The React Team has disclosed a critical security vulnerability affecting React Server Components that can allow unauthenticated remote code execution on affected servers. The issue is tracked as CVE-2025-55182 and carries a cvss score of 10.0, the highest possible severity rating.
Developers using React Server Components are strongly urged to upgrade immediately.
What happened
On November 29, security researcher Lachlan Davidson reported a flaw in how React decodes payloads sent to React Server Function endpoints. By crafting a malicious http request, an unauthenticated attacker could exploit this decoding logic and execute arbitrary code on the server.
Applications may still be vulnerable even if they do not explicitly define any React Server Function endpoints, so long as they support React Server Components. Additional technical details will be released after the fix rollout is fully complete.
Affected packages and versions
The vulnerability is present in versions 19.0, 19.1.0, 19.1.1, and 19.2.0 of the following packages: react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack.
Fixed versions
The issue has been resolved in versions 19.0.1, 19.1.2, and 19.2.1. Any application using the affected packages should upgrade to one of these versions immediately.
Who is not affected
Applications that do not use server-side React code are not affected. Apps that do not use a framework, bundler, or plugin that supports React Server Components are also not affected.
Affected frameworks and bundlers
Several popular tools depend on or bundle the vulnerable packages. Known affected frameworks and bundlers include Next.js, React Router, Waku, @parcel/rsc, @vitejs/plugin-rsc, and Redwood SDK.
Additional upgrade instructions for these projects will be provided as they become available.
Hosting provider mitigations
The React Team has worked with multiple hosting providers to apply temporary mitigations. These mitigations should not be relied upon as a permanent solution, and applications must still be updated immediately.
Vulnerability overview
React Server Functions allow a client to call a function that runs on a server. React provides integration points used by frameworks and bundlers to allow React code to execute on both the client and the server. Client-side requests are translated into http requests that are forwarded to the server, where React deserializes them into function calls and returns the result.
An unauthenticated attacker can craft a malicious request to a Server Function endpoint that triggers remote code execution during deserialization. Further details will be shared once the rollout of fixes is complete.
Update instructions
Next.js
All users should upgrade to the latest patched version in their current release line.
npm install [email protected] for 15.0.x
npm install [email protected] for 15.1.x
npm install [email protected] for 15.2.x
npm install [email protected] for 15.3.x
npm install [email protected] for 15.4.x
npm install [email protected] for 15.5.x
npm install [email protected] for 16.0.x
Users on Next.js 14.3.0-canary.77 or newer should downgrade to the latest stable 14.x release.
npm install next@14
React Router
Applications using React Router unstable rsc apis should ensure the following dependencies are upgraded.
npm install react@latest
npm install react-dom@latest
npm install react-server-dom-parcel@latest
npm install react-server-dom-webpack@latest
npm install @vitejs/plugin-rsc@latest
Expo
Developers should consult the guidance published on expo.dev/changelog to learn more about mitigation options.
Redwood SDK
Ensure your application is running rwsdk version 1.0.0-alpha.0 or newer.
npm install rwsdk@latest
npm install react@latest react-dom@latest react-server-dom-webpack@latest
Waku
Upgrade all relevant dependencies to their latest versions.
npm install react@latest react-dom@latest react-server-dom-webpack@latest waku@latest
@vitejs/plugin-rsc
Upgrade the rsc plugin and related dependencies.
npm install react@latest react-dom@latest @vitejs/plugin-rsc@latest
react-server-dom-parcel
npm install react@latest react-dom@latest react-server-dom-parcel@latest
react-server-dom-turbopack
npm install react@latest react-dom@latest react-server-dom-turbopack@latest
react-server-dom-webpack
npm install react@latest react-dom@latest react-server-dom-webpack@latest
Timeline
November 29: Lachlan Davidson reported the vulnerability through the Meta bug bounty program.
November 30: Meta security researchers confirmed the issue and collaborated with The React Team.
December 1: A fix was completed and coordinated with hosting providers and open source projects.
December 3: The fix was published to npm and the vulnerability was publicly disclosed as CVE-2025-55182.
Attribution
The React Team thanks Lachlan Davidson for responsibly discovering, reporting, and assisting in the remediation of this vulnerability.
Source: React blog, critical security vulnerability in React server components, December 3, 2025
Status Update 12 December 2025: New RSC vulnerabilities identified
Two additional vulnerabilities (CVE-2025-55184 and CVE-2025-55183) have been identified in the React Server Components (RSC) implementation used by frameworks including Next.js. These issues were uncovered by an external security researcher participating in Vercel and Meta’s bug bounty program, following increased community scrutiny after the React2Shell incident. We appreciate the continued collaboration and responsible disclosure efforts. At this time, there is no evidence of exploitation in the wild.
Vulnerability details
-
CVE-2025-55184 — High Severity (Denial of Service):
Specially crafted HTTP requests sent to any App Router endpoint can cause the server to hang and consume excessive CPU during deserialization. All versions handling RSC requests are affected. -
CVE-2025-55183 — Medium Severity (Source Code Exposure):
Malicious HTTP requests to App Router endpoints may result in compiled Server Action source code being returned. While this could expose business logic, secrets are not at risk unless hardcoded directly in Server Action code.
Required action
These vulnerabilities impact React versions 19.0.0–19.2.1 and Next.js versions 13.x–16.x.
If you are running an affected version, upgrade immediately, even if additional mitigations are in place.
