U.S. CISA adds a Meta React Server Components flaw to its Known Exploited Vulnerabilities catalog

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a Meta React Server Components flaw, tracked as CVE-2025-55182 with a CVSS score of 10.0, to its Known Exploited Vulnerabilities catalog.

The vulnerability is a pre-authentication remote code execution flaw in React Server Components versions 19.0.0, 19.1.0, 19.1.1 and 19.2.0, affecting packages including react-server-dom-parcel, react-server-dom-turbopack and react-server-dom-webpack, caused by unsafe deserialisation of payloads from HTTP requests to Server Function endpoints.

The researcher Lachlan Davidson reported the vulnerability on 29 November, explaining that the unsafe decoding allows unauthenticated code execution and that apps using React Server Components may be exposed even without Server Function endpoints. Versions 19.0.1, 19.1.2 and 19.2.1 have addressed the flaw, and Amazon detected China-linked groups exploiting CVE-2025-55182 (React2Shell) within hours of the December 3 disclosure.

According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, CISA orders federal agencies to fix the vulnerabilities by 26 December 2025.