CVE-2025-55182

⚡ CISA KEV🔐 Ransomware

Published: —Modified: —Vendor: MetaProduct: React Server Components

—

CVSS v3

99.6%

EPSS

⚡ Added to KEV on 2025-12-05 · Federal agencies must remediate by 2025-12-12

Meta React Server Components contains a remote code execution vulnerability that could allow unauthenticated remote code execution by exploiting a flaw in how React decodes payloads sent to React Server Function endpoints. Please note CVE-2025-66478 has been rejected, but it is associated with CVE-2025- 55182.

💣 Public Exploits1

From Exploit-DB

React Server 19.2.0 - Remote Code Execution

multiple

webapps

2026-04-09

🔍 Sigma Detection Rules2

Rules tagged with this CVE

high	Linux Suspicious Child Process from Node.js - React2Shell	linux	—
high	Windows Suspicious Child Process from Node.js - React2Shell	windows	—

🛠️ Patch Details20

Affected/fixed versions from threat intel reports

React2Shell			source ↗
React Server Components	—	—	source ↗
OpenClaw	—	—	source ↗
Recorded Future Attack Surface Intelligence	—	—	source ↗
Meta React	React < 19.0.1; Next.js multiple lines		source ↗
Next.js	—	—	source ↗
React	19.1.0		source ↗
Next.js	15.4.6		source ↗
Baota Baota (BT) management panel			source ↗
NGINX			source ↗
Google Chrome	—	—	source ↗
React			source ↗
React Server Components (react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack)	version 19.0, 19.1.0, 19.1.1, and 19.2.0	versions 19.0.1, 19.1.2, and 19.2.1	source ↗
Vercel Next.js	—	—	source ↗
Parcel Parcel RSC	—	—	source ↗
Vite Vite RSC plugin	—	—	source ↗
React Router React Router (unstable RSC APIs)	—	—	source ↗
Vercel Next.js	—	—	source ↗
React react-server-dom-turbopack	19.0, 19.1.0, 19.1.1, 19.2.0	19.0.1, 19.1.2, 19.2.1	source ↗
React react-server-dom-parcel	19.0, 19.1.0, 19.1.1, 19.2.0	19.0.1, 19.1.2, 19.2.1	source ↗

📰 Threat Intel Coverage20

Digest reports mentioning this CVE

No Manners Here: The Ruthless Rise of The Gentlemen Ransomware	unit42	2026-07-10
Vect and TeamPCP partner for ransomware campaigns	sophos.threat_research	2026-07-02
Security risks for OpenClaw users and how to mitigate these risks	securelist	2026-07-01
Splunk Enterprise RCE (CVE-2026-20253) \| ThreatLabz	zscaler.threatlabz	2026-06-26
Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257	unit42	2026-06-09
How Huntress Uses Managed SIEM to Detect Threats Faster \| Huntress	huntress	2026-05-21
At Mythos Speed: A Defender's Playbook for the AI Vulnerability Surge in 2026	recordedfuture	2026-05-19
PCPJack \| Cloud Worm Evicts TeamPCP and Steals Credentials at Scale	sentinellabs	2026-05-07
Threat Brief: Exploitation of PAN-OS Captive Portal Zero-Day for Unauthenticated Remote Code Execution	unit42	2026-05-07
Copy Fail: What You Need to Know About the Most Severe Linux Threat in Years	unit42	2026-05-05
Untangling a Linux Incident With an OpenAI Twist (Part 2) \| Huntress	huntress	2026-04-22
Bissa Scanner Exposed: AI-Assisted Mass Exploitation and Credential Harvesting - The DFIR Report	thedfirreport	2026-04-22
A Deep Dive Into Attempted Exploitation of CVE-2023-33538	unit42	2026-04-16
Malicious NGINX Configurations Enable Large-Scale Web Traffic Hijacking Campaign	hawkeye	2026-02-06
Dissecting CrashFix: KongTuke's New Toy \| Huntress	huntress	2026-01-16
Tradecraft Tuesday Recap \| Huntress	huntress	2025-12-23
Gladinet CentreStack/Triofox: Cryptography Vulnerability \| Huntress	huntress	2025-12-18
PeerBlight Linux Backdoor Exploits React2Shell CVE-2025-55182 \| Huntress	huntress	2025-12-10
Critical RCE Vulnerability in React Server Components – CVE-2025-55182	hawkeye	2025-12-06
Wing FTP Server RCE (CVE-2025-47812) Exploited in the Wild \| Huntress	huntress	2025-07-10

📎 References0

No reference URLs.