A critical security vulnerability affecting React Server Components allows unauthenticated attackers to execute malicious code on servers running popular web frameworks.
The flaw, tracked as CVE-2025-55182 in React and CVE-2025-66478 in Next.js, carries the maximum CVSS severity rating of 10.0 and affects default configurations without requiring developer modifications.
| CVE ID | Product | CVSS Score | Severity |
| CVE-2025-55182 | React Server Components | 10.0 | critical |
| CVE-2025-66478 | Next.js App Router | 10.0 | critical |
Vulnerability Overview
The remote code execution (RCE) vulnerability stems from insecure deserialization in the React Server Components (RSC) “Flight” protocol.
When servers process specially crafted HTTP requests containing malformed RSC payloads, they fail to validate the data structure properly.
This allows attacker-controlled information to influence server-side execution logic, resulting in privileged JavaScript code execution.
The vulnerability affects any framework or library that implements the React Server Specification, including the Vite RSC plugin, Parcel RSC plugin, React Router RSC preview, RedwoodSDK, and Waku.
Wiz Research data reveals that 39% of cloud environments contain vulnerable React or Next.js instances.
Next.js appears in 69% of cloud environments, with 61% of those running public applications. This means 44% of all cloud environments have publicly exposed Next.js instances at risk.
The attack vector requires only a single crafted HTTP request to a Server Function endpoint. Testing demonstrates near-100% exploitation reliability, making this a high-fidelity attack that does not require authentication or complex prerequisites.
React Server Functions enable clients to call server-side functions, with React handling the translation between HTTP requests and function calls.
The deserialization flaw occurs when React processes these requests, allowing malicious payloads to achieve RCE before legitimate functions are executed.
Developers must upgrade to patched versions immediately. The vulnerability was reported on November 29th by Lachlan Davidson through Meta’s Bug Bounty program.
Fixes were published to npm on December 3rd after coordination with hosting providers for temporary mitigations.
Next.js Upgrade Commands:
- For 15.0.x:Â npm install [email protected]
- For 15.1.x:Â npm install [email protected]
- For 15.2.x:Â npm install [email protected]
- For 15.3.x:Â npm install [email protected]
- For 15.4.x:Â npm install [email protected]
- For 15.5.x:Â npm install [email protected]
- For 16.0.x:Â npm install [email protected]
All affected frameworks require upgrading to the latest React Server DOM packages. Applications that do not use React Server Components or server-side React code are not affected.
Hosting providers have implemented temporary mitigations, but these should not replace immediate patching.
The React team continues working with the ecosystem to ensure comprehensive protection as fixes roll out across the development community.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
