CVE-2025-55182

Confirmed PUBLISHED

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including...

Meta · react-server-dom-webpack, react-server-dom-turbopack, react-server-dom-parcel

1 day faster than CISA KEV

Exploited in the wild Active exploitation observed Used in malware PoC available

Recommended Action

Prioritize immediate patching and validate internet-facing exposure. Monitor for matching exploitation attempts in your environment.

View KEV Feed Talk to Sales

Confidence

Confirmed

Exploitation Status

Active exploitation observed

Observed in Sensors

Yes

Attempts (30d)

946

Unique Attacker IPs

114

CISA KEV

In CISA KEV

CVSS / EPSS

10.0 Critical EPSS 99.6%

At a Glance

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.

cisa nuclei_scanner malware

CVE Published: Dec 03, 2025
Exploitation Reported: Jun 01, 2026
CVSS: 10.0 Critical
EPSS: 99.6%

Remote Low complexity No user interaction Unauthenticated

Affected Versions

Vendor	Product	Version	Status
Meta	react-server-dom-webpack	19.0.0 to <= 19.0.0	Affected
Meta	react-server-dom-webpack	19.1.0 to <= 19.1.1	Affected
Meta	react-server-dom-webpack	19.2.0 to <= 19.2.0	Affected
Meta	react-server-dom-turbopack	19.0.0 to <= 19.0.0	Affected
Meta	react-server-dom-turbopack	19.1.0 to <= 19.1.1	Affected
Meta	react-server-dom-turbopack	19.2.0 to <= 19.2.0	Affected
Meta	react-server-dom-parcel	19.0.0 to <= 19.0.0	Affected
Meta	react-server-dom-parcel	19.1.0 to <= 19.1.1	Affected
Meta	react-server-dom-parcel	19.2.0 to <= 19.2.0	Affected

CVE References

facebook.com/security/advisories/cve-2025-55182 facebook.com · CVE Record https://www.facebook.com/security/advisories/cve-2025-55182
react.dev/blog/2025/12/03/critical-security-vulnerabil... react.dev · CVE Record https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-...

Recommended Actions

Prioritize immediate patching and validate internet-facing exposure. Monitor for matching exploitation attempts in your environment.
Review sensor telemetry for request paths, attacker IPs, and payload patterns that may inform detection and exposure validation.
Check enrichment artifacts for scanner coverage and available PoCs before rolling remediation validation.
Use the Pro API to automate enrichment, telemetry, and workflow delivery for VM, SOC, and CTI pipelines.

Known Exploited Vulnerability Sources

Catalogues that list this CVE as a known exploited vulnerability.

Per-source evidence links for KEV attestations are available through the KEVIntel Pro API.

Learn about Pro API access

Source	Added
The Shadowserver First	2026-06-01 00:00 UTC
CVE	2026-06-01 10:45 UTC
CISA	2026-06-02 14:04 UTC
KEVIntel	2026-07-03 10:18 UTC

Operational indicators for this CVE are listed on the Detection tab.

Indicators of Compromise (IoCs)

Attacker IP IoCs observed in KEVIntel sensors are available to Pro and Enterprise accounts on the Detection tab and through the Pro API.

Learn about Pro API access

Observed Detection Signals (30d)

Aggregate counts from KEVIntel sensor telemetry for this CVE.

Distinct request paths: 27
Distinct User-Agents: 40

The specific request paths and User-Agents attackers are using are available on Pro and Enterprise plans.

Request Enterprise Access Compare plans Create free account

Scanner Artifacts

Nuclei and Metasploit references linked to this CVE.

Scanner	Reference	Detected
Nuclei	https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-55182.yaml	Jun 01, 2026

CVSS Scores

CVSS v3.1 10.0 Critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Exploitation Status

Exploited in the wild

Recorded 2026-06-01 10:45:37 UTC · CVE

Active exploitation observed

Recorded 2026-06-15 12:54:46 UTC · KEVIntel sensor

Used in malware

Recorded 2026-06-02 14:04:43 UTC · CVE

Proof of concept available

Recorded 2026-06-12 14:21:08 UTC · Nuclei Templates

Weaknesses (CWE)

CWE-502

Deserialization of Untrusted Data

Scanner Integrations

Scanner	Reference	Detected
Nuclei	https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-55182.yaml	Jun 01, 2026

Potential Proof of Concepts

These PoCs are unverified and could contain malware. Use at your own risk.

