# CVE-2025-55182 (React2Shell)

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.

- Page: https://www.vulneraibility.com/cve/CVE-2025-55182
- CVSS: 10.0
- Known exploited: yes, in CISA KEV since 2025-12-05; CISA due date 2025-12-12; known ransomware use
- EPSS: 99.80%
- Public exploit code: 1 on Exploit-DB · 1 Metasploit module · 461 GitHub proofs of concept · 1 Nuclei template (first 2025-06-06)
- CISA SSVC: exploitation active, automatable yes, technical impact total (assessed 2026-08-04)
- Weakness: CWE-502
- Also known as: GHSA-fv66-9v8q-g76r
- Published: 2025-12-03

## Affected versions

- Meta react-server-dom-parcel: affected <= 19.0.0; >= 19.1.0 and <= 19.1.1; <= 19.2.0
- Meta react-server-dom-turbopack: affected <= 19.0.0; >= 19.1.0 and <= 19.1.1; <= 19.2.0
- Meta react-server-dom-webpack: affected <= 19.0.0; >= 19.1.0 and <= 19.1.1; <= 19.2.0

A version outside these ranges is not a statement that it is unaffected.

## References

- [other] https://www.facebook.com/security/advisories/cve-2025-55182
- [other] https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components
- [other] https://aws.amazon.com/blogs/security/china-nexus-cyber-threat-groups-rapidly-exploit-react2shell-vulnerability-cve-2025-55182/
- [other] https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-55182
- [other] http://www.openwall.com/lists/oss-security/2025/12/03/4
- [other] https://news.ycombinator.com/item?id=46136026

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.