CVE-2025-55182
10.0 critical
KEV · due 2025-12-12
ransomware
exploit ×464
SSVC exploitation: active
Analyzed
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.
Fix
Public exploits 464
- Unauthenticated RCE in React Server Components (React2Shell) (exploit module) Metasploit · verified · 2025-12-03
- React Server 19.2.0 - Remote Code Execution (webapps · multiple) Exploit-DB · 2026-04-09
- 0x0asif/CVE-2025-55182 PoC on GitHub
- 0xBlackash/CVE-2025-55182 PoC on GitHub
- 0xN7y/CVE-2025-55182 PoC on GitHub
- 0xPThree/cve-2025-55182 PoC on GitHub
- 0xRAM-bit/CVE-2025-55182 PoC on GitHub
- 0xROI/CVE-2025-55182 PoC on GitHub
- 0xSalm0n/CVE-2025-55182 PoC on GitHub
- 0xsj/CVE-2025-55182 PoC on GitHub
- 3SC0133/CVE-2025-55182-React2Shell PoC on GitHub
- 4nuxd/React2Shell PoC on GitHub
- 6t2kydmp8k-jpg/CVE-2025-55182-Vulnerability-Proof-of-Concept-Group-Project- PoC on GitHub
- ABCFabian/React2Shell-CVE-2025-55182-Testing-Environment PoC on GitHub
- AbdullahMaqbool22/Explosive-As-Hell-MCS-Qualifer-Web-500 PoC on GitHub
- AdityaBhatt3010/React2Shell-CVE-2025-55182 PoC on GitHub
- AdityaBhatt3010/React2Shell-CVE-2025-55182-The-Deserialization-Bug-That-Broke-the-Web PoC on GitHub
- AggressiveUser/React2Hell PoC on GitHub
- Airis101/CVE-2025-55182-analysis PoC on GitHub
- AkhmadKholmurodov/React2Shell_Exploit PoC on GitHub
- and 444 more
Each line links to the index that lists it, never to exploit code. Exploit-DB's "verified" and a Metasploit rank of good or better count as verified; a PoC-in-GitHub entry is a repository's claim.
CISA KEV required action · due 2025-12-12
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Added to the catalog 2025-12-05. CISA KEV
Patch, vendor advisory and mitigation references on NVD 3
- https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components Patch, Vendor Advisory
- https://www.facebook.com/security/advisories/cve-2025-55182 Vendor Advisory
- http://www.openwall.com/lists/oss-security/2025/12/03/4 Mailing List, Patch, Third Party Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
In the news 5
- React Server Components Exploitation Consolidates as Two IPs Generate Majority of Attack Traffic GreyNoise blog · 2026-02-02
- PeerBlight Linux Backdoor Exploits React2Shell CVE-2025-55182 Huntress blog · 2025-12-10
- React2Shell: Technical Deep-Dive & In-the-Wild Exploitation of CVE-2025-55182 Wiz blog · 2025-12-08
- CVE-2025-55182 (React2Shell) Opportunistic Exploitation In The Wild: What The GreyNoise Observation Grid Is Seeing So Far GreyNoise blog · 2025-12-05
- React2Shell (CVE-2025-55182): Everything You Need to Know About the Critical React Vulnerability Wiz blog · 2025-12-03
Change history 1
- First seenCVSS 10.0 · in KEV · facebook, vercelNVD modified 2026-10-08 10:35
Affected (CPE criteria) 76
