Skip to content
Critical RCE Vulnerability in Meta React Server Components Discovered

Critical RCE Vulnerability in Meta React Server Components Discovered

First seen 22 Oct 2026, 04:38 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 22, 2026 at 06:39 UTC
  • •CVE-2025-55182 is a critical RCE vulnerability with a CVSS score of 10.0.
  • •It allows unauthenticated remote code execution via crafted JSON payloads in React Server Components.
  • •CISA added this CVE to its KEV catalog on December 5, 2025, indicating active exploitation.

CVE-2025-55182 is a critical remote code execution vulnerability in Meta React Server Components, with a CVSS score of 10.0. It allows unauthenticated attackers to execute arbitrary commands on the server by sending crafted JSON payloads. This vulnerability was added to CISA's Known Exploited Vulnerabilities catalog on December 5, 2025, indicating active exploitation in the wild. Affected versions include react-server-dom-webpack and react-server-dom-esm from 19.0.0 to 19.2.0. The exploit can lead to full server compromise, as it executes commands with the privileges of the Node.js process, often as root. Organizations are urged to confirm their exposure and implement remediation strategies, including applying vendor patches and reducing internet exposure. As of October 2026, the vulnerability remains a significant concern for users of React Server Components.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2020-03-12
Public exploit for CVE-2020-1350 released
A proof-of-concept exploit appeared on GitHub, lowering the barrier for opportunistic attackers.
GitHub
2025-10-01
Public exploit for CVE-2025-66478 released
A proof-of-concept exploit appeared on GitHub, lowering the barrier for opportunistic attackers.
GitHub
2025-12-03
CVE-2025-55182 published
Meta disclosed a critical RCE vulnerability in React Server Components, affecting multiple versions.
Nhimg
2025-12-05
CVE added to CISA KEV
CISA included CVE-2025-55182 in its Known Exploited Vulnerabilities catalog, confirming active exploitation.
Nhimg
2026-01-06
First public PoC released
Proof-of-concept code demonstrating the exploitation of CVE-2025-55182 was made publicly available.
Sploitus
Recent
Ongoing exploitation confirmed
Reports indicate that the vulnerability is actively being exploited in the wild, prompting urgent remediation efforts.
Sploitus

More articles in this cluster (2)

Following this threat?

Track Ubuntu and CVE-2020-1350 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (15)

1 / 4

Common questions

Which versions of React Server Components are affected?
Affected versions include react-server-dom-webpack and react-server-dom-esm from 19.0.0 to 19.2.0.
Is CVE-2025-55182 actively exploited?
Yes, it has been confirmed that CVE-2025-55182 is actively exploited in the wild.
What should organizations do to mitigate this vulnerability?
Organizations should apply vendor patches immediately and consider reducing internet exposure of affected systems.