Every CVE Search/ Get API key

CVE-2025-55182

React Server Components are Vulnerable to RCE

10.0 CriticalIn KEVPublic exploitFix available

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

99.7%Up 99.3 points since Dec 4, 2025
90%50%10%1%

What each source reports

CVE List Score used 10.0

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.

Record
CVE-2025-55182
CVSS 3.1
10.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness
CWE-502
Updated
2026-11-02
EUVDEUVD-2025-200983 10.0

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.

Record
EUVD-2025-200983
CVSS 3.1
10.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-fv66-9v8q-g76r 10.0

React Server Components are Vulnerable to RCE

Impact

There is an unauthenticated remote code execution vulnerability in React Server Components.

We recommend upgrading immediately.

The vulnerability is present in versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 of:

Patches

A fix was introduced in versions 19.0.1, 19.1.2, and 19.2.1. If you are using any of the above packages please upgrade to any of the fixed versions immediately.

If your app’s React code does not use a server, your app is not affected by this vulnerability. If your app does not use a framework, bundler, or bundler plugin that supports React Server Components, your app is not affected by this vulnerability.

References

See the blog post for more information and upgrade instructions.

Record
GHSA-fv66-9v8q-g76r
CVSS 3.1
10.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness
CWE-502
Updated
2026-11-02
CISA KEV No score

Meta React Server Components Remote Code Execution Vulnerability

Meta React Server Components contains a remote code execution vulnerability that could allow unauthenticated remote code execution by exploiting a flaw in how React decodes payloads sent to React Server Function endpoints. Please note CVE-2025-66478 has been rejected, but it is associated with CVE-2025- 55182.

Record
CVE-2025-55182
Updated
2026-11-02
NVD 10.0

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.

Record
CVE-2025-55182
CVSS 3.1
10.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness
CWE-502
Updated
2026-11-02
OSV 10.0

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.

Record
CVE-2025-55182
CVSS 3.1
10.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
Show 49 moreShow less
OSVGHSA-fv66-9v8q-g76r 10.0

React Server Components are Vulnerable to RCE

Impact

There is an unauthenticated remote code execution vulnerability in React Server Components.

We recommend upgrading immediately.

The vulnerability is present in versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 of:

Patches

A fix was introduced in versions 19.0.1, 19.1.2, and 19.2.1. If you are using any of the above packages please upgrade to any of the fixed versions immediately.

If your app’s React code does not use a server, your app is not affected by this vulnerability. If your app does not use a framework, bundler, or bundler plugin that supports React Server Components, your app is not affected by this vulnerability.

References

See the blog post for more information and upgrade instructions.

Record
GHSA-fv66-9v8q-g76r
CVSS 3.1
10.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness
CWE-502
Updated
2026-11-02
OSVCLSA-2026-1789473405 No score

TuxCare security update for 22 packages (1 CVE)

TuxCare rebuilt 22 packages to address 1 CVE. Fixed in 16.0.6-tuxcare.4.

Record
CLSA-2026-1789473405
Updated
2026-11-02
OSVCLSA-2026-1790850263 No score

TuxCare security update for 9 packages (1 CVE)

TuxCare rebuilt 9 packages to address 1 CVE. Fixed in 15.1.2-tuxcare.1.

Record
CLSA-2026-1790850263
Updated
2026-11-02
OSVCLSA-2026-1790853485 No score

TuxCare security update for 21 packages (1 CVE)

TuxCare rebuilt 21 packages to address 1 CVE. Fixed in 15.5.25-tuxcare.1.

Record
CLSA-2026-1790853485
Updated
2026-11-02
OSVCLSA-2026-1790864321 No score

TuxCare security update for 21 packages (1 CVE)

TuxCare rebuilt 21 packages to address 1 CVE. Fixed in 15.5.23-tuxcare.1.

Record
CLSA-2026-1790864321
Updated
2026-11-02
OSVCLSA-2026-1790866117 No score

TuxCare security update for 21 packages (1 CVE)

TuxCare rebuilt 21 packages to address 1 CVE. Fixed in 15.5.24-tuxcare.1.

Record
CLSA-2026-1790866117
Updated
2026-11-02
OSVCLSA-2026-1790866219 No score

TuxCare security update for 21 packages (1 CVE)

TuxCare rebuilt 21 packages to address 1 CVE. Fixed in 15.5.26-tuxcare.1.

