Catastrophic React Flaw (CVE-2025-55182, CVSS 10.0) Allows Unauthenticated RCE on Next.js and Server Components

According to Daily CyberSecurity, CVE-2025-55182 is a catastrophic vulnerability rated CVSS 10.0 that allows unauthenticated remote code execution on servers running React Server Components. The flaw lies in how deserialization occurs as React translates data from the client back into server actions, enabling an unauthenticated attacker to craft a malicious HTTP request to any Server Function endpoint and execute code on the server.

The issue affects the underlying packages react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack, with affected versions ranging from 19.0 through 19.2.0, and it cascades to major frameworks and bundlers including next, react-router, waku, @parcel/rsc, @vitejs/plugin-rsc, and rwsdk.

Patches have been released, with fixes for React Core Packages in versions 19.0.1, 19.1.2, and 19.2.1; Next.js users must upgrade to the latest patched version in their release line immediately: v15.0.x → next@15.0.5, v15.1.x → next@15.1.9, v16.0.x → next@16.0.7, and those on Next.js 14.3.0-canary.77 or later should downgrade to next@14. Developers using unstable RSC APIs in React Router, Waku, or Redwood SDK should also run updates to the latest versions. The React Team emphasises that upgrades are mandatory to secure affected applications.