React Server Components - Remote Code Execution

nuclei · Created Unknown

Timeline

Key exploitation, disclosure, scanner coverage, and KEV attestation events for this CVE.

15 Jun 2026 12:54 UTC about 1 month ago

15 Jun 2026 12:54 UTC · about 1 month ago

Observed by KEVIntel sensors

Evidence-backed exploitation signal
15 Jun 2026 12:54 UTC about 1 month ago

15 Jun 2026 12:54 UTC · about 1 month ago

Indicators of compromise added (114)

Indicators of compromise recorded
12 Jun 2026 14:21 UTC about 1 month ago

12 Jun 2026 14:21 UTC · about 1 month ago

Public PoC available

Public proof-of-concept code published
2 Jun 2026 14:04 UTC about 2 months ago

2 Jun 2026 14:04 UTC · about 2 months ago

First public exploitation report

Exploit observed in malware
2 Jun 2026 14:04 UTC about 2 months ago

2 Jun 2026 14:04 UTC · about 2 months ago

Added to CISA KEV

Listed in the CISA Known Exploited Vulnerabilities catalog
1 Jun 2026 15:34 UTC about 2 months ago

1 Jun 2026 15:34 UTC · about 2 months ago

Nuclei template available

Scanner coverage available
1 Jun 2026 10:45 UTC about 2 months ago

1 Jun 2026 10:45 UTC · about 2 months ago

KEV confirmed by CVE

Exploitation attested by an external source
1 Jun 2026 00:00 UTC about 2 months ago

1 Jun 2026 00:00 UTC · about 2 months ago

Added to KEVIntel KEV Feed

High-confidence, third-party attested exploitation
3 Dec 2025 15:40 UTC 8 months ago

3 Dec 2025 15:40 UTC · 8 months ago

CVE published

Vulnerability disclosed publicly
8 Aug 2025 18:21 UTC 11 months ago

8 Aug 2025 18:21 UTC · 11 months ago

CVE ID reserved

Identifier reserved by the CNA

Automate This Intelligence with the Pro API

Confidence scoring, exploit status, sensor telemetry, PoCs, scanner integrations, mentions, and tags are available programmatically for VM, SOC, and CTI workflows.

View Pro Pricing View API Docs

Pro API Example

GET /api/v2/pro/kevs/CVE-2025-55182

{
  "cve_id": "CVE-2025-55182",
  "title": "A pre-authentication remote code execution vulnerability exists in React Serv...",
  "affected_vendor": "Meta",
  "affected_product": "react-server-dom-webpack, react-server-dom-turbopack, react-server-dom-parcel",
  "affected_versions": [
    { "vendor": "...", "product": "...", "status": "affected", "display_label": "..." }
  ],
  "confidence": "Confirmed",
  "cvss_score": 10.0,
  "epss_score": 0.99562,
  "exploit_status": {
    "exploited_in_the_wild": true,
    "active_exploitation_observed": true
  },
  "sensor_telemetry": { "...": "Pro API fields" },
  "proof_of_concepts": [ "..." ],
  "scanner_integrations": [ "..." ]
}

The free JSON API returns basic KEV fields only. Confidence, telemetry, and artifact enrichment require Pro API access.

CVE-2025-55182

At a Glance

Affected Versions

CVE References

Recommended Actions

Known Exploited Vulnerability Sources

Observed Exploitation Attempts

Exploitation Attempts Over the Last 41 Days

See more exploitation detail

Indicators of Compromise (IoCs)

Observed Detection Signals (30d)

Scanner Artifacts

Virtual Patch

CVSS Scores

Exploitation Status

Weaknesses (CWE)

Scanner Integrations

Potential Proof of Concepts

Timeline

Automate This Intelligence with the Pro API