CVE-2025-55182 KEVRansomwarePublic exploit Critical · 10.0 EPSS 99.8%

Meta React Server Components Remote Code Execution Vulnerability

Meta · React Server Components

Summary

The flaw is an unsafe deserialization of untrusted data in Meta's React Server Components, affecting the react-server-dom-parcel, react-server-dom-turbopack and react-server-dom-webpack packages, where HTTP request payloads sent to Server Function endpoints are deserialized without adequate checks. An unauthenticated remote attacker with network access can send a crafted request to a Server Function endpoint to achieve remote code execution, requiring no privileges, no user interaction and no non-default configuration.

Official description · NVD

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.

Breakdown

95.0 / 100

Exploited: Yes, in CISA KEV
Reports: 5
Tactics: 2/15

How an attack unfolds

Based on mappings. Select a step to see the evidence.

How attackers get in
- Break in through an internet-facing appT1190 · Exploit Public-Facing ApplicationAI-written (claude-haiku-5-5)Medium confidence2 detection rules for this CVE
What they do
- Run commands on the systemT1059 · Command and Scripting InterpreterAI-written (claude-haiku-5-5)Medium confidence2 detection rules for this CVE

First seen exploited the day it was disclosed. Public exploit code (PoC-in-GitHub) was available 3 years before disclosure.

Public exploit codePoC-in-GitHub17 Jun 20223 yrs before
DisclosedFirst seen exploitedVulnCheck KEV evidence3 Dec 2025day 0
Added to CISA KEVknown ransomware use; EU database agrees5 Dec 2025+2 days
First dated threat reportctrlaltintel.com4 Mar 2026+3 mo

CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.

4 fixes in react-server-dom-webpack over 8 days. The latest fix listed for react-server-dom-webpack is 19.2.3.

Fixes in react-server-dom-webpacknpm package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

19.2.1CVE-2025-551823 Dec 2025KEV
19.2.2CVE-2025-5518311 Dec 2025
19.2.2CVE-2025-5518411 Dec 2025
19.2.3CVE-2025-6777911 Dec 2025Latest listed

techniques

2 , grouped by in kill-chain order, 2 cited passages 2

Initial AccessTA0001

Exploit Public-Facing Application T1190 Medium

AI mapping from the description · how it is exploited

Unauthenticated exploit via public HTTP endpoints

A pre-authentication remote code execution vulnerability exists

From the official description (NVD) Original ↗

ExecutionTA0002

Command and Scripting Interpreter T1059 Medium

AI mapping from the description · primary impact

Deserialization yields arbitrary code execution

unsafely deserializes payloads from HTTP requests

From the official description (NVD) Original ↗

Detection

2 rules for this CVE · 244 general rules for its techniques

Rules for this CVE

2 that reference CVE-2025-55182 directly.

Linux Suspicious Child Process from Node.js - React2Shellhighexperimental
Windows Suspicious Child Process from Node.js - React2Shellhighexperimental

General rules for this CVE’s techniques

These detect the technique in general, not this specific vulnerability.

Exploit Public-Facing ApplicationT1190149 general rules

Arcadyan Router Exploitationscriticaltest
Citrix ADS Exploitation CVE-2020-8193 CVE-2020-8195criticaltest
Citrix Netscaler Attack CVE-2019-19781criticaltest
Confluence Exploitation CVE-2019-3398criticaltest
CVE-2010-5278 Exploitation Attemptcriticaltest
CVE-2020-0688 Exchange Exploitation via Web Logcriticaltest
CVE-2020-10148 SolarWinds Orion API Auth Bypasscriticaltest
CVE-2020-5902 F5 BIG-IP Exploitation Attemptcriticaltest

All 149 on SigmaHQ ↗

Command and Scripting InterpreterT105995 general rules

HackTool - Sliver C2 Implant Activity Patterncriticaltest
Lazarus Group Activitycriticaltest
REvil Kaseya Incident Malware Patternscriticaltest
Turla Group Lateral Movementcriticaltest
Windows Defender AMSI Trigger Detectedhighstable
Windows Defender Threat Detectedhighstable
Abusable DLL Potential Sideloading From Suspicious Locationhightest
Add Insecure Download Source To Wingethightest

All 95 on SigmaHQ ↗

Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

3 packages in 1 ecosystem. No single main package: each of these ships the affected code.

npmreact-server-dom-webpack
Affected: 19.2.0 up to 19.2.1; 19.1.0 up to 19.1.2; 19.0.0 up to 19.0.1Upgrade to 19.2.2 or later (older lines: 19.1.3, 19.0.2)
GHSA-fv66-9v8q-g76r
npmreact-server-dom-turbopack
Affected: 19.2.0 up to 19.2.1; 19.1.0 up to 19.1.2; 19.0.0 up to 19.0.1Upgrade to 19.2.2 or later (older lines: 19.1.3, 19.0.2)
GHSA-fv66-9v8q-g76r
npmreact-server-dom-parcel
Affected: 19.2.0 up to 19.2.1; 19.1.0 up to 19.1.2; 19.0.0 up to 19.0.1Upgrade to 19.2.2 or later (older lines: 19.1.3, 19.0.2)
GHSA-fv66-9v8q-g76r

Check your lockfile against all CVEs

What security researchers reported

Named in 5 threat reports

5 reportsUnit 42ctrlaltintel.comHuntress+2Mar 2026 · 3 undated

Reports are matched by finding the exact id CVE-2025-55182 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.

