable |
| next.js | 15.6.0 | 15.6.0 | vulnerable |
| next.js | 16.0.0 | 16.0.0 | vulnerable |
Related weakness (CWE)
Remediation plan
Apply official patches
Immediately apply the security updates released by Meta and the Vercel team. For React, move to a patched version beyond 19.2.0. For Next.js, ensure you are on a version that includes the fix for the react-server-dom-webpack and related packages.
Update affected systems
Upgrade React to version 19.2.1 or higher. For Next.js users, update to versions 15.0.5+, 15.1.9+, 15.2.6+, 15.3.6+, 15.4.8+, 15.5.7+, 15.6.1+, or 16.0.8+ to ensure the underlying React dependencies are secured.
Restrict access
While a patch is the only complete fix, consider placing vulnerable Server Function endpoints behind a Web Application Firewall (WAF) or an authenticated proxy. Implement strict input validation and limit exposure of internal server-side functions to the public internet.
Monitor for exploitation
Inspect server logs for unusual POST requests to Server Function endpoints, specifically looking for malformed serialized payloads. Monitor for unexpected outbound network connections or spawned shell processes originating from the web server process.
Detection Guidance
Look for HTTP POST requests targeting Server Function endpoints containing complex or obfuscated serialized data in the request body. Specifically, monitor for payloads containing unexpected JavaScript objects that trigger CWE-502. Security teams should use EDR tools to detect anomalous child processes spawned by the Node.js runtime. Network-level signatures should flag high-frequency requests to server-side actions that do not match known application traffic patterns.