Record
CLSA-2026-1790866219
Updated
2026-11-02
OSVCLSA-2026-1792195716 No score

TuxCare security update for create-next-app (1 CVE)

TuxCare rebuilt create-next-app to address 1 CVE. Fixed in 15.5.25-tuxcare.1.

Record
CLSA-2026-1792195716
Updated
2026-11-02
OSVCLSA-2026-1792195717 No score

TuxCare security update for create-next-app (1 CVE)

TuxCare rebuilt create-next-app to address 1 CVE. Fixed in 15.5.23-tuxcare.1.

Record
CLSA-2026-1792195717
Updated
2026-11-02
OSVCLSA-2026-1792195718 No score

TuxCare security update for create-next-app (1 CVE)

TuxCare rebuilt create-next-app to address 1 CVE. Fixed in 15.5.24-tuxcare.1.

Record
CLSA-2026-1792195718
Updated
2026-11-02
OSVCLSA-2026-1792195719 No score

TuxCare security update for create-next-app (1 CVE)

TuxCare rebuilt create-next-app to address 1 CVE. Fixed in 15.5.26-tuxcare.1.

Record
CLSA-2026-1792195719
Updated
2026-11-02
OSVCLSA-2026-1792195755 No score

TuxCare security update for create-next-app (1 CVE)

TuxCare rebuilt create-next-app to address 1 CVE. Fixed in 16.0.6-tuxcare.4.

Record
CLSA-2026-1792195755
Updated
2026-11-02
OSVCLSA-2026-1792196702 No score

TuxCare security update for @next/eslint-plugin-next (1 CVE)

TuxCare rebuilt @next/eslint-plugin-next to address 1 CVE. Fixed in 15.5.25-tuxcare.1.

Record
CLSA-2026-1792196702
Updated
2026-11-02
OSVCLSA-2026-1792196704 No score

TuxCare security update for @next/eslint-plugin-next (1 CVE)

TuxCare rebuilt @next/eslint-plugin-next to address 1 CVE. Fixed in 15.5.23-tuxcare.1.

Record
CLSA-2026-1792196704
Updated
2026-11-02
OSVCLSA-2026-1792196706 No score

TuxCare security update for @next/eslint-plugin-next (1 CVE)

TuxCare rebuilt @next/eslint-plugin-next to address 1 CVE. Fixed in 15.5.24-tuxcare.1.

Record
CLSA-2026-1792196706
Updated
2026-11-02
OSVCLSA-2026-1792196707 No score

TuxCare security update for @next/eslint-plugin-next (1 CVE)

TuxCare rebuilt @next/eslint-plugin-next to address 1 CVE. Fixed in 15.5.26-tuxcare.1.

Record
CLSA-2026-1792196707
Updated
2026-11-02
OSVCLSA-2026-1792196895 No score

TuxCare security update for @next/eslint-plugin-next (1 CVE)

TuxCare rebuilt @next/eslint-plugin-next to address 1 CVE. Fixed in 16.0.6-tuxcare.4.

Record
CLSA-2026-1792196895
Updated
2026-11-02
OSVCLSA-2026-1792206276 No score

TuxCare security update for @next/bundle-analyzer (1 CVE)

TuxCare rebuilt @next/bundle-analyzer to address 1 CVE. Fixed in 15.5.25-tuxcare.1.

Record
CLSA-2026-1792206276
Updated
2026-11-02
OSVCLSA-2026-1792206277 No score

TuxCare security update for @next/bundle-analyzer (1 CVE)

TuxCare rebuilt @next/bundle-analyzer to address 1 CVE. Fixed in 15.5.24-tuxcare.1.

Record
CLSA-2026-1792206277
Updated
2026-11-02
OSVCLSA-2026-1792206278 No score

TuxCare security update for @next/bundle-analyzer (1 CVE)

TuxCare rebuilt @next/bundle-analyzer to address 1 CVE. Fixed in 15.5.23-tuxcare.1.

Record
CLSA-2026-1792206278
Updated
2026-11-02
OSVCLSA-2026-1792206279 No score

TuxCare security update for @next/bundle-analyzer (1 CVE)

TuxCare rebuilt @next/bundle-analyzer to address 1 CVE. Fixed in 15.5.26-tuxcare.1.

Record
CLSA-2026-1792206279
Updated
2026-11-02
OSVCLSA-2026-1792206328 No score

TuxCare security update for @next/bundle-analyzer (1 CVE)

TuxCare rebuilt @next/bundle-analyzer to address 1 CVE. Fixed in 16.0.6-tuxcare.4.

