CVE-2025-55182

nvd.nist.gov • July 2, 2026

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.

Reference CISA's BOD 22-01 and Known Exploited Vulnerabilities Catalog for further guidance and requirements.

Denotes Vulnerable Software Are we missing a CPE here? Please let us know .

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

AWS Warns of Data Exfiltration Risks from Outbound Traffic Blind Spots AWS has highlighted the risks associated with unmonitored outbound traffic in cloud environments, particularly in light of the CVE-2025-55182 vulnerability affecting React Server Components. This vulnerability allows for pre-authentication remote code execution, which can lead to unauthorized data exfiltration. Organizations often focus on inbound security measures, neglecting egress controls that can prevent data leaks. The React2Shell vulnerability was publicly disclosed on December 3, 2025, and has since been actively exploited, with proof-of-concept code released shortly after. AWS emphasizes the need for layered egress detection and protection to mitigate these risks, especially as AI-driven architectures become more prevalent. The lack of egress controls can lead to significant data breaches if unauthorized access is not detected promptly. Companies are urged to implement robust monitoring and control measures to safeguard their cloud workloads from these threats. 3 sources 74

Extracted Entities

CVE-2025-55182

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)

Malware (1)

MITRE ATT&CK (1)

Platforms (1)