cpe:2.3:a:facebook:react:19.0.0:*:*:*:*:*:*:*cpe:2.3:a:facebook:react:19.1.0:*:*:*:*:*:*:*cpe:2.3:a:facebook:react:19.1.1:*:*:*:*:*:*:*cpe:2.3:a:facebook:react:19.2.0:*:*:*:*:*:*:*cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*cpe:2.3:a:vercel:next.js:14.3.0:canary77:*:*:*:node.js:*:*cpe:2.3:a:vercel:next.js:14.3.0:canary78:*:*:*:node.js:*:*cpe:2.3:a:vercel:next.js:14.3.0:canary79:*:*:*:node.js:*:*cpe:2.3:a:vercel:next.js:14.3.0:canary80:*:*:*:node.js:*:*cpe:2.3:a:vercel:next.js:14.3.0:canary81:*:*:*:node.js:*:*cpe:2.3:a:vercel:next.js:14.3.0:canary82:*:*:*:node.js:*:*cpe:2.3:a:vercel:next.js:14.3.0:canary83:*:*:*:node.js:*:*cpe:2.3:a:vercel:next.js:14.3.0:canary84:*:*:*:node.js:*:*cpe:2.3:a:vercel:next.js:14.3.0:canary85:*:*:*:node.js:*:*cpe:2.3:a:vercel:next.js:14.3.0:canary86:*:*:*:node.js:*:*cpe:2.3:a:vercel:next.js:14.3.0:canary87:*:*:*:node.js:*:*cpe:2.3:a:vercel:next.js:15.6.0:-:*:*:*:node.js:*:*cpe:2.3:a:vercel:next.js:15.6.0:canary0:*:*:*:node.js:*:*cpe:2.3:a:vercel:next.js:15.6.0:canary1:*:*:*:node.js:*:*cpe:2.3:a:vercel:next.js:15.6.0:canary10:*:*:*:node.js:*:*cpe:2.3:a:vercel:next.js:15.6.0:canary11:*:*:*:node.js:*:*cpe:2.3:a:vercel:next.js:15.6.0:canary12:*:*:*:node.js:*:*cpe:2.3:a:vercel:next.js:15.6.0:canary13:*:*:*:node.js:*:*cpe:2.3:a:vercel:next.js:15.6.0:canary14:*:*:*:node.js:*:*cpe:2.3:a:vercel:next.js:15.6.0:canary15:*:*:*:node.js:*:*cpe:2.3:a:vercel:next.js:15.6.0:canary16:*:*:*:node.js:*:*cpe:2.3:a:vercel:next.js:15.6.0:canary17:*:*:*:node.js:*:*cpe:2.3:a:vercel:next.js:15.6.0:canary18:*:*:*:node.js:*:*cpe:2.3:a:vercel:next.js:15.6.0:canary19:*:*:*:node.js:*:*cpe:2.3:a:vercel:next.js:15.6.0:canary2:*:*:*:node.js:*:*cpe:2.3:a:vercel:next.js:15.6.0:canary20:*:*:*:node.js:*:*cpe:2.3:a:vercel:next.js:15.6.0:canary21:*:*:*:node.js:*:*cpe:2.3:a:vercel:next.js:15.6.0:canary22:*:*:*:node.js:*:*cpe:2.3:a:vercel:next.js:15.6.0:canary23:*:*:*:node.js:*:*cpe:2.3:a:vercel:next.js:15.6.0:canary24:*:*:*:node.js:*:*cpe:2.3:a:vercel:next.js:15.6.0:canary25:*:*:*:node.js:*:*cpe:2.3:a:vercel:next.js:15.6.0:canary26:*:*:*:node.js:*:*cpe:2.3:a:vercel:next.js:15.6.0:canary27:*:*:*:node.js:*:*cpe:2.3:a:vercel:next.js:15.6.0:canary28:*:*:*:node.js:*:*cpe:2.3:a:vercel:next.js:15.6.0:canary29:*:*:*:node.js:*:*- and 36 more
References 6
- https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components Patch, Vendor Advisory
- https://www.facebook.com/security/advisories/cve-2025-55182 Vendor Advisory
- http://www.openwall.com/lists/oss-security/2025/12/03/4 Mailing List, Patch, Third Party Advisory
- https://news.ycombinator.com/item?id=46136026 Issue Tracking
- https://aws.amazon.com/blogs/security/china-nexus-cyber-threat-groups-rapidly-exploit-react2shell-vulnerability-cve-2025-55182/ Third Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-55182 US Government Resource