Record
CLSA-2026-1792206328
Updated
2026-11-02
OSVCLSA-2026-1792256955 No score

TuxCare security update for next-rspack (1 CVE)

TuxCare rebuilt next-rspack to address 1 CVE. Fixed in 15.5.25-tuxcare.1.

Record
CLSA-2026-1792256955
Updated
2026-11-02
OSVCLSA-2026-1792256956 No score

TuxCare security update for next-rspack (1 CVE)

TuxCare rebuilt next-rspack to address 1 CVE. Fixed in 15.5.23-tuxcare.1.

Record
CLSA-2026-1792256956
Updated
2026-11-02
OSVCLSA-2026-1792256957 No score

TuxCare security update for next-rspack (1 CVE)

TuxCare rebuilt next-rspack to address 1 CVE. Fixed in 15.5.24-tuxcare.1.

Record
CLSA-2026-1792256957
Updated
2026-11-02
OSVCLSA-2026-1792256958 No score

TuxCare security update for next-rspack (1 CVE)

TuxCare rebuilt next-rspack to address 1 CVE. Fixed in 15.5.26-tuxcare.1.

Record
CLSA-2026-1792256958
Updated
2026-11-02
OSVCLSA-2026-1792256967 No score

TuxCare security update for next-rspack (1 CVE)

TuxCare rebuilt next-rspack to address 1 CVE. Fixed in 16.0.6-tuxcare.4.

Record
CLSA-2026-1792256967
Updated
2026-11-02
OSVCLSA-2026-1792272210 No score

TuxCare security update for @next/plugin-storybook (1 CVE)

TuxCare rebuilt @next/plugin-storybook to address 1 CVE. Fixed in 15.5.25-tuxcare.1.

Record
CLSA-2026-1792272210
Updated
2026-11-02
OSVCLSA-2026-1792272211 No score

TuxCare security update for @next/plugin-storybook (1 CVE)

TuxCare rebuilt @next/plugin-storybook to address 1 CVE. Fixed in 15.5.23-tuxcare.1.

Record
CLSA-2026-1792272211
Updated
2026-11-02
OSVCLSA-2026-1792272212 No score

TuxCare security update for @next/plugin-storybook (1 CVE)

TuxCare rebuilt @next/plugin-storybook to address 1 CVE. Fixed in 15.5.24-tuxcare.1.

Record
CLSA-2026-1792272212
Updated
2026-11-02
OSVCLSA-2026-1792272214 No score

TuxCare security update for @next/plugin-storybook (1 CVE)

TuxCare rebuilt @next/plugin-storybook to address 1 CVE. Fixed in 15.5.26-tuxcare.1.

Record
CLSA-2026-1792272214
Updated
2026-11-02
OSVCLSA-2026-1792272250 No score

TuxCare security update for @next/plugin-storybook (1 CVE)

TuxCare rebuilt @next/plugin-storybook to address 1 CVE. Fixed in 16.0.6-tuxcare.4.

Record
CLSA-2026-1792272250
Updated
2026-11-02
OSVCLSA-2026-1792292985 No score

TuxCare security update for @next/polyfill-module (1 CVE)

TuxCare rebuilt @next/polyfill-module to address 1 CVE. Fixed in 15.5.25-tuxcare.1.

Record
CLSA-2026-1792292985
Updated
2026-11-02
OSVCLSA-2026-1792292986 No score

TuxCare security update for @next/polyfill-module (1 CVE)

TuxCare rebuilt @next/polyfill-module to address 1 CVE. Fixed in 15.5.23-tuxcare.1.

Record
CLSA-2026-1792292986
Updated
2026-11-02
OSVCLSA-2026-1792292987 No score

TuxCare security update for @next/polyfill-module (1 CVE)

TuxCare rebuilt @next/polyfill-module to address 1 CVE. Fixed in 15.5.24-tuxcare.1.

Record
CLSA-2026-1792292987
Updated
2026-11-02
OSVCLSA-2026-1792292988 No score

TuxCare security update for @next/polyfill-module (1 CVE)

TuxCare rebuilt @next/polyfill-module to address 1 CVE. Fixed in 15.5.26-tuxcare.1.

Record
CLSA-2026-1792292988
Updated
2026-11-02
OSVCLSA-2026-1792293023 No score

TuxCare security update for @next/polyfill-module (1 CVE)

TuxCare rebuilt @next/polyfill-module to address 1 CVE. Fixed in 16.0.6-tuxcare.4.

