A really serious bug exists in the React Server Components, a popular JavaScript library and the Next.js framework that has reached a imperfect CVSS score of 10.0!
CVE-2025-55182 is a critical remote code execution vulnerability in React Server Components that allows attackers to execute arbitrary code without authentication by exploiting improper input deserialization. This vulnerability has been actively exploited in the wild, particularly targeting applications using the Next.js framework.
This vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.
Anyone using these components on their web server should upgrade the packages immediately! The libraries are often included in other projects, so you need to search requirements or include files. On Linux systems, you can use the following commands to search for their inclusion:
find ~/project -name 'package.json' -type f -exec grep -Hin 'react' {} \;
# or
find ~/project -name 'package.json' -type f -exec grep -Hin 'node.js' {} \;