Admins and defenders gird themselves against maximum-severity server vulnerability

Security defenders are girding themselves after the disclosure of a maximum-severity vulnerability in React Server, an open source package widely used by websites and cloud environments. Exploitation requires only a single HTTP request and has shown near-100% reliability in testing, with the vulnerability tracked as CVE-2025-55182 and a perfect 10 severity rating.

The flaw affects React versions 19.0.1, 19.1.2, or 19.2.1, and several third‑party components such as Vite RSC plugin, Parcel RSC plugin, React Router RSC preview, RedwoodSDK, Waku, and Next.js; Next.js has assigned CVE-2025-66478 to track the vulnerability in its package.

According to Wiz and fellow security firm Aikido, the vulnerability stems from unsafe deserialization, enabling unauthenticated, remote code execution via a specially crafted HTTP request and affecting the default configuration of popular frameworks. Both companies are advising admins and developers to upgrade React and any dependencies that rely on it, and to scan codebases for uses of React with relevant plugins and frameworks.