Record
CLSA-2026-1792293023
Updated
2026-11-02
OSVCLSA-2026-1792304696 No score

TuxCare security update for @next/polyfill-nomodule (1 CVE)

TuxCare rebuilt @next/polyfill-nomodule to address 1 CVE. Fixed in 15.5.25-tuxcare.1.

Record
CLSA-2026-1792304696
Updated
2026-11-02
OSVCLSA-2026-1792304698 No score

TuxCare security update for @next/polyfill-nomodule (1 CVE)

TuxCare rebuilt @next/polyfill-nomodule to address 1 CVE. Fixed in 15.5.23-tuxcare.1.

Record
CLSA-2026-1792304698
Updated
2026-11-02
OSVCLSA-2026-1792304699 No score

TuxCare security update for @next/polyfill-nomodule (1 CVE)

TuxCare rebuilt @next/polyfill-nomodule to address 1 CVE. Fixed in 15.5.24-tuxcare.1.

Record
CLSA-2026-1792304699
Updated
2026-11-02
OSVCLSA-2026-1792304701 No score

TuxCare security update for @next/polyfill-nomodule (1 CVE)

TuxCare rebuilt @next/polyfill-nomodule to address 1 CVE. Fixed in 15.5.26-tuxcare.1.

Record
CLSA-2026-1792304701
Updated
2026-11-02
OSVCLSA-2026-1792304746 No score

TuxCare security update for @next/polyfill-nomodule (1 CVE)

TuxCare rebuilt @next/polyfill-nomodule to address 1 CVE. Fixed in 16.0.6-tuxcare.4.

Record
CLSA-2026-1792304746
Updated
2026-11-02
OSVCLSA-2026-1792326281 No score

TuxCare security update for @next/react-refresh-utils (1 CVE)

TuxCare rebuilt @next/react-refresh-utils to address 1 CVE. Fixed in 15.5.25-tuxcare.1.

Record
CLSA-2026-1792326281
Updated
2026-11-02
OSVCLSA-2026-1792326282 No score

TuxCare security update for @next/react-refresh-utils (1 CVE)

TuxCare rebuilt @next/react-refresh-utils to address 1 CVE. Fixed in 15.5.23-tuxcare.1.

Record
CLSA-2026-1792326282
Updated
2026-11-02
OSVCLSA-2026-1792326283 No score

TuxCare security update for @next/react-refresh-utils (1 CVE)

TuxCare rebuilt @next/react-refresh-utils to address 1 CVE. Fixed in 15.5.24-tuxcare.1.

Record
CLSA-2026-1792326283
Updated
2026-11-02
OSVCLSA-2026-1792326284 No score

TuxCare security update for @next/react-refresh-utils (1 CVE)

TuxCare rebuilt @next/react-refresh-utils to address 1 CVE. Fixed in 15.5.26-tuxcare.1.

Record
CLSA-2026-1792326284
Updated
2026-11-02
OSVCLSA-2026-1792326311 No score

TuxCare security update for @next/react-refresh-utils (1 CVE)

TuxCare rebuilt @next/react-refresh-utils to address 1 CVE. Fixed in 16.0.6-tuxcare.4.

Record
CLSA-2026-1792326311
Updated
2026-11-02
OSVCLSA-2026-1792338221 No score

TuxCare security update for @next/third-parties (1 CVE)

TuxCare rebuilt @next/third-parties to address 1 CVE. Fixed in 15.5.25-tuxcare.1.

Record
CLSA-2026-1792338221
Updated
2026-11-02
OSVCLSA-2026-1792338222 No score

TuxCare security update for @next/third-parties (1 CVE)

TuxCare rebuilt @next/third-parties to address 1 CVE. Fixed in 15.5.23-tuxcare.1.

