Critical RSC Bugs in React and Next.js Allow Unauthenticated Remote Code Execution

A critical security vulnerability in React Server Components could allow unauthenticated remote code execution, according to The Hacker News’ coverage of CVE-2025-55182, which has a CVSS score of 10.0. The React Team said the issue stems from how React decodes payloads sent to React Server Function endpoints, and could affect apps even without Server Function endpoints if they support React Server Components.

Wiz estimated that 39% of cloud environments have instances vulnerable to CVE-2025-55182 and CVE-2025-66478, the latter being the CVE tied to Next.js via App Router (CVE-2025-66478, CVSS 10.0).

The vulnerability impacts npm packages react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack in versions 19.0, 19.1.0, 19.1.1, and 19.2.0, with patches in 19.0.1, 19.1.2, and 19.2.1, and Next.js versions >=14.3.0-canary.77, >=15, and >=16, with patches listed as 16.0.7, 15.5.7, 15.4.8, 15.3.6, 15.2.6, 15.1.9, and 15.0.5; Lachlan Davidson, a New Zealand-based security researcher, was credited with discovering and reporting the flaw on 29 November 2025.