Unit 4231 Mar 2026

Weaponizing the Protectors: TeamPCP’s Multi-Stage Supply Chain Attack on Security Infrastructure

That campaign exploited the React2Shell vulnerability (CVE-2025-55182), allowing the group to leverage remote code execution (RCE) within vulnerable cloud endpoints.

2 passages name itOriginal (opens in a new tab) ↗

ctrlaltintel.com4 Mar 2026

MuddyWater Exposed: Inside an Iranian APT operation - Ctrl-Alt-Intel

Mentions the CVE; no further detail.

Original (opens in a new tab) ↗

HuntressUndated

LightSpy Malware Variant Targeting macOS

PeerBlight Linux Backdoor Exploits React2Shell CVE-2025-55182Huntress is seeing threat actors exploit React2Shell (CVE-2025-55182) to deploy a Linux backdoor, a reverse proxy tunnel, and a Go-based post-exploitation implant.Learn More…

Original (opens in a new tab) ↗

BitdefenderUndated

Bitdefender Labs

Mentions the CVE; no further detail.

Original (opens in a new tab) ↗

Show all 5 reportsShow fewer

FBIUndated

260702

Mentions the CVE; no further detail.

Original (opens in a new tab) ↗

Also mentioned in 50 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

Actively_Exploited_Kev | Oct 30, 202629 Oct 2026
Hunting Leaked PHP2Shell RCE Across Open Directories (CVE-2026-109618, CVE-2026-109619)28 Oct 2026
Actively_Exploited_Kev | Oct 29, 202628 Oct 2026
EbeeOct2026 Pt528 Oct 2026
Actively_Exploited_Kev | Oct 28, 202627 Oct 2026
Actively_Exploited_Kev | Oct 27, 202626 Oct 2026
44 more on OTX

References

6 links, grouped by NVD tag

Exploitation evidence

Exploited in the wild

Listed since 5 Dec 2025. Federal due date 12 Dec 2025. Known ransomware use.

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

ENISA

Marked exploited since 5 Dec 2025. EUVD-2025-200983

React Server 19.2.0 - Remote Code ExecutionEDB-52506 · webapps · multiple · 2026-04-09

, 30 Oct 2026

99.8%Top 0.04%

Chance of exploitation in the next 30 days. of scored CVEs (riskier than 99.96%).

3.1

10.0Critical · 10.0

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Priority factorsFormula

In a KEV cataloglisted in CISA KEV and VulnCheck KEV 35.0/35

Recent KEV listingadded 332 days ago 5.0/10

Known ransomware useCISA KEV and VulnCheck KEV: Known 10.0/10

EPSS percentilepercentile 0.9996 20.0/20

Threat reports5 reports 10.0/10

Public exploit code1 Exploit-DB entry; 1 advisory exploit reference; 383 PoC-in-GitHub repos; 1 Metasploit module; 1 nuclei template 5.0/5

Mentioned in OTX pulses50 pulses 3.0/3

CVSS base scorebase score 10.0 7.0/7

End-of-life productsupported or unknown 0.0

Total95.0

Record

Published: 3 Dec 2025
Modified: 18 Oct 2026
: CWE-502 Deserialization of Untrusted Data
Elsewhere: NVD CVE.org KEV JSON

How an attack unfolds

1How attackers get in

2What they do

Exploitation timelineExploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.

Patch historyPatch historyEarlier and later CVEs in the same code, in date order. It shows when a fix was bypassed or incomplete and which version finally fixed it.

Fixes in react-server-dom-webpacknpm package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

ATT&CKMITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques

Initial AccessTA0001

ExecutionTA0002

Detection

Rules for this CVE

General rules for this CVE’s techniques

Am I affected? What do I upgrade to?

What security researchers reported

Weaponizing the Protectors: TeamPCP’s Multi-Stage Supply Chain Attack on Security Infrastructure

MuddyWater Exposed: Inside an Iranian APT operation - Ctrl-Alt-Intel

LightSpy Malware Variant Targeting macOS

Bitdefender Labs

260702

Also mentioned in 50 community threat pulses (AlienVault OTX)

References

Vendor Advisory 2

Patch 1

US Government Resource 1

Third Party Advisory 1

Issue Tracking 1

How attackers get in

What they do

techniques