Record
CLSA-2026-1792338222
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
react-server-dom-webpack
npm
 19.1.0 up to 19.1.2
19.1.2
react-server-dom-webpack
npm
 19.2.0 to 19.2.0
19.2.1
react-server-dom-turbopack
npm
 19.1.0 up to 19.1.2
19.1.2
react-server-dom-turbopack
npm
 19.2.0 to 19.2.0
19.2.1
react-server-dom-parcel
npm
 19.1.0 up to 19.1.2
19.1.2
react-server-dom-parcel
npm
 19.2.0 to 19.2.0
19.2.1
react-server-dom-turbopack
npm
 19.0.0 to 19.0.0
19.0.1
react-server-dom-parcel
npm
 19.0.0 to 19.0.0
19.0.1
react-server-dom-webpack
npm
 19.0.0 to 19.0.0
19.0.1
create-next-app
TuxCare:npm
 15.5.25-tuxcare.0 up to 15.5.25-tuxcare.1, plus listed versions
15.5.25
15.5.25-tuxcare.1
Show 74 moreShow less
Affected packages
PackageAffectedFixed
create-next-app
TuxCare:npm
 15.5.23-tuxcare.0 up to 15.5.23-tuxcare.1, plus listed versions
15.5.23
15.5.23-tuxcare.1
create-next-app
TuxCare:npm
 15.5.24-tuxcare.0 up to 15.5.24-tuxcare.1, plus listed versions
15.5.24
15.5.24-tuxcare.1
create-next-app
TuxCare:npm
 15.5.26-tuxcare.0 up to 15.5.26-tuxcare.1, plus listed versions
15.5.26
15.5.26-tuxcare.1
create-next-app
TuxCare:npm
 16.0.6-tuxcare.0 up to 16.0.6-tuxcare.4, plus listed versions
16.0.616.0.6-tuxcare.3
16.0.6-tuxcare.4
@next/eslint-plugin-next
TuxCare:npm
 15.5.25-tuxcare.0 up to 15.5.25-tuxcare.1, plus listed versions
15.5.25
15.5.25-tuxcare.1
@next/eslint-plugin-next
TuxCare:npm
 15.5.23-tuxcare.0 up to 15.5.23-tuxcare.1, plus listed versions
15.5.23
15.5.23-tuxcare.1
@next/eslint-plugin-next
TuxCare:npm
 15.5.24-tuxcare.0 up to 15.5.24-tuxcare.1, plus listed versions
15.5.24
15.5.24-tuxcare.1
@next/eslint-plugin-next
TuxCare:npm
 15.5.26-tuxcare.0 up to 15.5.26-tuxcare.1, plus listed versions
15.5.26
15.5.26-tuxcare.1
@next/eslint-plugin-next
TuxCare:npm
 16.0.6-tuxcare.0 up to 16.0.6-tuxcare.4, plus listed versions
16.0.616.0.6-tuxcare.3
16.0.6-tuxcare.4
@next/bundle-analyzer
TuxCare:npm
 15.5.25-tuxcare.0 up to 15.5.25-tuxcare.1, plus listed versions
15.5.25
15.5.25-tuxcare.1
@next/bundle-analyzer
TuxCare:npm
 15.5.24-tuxcare.0 up to 15.5.24-tuxcare.1, plus listed versions
15.5.24
15.5.24-tuxcare.1
@next/bundle-analyzer
TuxCare:npm
 15.5.23-tuxcare.0 up to 15.5.23-tuxcare.1, plus listed versions
15.5.23
15.5.23-tuxcare.1
@next/bundle-analyzer
TuxCare:npm
 15.5.26-tuxcare.0 up to 15.5.26-tuxcare.1, plus listed versions
15.5.26
15.5.26-tuxcare.1
@next/bundle-analyzer
TuxCare:npm
 16.0.6-tuxcare.0 up to 16.0.6-tuxcare.4, plus listed versions
16.0.616.0.6-tuxcare.3
16.0.6-tuxcare.4
next-rspack
TuxCare:npm
 15.5.25-tuxcare.0 up to 15.5.25-tuxcare.1, plus listed versions
15.5.25
15.5.25-tuxcare.1
next-rspack
TuxCare:npm
 15.5.23-tuxcare.0 up to 15.5.23-tuxcare.1, plus listed versions
15.5.23
15.5.23-tuxcare.1
next-rspack
TuxCare:npm
 15.5.24-tuxcare.0 up to 15.5.24-tuxcare.1, plus listed versions
15.5.24
15.5.24-tuxcare.1
next-rspack
TuxCare:npm
 15.5.26-tuxcare.0 up to 15.5.26-tuxcare.1, plus listed versions
15.5.26
15.5.26-tuxcare.1
next-rspack
TuxCare:npm
 16.0.6-tuxcare.0 up to 16.0.6-tuxcare.4, plus listed versions
16.0.616.0.6-tuxcare.3
