Critical Vulnerabilities in React Server Components and Next.js

Unit42.Paloaltonetworks •Unit 42 • December 4, 2025

Share: View original

We the CVSS 10.0-rated RCE vulnerabilities in the Flight protocol used by React Server Components. These are tracked as CVE-2025-55182 and CVE-2025-55182-66478.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical React Flaw CVE-2025-55182 Exposes Major Security Risks A maximum-severity vulnerability in the React JavaScript library, tracked as CVE-2025-55182, allows unauthenticated remote code execution on affected instances. Security researchers report that 39 percent of cloud environments are vulnerable, and exploitation is expected to occur imminently. Developers are actively working to patch the flaw as it threatens numerous applications relying on React Server Components. 47 sources 62

Extracted Entities

Attack Types (1)

Zero-day Exploit

CVEs (1)

Platforms (3)

Flight Protocol Next.js React Server Components