16.0.6-tuxcare.4
@next/plugin-storybook
TuxCare:npm
 15.5.25-tuxcare.0 up to 15.5.25-tuxcare.1, plus listed versions
15.5.25
15.5.25-tuxcare.1
@next/plugin-storybook
TuxCare:npm
 15.5.23-tuxcare.0 up to 15.5.23-tuxcare.1, plus listed versions
15.5.23
15.5.23-tuxcare.1
@next/plugin-storybook
TuxCare:npm
 15.5.24-tuxcare.0 up to 15.5.24-tuxcare.1, plus listed versions
15.5.24
15.5.24-tuxcare.1
@next/plugin-storybook
TuxCare:npm
 15.5.26-tuxcare.0 up to 15.5.26-tuxcare.1, plus listed versions
15.5.26
15.5.26-tuxcare.1
@next/plugin-storybook
TuxCare:npm
 16.0.6-tuxcare.0 up to 16.0.6-tuxcare.4, plus listed versions
16.0.616.0.6-tuxcare.3
16.0.6-tuxcare.4
@next/polyfill-module
TuxCare:npm
 15.5.25-tuxcare.0 up to 15.5.25-tuxcare.1, plus listed versions
15.5.25
15.5.25-tuxcare.1
@next/polyfill-module
TuxCare:npm
 15.5.23-tuxcare.0 up to 15.5.23-tuxcare.1, plus listed versions
15.5.23
15.5.23-tuxcare.1
@next/polyfill-module
TuxCare:npm
 15.5.24-tuxcare.0 up to 15.5.24-tuxcare.1, plus listed versions
15.5.24
15.5.24-tuxcare.1
@next/polyfill-module
TuxCare:npm
 15.5.26-tuxcare.0 up to 15.5.26-tuxcare.1, plus listed versions
15.5.26
15.5.26-tuxcare.1
@next/polyfill-module
TuxCare:npm
 16.0.6-tuxcare.0 up to 16.0.6-tuxcare.4, plus listed versions
16.0.616.0.6-tuxcare.3
16.0.6-tuxcare.4
@next/polyfill-nomodule
TuxCare:npm
 15.5.25-tuxcare.0 up to 15.5.25-tuxcare.1, plus listed versions
15.5.25
15.5.25-tuxcare.1
@next/polyfill-nomodule
TuxCare:npm
 15.5.23-tuxcare.0 up to 15.5.23-tuxcare.1, plus listed versions
15.5.23
15.5.23-tuxcare.1
@next/polyfill-nomodule
TuxCare:npm
 15.5.24-tuxcare.0 up to 15.5.24-tuxcare.1, plus listed versions
15.5.24
15.5.24-tuxcare.1
@next/polyfill-nomodule
TuxCare:npm
 15.5.26-tuxcare.0 up to 15.5.26-tuxcare.1, plus listed versions
15.5.26
15.5.26-tuxcare.1
@next/polyfill-nomodule
TuxCare:npm
 16.0.6-tuxcare.0 up to 16.0.6-tuxcare.4, plus listed versions
16.0.616.0.6-tuxcare.3
16.0.6-tuxcare.4
@next/react-refresh-utils
TuxCare:npm
 15.5.25-tuxcare.0 up to 15.5.25-tuxcare.1, plus listed versions
15.5.25
15.5.25-tuxcare.1
@next/react-refresh-utils
TuxCare:npm
 15.5.23-tuxcare.0 up to 15.5.23-tuxcare.1, plus listed versions
15.5.23
15.5.23-tuxcare.1
@next/react-refresh-utils
TuxCare:npm
 15.5.24-tuxcare.0 up to 15.5.24-tuxcare.1, plus listed versions
15.5.24
15.5.24-tuxcare.1
@next/react-refresh-utils
TuxCare:npm
 15.5.26-tuxcare.0 up to 15.5.26-tuxcare.1, plus listed versions
15.5.26
15.5.26-tuxcare.1
@next/react-refresh-utils
TuxCare:npm
 16.0.6-tuxcare.0 up to 16.0.6-tuxcare.4, plus listed versions
16.0.616.0.6-tuxcare.3
16.0.6-tuxcare.4
@next/third-parties
TuxCare:npm
 15.5.25-tuxcare.0 up to 15.5.25-tuxcare.1, plus listed versions
15.5.25
15.5.25-tuxcare.1
@next/third-parties
TuxCare:npm
 15.5.23-tuxcare.0 up to 15.5.23-tuxcare.1, plus listed versions
15.5.23
15.5.23-tuxcare.1
@next/third-parties
TuxCare:npm
 15.5.24-tuxcare.0 up to 15.5.24-tuxcare.1, plus listed versions
15.5.24
15.5.24-tuxcare.1
@next/third-parties
TuxCare:npm
 15.5.26-tuxcare.0 up to 15.5.26-tuxcare.1, plus listed versions
15.5.26
15.5.26-tuxcare.1
@next/third-parties
TuxCare:npm
 16.0.6-tuxcare.0 up to 16.0.6-tuxcare.4, plus listed versions
16.0.616.0.6-tuxcare.3
16.0.6-tuxcare.4
@next/swc-linux-x64-gnu
TuxCare:npm
 15.5.25-tuxcare.0 up to 15.5.25-tuxcare.1, plus listed versions
15.5.25
15.5.25-tuxcare.1
@next/swc-linux-x64-gnu
TuxCare:npm
 15.5.23-tuxcare.0 up to 15.5.23-tuxcare.1, plus listed versions
15.5.23
15.5.23-tuxcare.1
@next/swc-linux-x64-gnu
TuxCare:npm
 15.5.24-tuxcare.0 up to 15.5.24-tuxcare.1, plus listed versions
15.5.24
15.5.24-tuxcare.1
@next/swc-linux-x64-gnu
TuxCare:npm
 15.5.26-tuxcare.0 up to 15.5.26-tuxcare.1, plus listed versions
15.5.26
15.5.26-tuxcare.1
@next/swc-linux-x64-gnu
TuxCare:npm
 16.0.6-tuxcare.0 up to 16.0.6-tuxcare.4, plus listed versions
16.0.616.0.6-tuxcare.3
16.0.6-tuxcare.4
@next/swc-linux-x64-gnu
TuxCare:npm
 15.1.2-tuxcare.0 up to 15.1.2-tuxcare.1, plus listed versions
15.1.2
15.1.2-tuxcare.1
@next/codemod
TuxCare:npm
 15.5.25-tuxcare.0 up to 15.5.25-tuxcare.1, plus listed versions
15.5.25
15.5.25-tuxcare.1
@next/codemod
TuxCare:npm
 15.5.23-tuxcare.0 up to 15.5.23-tuxcare.1, plus listed versions
15.5.23
15.5.23-tuxcare.1
@next/codemod
TuxCare:npm
 15.5.24-tuxcare.0 up to 15.5.24-tuxcare.1, plus listed versions
15.5.24
15.5.24-tuxcare.1
@next/codemod
TuxCare:npm
 15.5.26-tuxcare.0 up to 15.5.26-tuxcare.1, plus listed versions
15.5.26
15.5.26-tuxcare.1
@next/codemod
TuxCare:npm
 16.0.6-tuxcare.0 up to 16.0.6-tuxcare.4, plus listed versions
16.0.616.0.6-tuxcare.3
16.0.6-tuxcare.4
@next/mdx
TuxCare:npm
 15.5.25-tuxcare.0 up to 15.5.25-tuxcare.1, plus listed versions
15.5.25
15.5.25-tuxcare.1
@next/mdx
TuxCare:npm
 15.5.23-tuxcare.0 up to 15.5.23-tuxcare.1, plus listed versions
15.5.23
15.5.23-tuxcare.1
@next/mdx
TuxCare:npm
 15.5.24-tuxcare.0 up to 15.5.24-tuxcare.1, plus listed versions
15.5.24
15.5.24-tuxcare.1
@next/mdx
TuxCare:npm
 15.5.26-tuxcare.0 up to 15.5.26-tuxcare.1, plus listed versions
15.5.26
15.5.26-tuxcare.1
@next/mdx
TuxCare:npm
 16.0.6-tuxcare.0 up to 16.0.6-tuxcare.4, plus listed versions
16.0.616.0.6-tuxcare.3
16.0.6-tuxcare.4
@next/swc-linux-arm64-gnu
TuxCare:npm
 15.5.25-tuxcare.0 up to 15.5.25-tuxcare.1, plus listed versions
15.5.25
15.5.25-tuxcare.1
@next/swc-linux-arm64-gnu
TuxCare:npm
 15.5.23-tuxcare.0 up to 15.5.23-tuxcare.1, plus listed versions
15.5.23
15.5.23-tuxcare.1
@next/swc-linux-arm64-gnu
TuxCare:npm
 15.5.24-tuxcare.0 up to 15.5.24-tuxcare.1, plus listed versions
15.5.24
15.5.24-tuxcare.1
@next/swc-linux-arm64-gnu
TuxCare:npm
 15.5.26-tuxcare.0 up to 15.5.26-tuxcare.1, plus listed versions
15.5.26
15.5.26-tuxcare.1
@next/swc-linux-arm64-gnu
TuxCare:npm
 16.0.6-tuxcare.0 up to 16.0.6-tuxcare.4, plus listed versions
16.0.616.0.6-tuxcare.3
16.0.6-tuxcare.4
@next/swc-linux-arm64-gnu
TuxCare:npm
 15.1.2-tuxcare.0 up to 15.1.2-tuxcare.1, plus listed versions
15.1.2
15.1.2-tuxcare.1
react-server-dom-turbopack
TuxCare:npm
From an advisory covering 2 CVEs
 19.0.0-tuxcare.0 up to 19.0.0-tuxcare.2, plus listed versions
19.0.0
19.0.0-tuxcare.2
react-server-dom-webpack
TuxCare:npm
From an advisory covering 2 CVEs
 19.0.0-tuxcare.0 up to 19.0.0-tuxcare.3, plus listed versions
19.0.0
19.0.0-tuxcare.3
react-server-dom-webpack
npm
 19.0.0 up to 19.0.1
19.0.1
react-server-dom-webpack
npm
 19.2.0 up to 19.2.1
19.2.1
react-server-dom-turbopack
npm
 19.0.0 up to 19.0.1
19.0.1
react-server-dom-turbopack
npm
 19.2.0 up to 19.2.1
19.2.1
react-server-dom-parcel
npm
 19.0.0 up to 19.0.1
19.0.1
react-server-dom-parcel
npm
 19.2.0 up to 19.2.1
19.2.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubmayank729/CVE-2025-55182-scanner2022-06-17
PoC in GitHubpitufo1721/CVE-2025-55182-GodzillaMemoryShell2023-07-07
PoC in GitHubalyaapm/CVE-2025-55182-shellinteractive2024-11-29
PoC in GitHubMayca369/CVE-2025-551822025-06-06
PoC in GitHubBankkRoll/Quickcheck-CVE-2025-55182-React-and-CVE-2025-66478-Next.js2025-12-03
PoC in GitHubatastycookie/CVE-2025-551822025-12-03
PoC in GitHubejpir/CVE-2025-55182-research2025-12-03
MetasploitUnauthenticated RCE in React Server Components (React2Shell)2025-12-03
PoC in GitHubfatguru/CVE-2025-55182-scanner2025-12-03
PoC in GitHubsantihabib/CVE-2025-55182-analysis2025-12-03
Show 18 moreShow less
Public exploits
SourceLinkDate
PoC in GitHubsickwell/CVE-2025-551822025-12-03
PoC in GitHub0xPThree/cve-2025-551822025-12-04
PoC in GitHubChelsea486MHz/CVE-2025-55182-test2025-12-04
PoC in GitHubCillian-Collins/CVE-2025-551822025-12-04
PoC in GitHubCymulateResearch/React2Shell-Scanner2025-12-04
PoC in GitHubEmiyelbarto/CVE-2025-55182-PoC2025-12-04
PoC in GitHubEynaExp/CVE-2025-55182-POC2025-12-04
PoC in GitHubM0onPu15e/next.js-scanner2025-12-04
PoC in GitHubMedusaSH/POC-CVE-2025-551822025-12-04
PoC in GitHubMrR0b0t19/CVE-2025-55182-shellinteractive2025-12-04
PoC in GitHubPa2sw0rd/exploit-CVE-2025-55182-poc2025-12-04
PoC in GitHubRsatan/Next.js-Exploit-Tool2025-12-04
PoC in GitHubSecurity-Phoenix-demo/react2shell-scanner-rce-react-next-CVE-2025-55182-CVE-2025-664782025-12-04
PoC in GitHubThemeHackers/CVE-2025-551822025-12-04
PoC in GitHubacheong08/CVE-2025-55182-poc2025-12-04
PoC in GitHubaquinn-r7/CVE-2025-55182-VulnCheckPOC2025-12-04
Exploit-DBReact Server 19.2.0 - Remote Code Execution2026-04-09
NucleiReact Server Components - Remote Code Execution

History

History
RecordedChangedSources
exploits_morePoC in GitHub
exploits_morePoC in GitHub
affected
exploits_morePoC in GitHub
exploitation
exploits, exploits_more
affected, exploits
first indexedCVE List, EUVD, Exploit-DB, GitHub Advisories, CISA KEV, Metasploit, Nuclei, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-55182 is a critical vulnerability (CVSS 10.0) in Facebook React, published December 3, 2025. CISA lists it as known to be exploited, since December 5, 2025. EUVD reports exploitation since December 5, 2025. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 99.7%, the 99th percentile. Fixed in react-server-dom-webpack 19.1.2.

References

Show 10 moreShow less
This page doesn't list everything

The full exploit list has 437 more links. Left out on purpose, here and in the API, to keep responses small: 27 source records.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open