{"id":"CVE-2025-55182","aliases":["CLSA-2026-1789473405","CLSA-2026-1790850263","CLSA-2026-1790853485","CLSA-2026-1790864321","CLSA-2026-1790866117","CLSA-2026-1790866219","CLSA-2026-1792195716","CLSA-2026-1792195717","CLSA-2026-1792195718","CLSA-2026-1792195719","CLSA-2026-1792195755","CLSA-2026-1792196702","CLSA-2026-1792196704","CLSA-2026-1792196706","CLSA-2026-1792196707","CLSA-2026-1792196895","CLSA-2026-1792206276","CLSA-2026-1792206277","CLSA-2026-1792206278","CLSA-2026-1792206279","CLSA-2026-1792206328","CLSA-2026-1792256955","CLSA-2026-1792256956","CLSA-2026-1792256957","CLSA-2026-1792256958","CLSA-2026-1792256967","CLSA-2026-1792272210","CLSA-2026-1792272211","CLSA-2026-1792272212","CLSA-2026-1792272214","CLSA-2026-1792272250","CLSA-2026-1792292985","CLSA-2026-1792292986","CLSA-2026-1792292987","CLSA-2026-1792292988","CLSA-2026-1792293023","CLSA-2026-1792304696","CLSA-2026-1792304698","CLSA-2026-1792304699","CLSA-2026-1792304701","CLSA-2026-1792304746","CLSA-2026-1792326281","CLSA-2026-1792326282","CLSA-2026-1792326283","CLSA-2026-1792326284","CLSA-2026-1792326311","CLSA-2026-1792338221","CLSA-2026-1792338222","CLSA-2026-1792338223","CLSA-2026-1792338224","CLSA-2026-1792338241","CLSA-2026-1792346458","CLSA-2026-1792346460","CLSA-2026-1792346461","CLSA-2026-1792346462","CLSA-2026-1792346472","CLSA-2026-1792346489","CLSA-2026-1792358574","CLSA-2026-1792358575","CLSA-2026-1792358576","CLSA-2026-1792358577","CLSA-2026-1792358601","CLSA-2026-1792363964","CLSA-2026-1792363966","CLSA-2026-1792363967","CLSA-2026-1792363969","CLSA-2026-1792364009","CLSA-2026-1792367377","CLSA-2026-1792367379","CLSA-2026-1792367380","CLSA-2026-1792367381","CLSA-2026-1792367393","CLSA-2026-1792367405","CLSA-2026-1793295328","CLSA-2026-1793297326","EUVD-2025-200983","GHSA-fv66-9v8q-g76r"],"status":"published","title":"React Server Components are Vulnerable to RCE","description":"A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.","severity":{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.99731,"percentile":0.99953,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":true},"cwes":["CWE-502"],"published":"2025-12-03T15:40:56Z","modified":"2026-10-30T02:15:08Z","kev":{"date_added":"2025-12-05","due_date":"2025-12-12","required_action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","known_ransomware_use":"Known"},"exploitation":[{"source":"euvd","since":"2025-12-05"},{"source":"kev","since":"2025-12-05"}],"exploits":[{"source":"pocgithub","id":"mayank729/CVE-2025-55182-scanner","title":"mayank729/CVE-2025-55182-scanner","date":"2022-06-17","url":"https://github.com/mayank729/CVE-2025-55182-scanner"},{"source":"pocgithub","id":"pitufo1721/CVE-2025-55182-GodzillaMemoryShell","title":"pitufo1721/CVE-2025-55182-GodzillaMemoryShell","date":"2023-07-07","url":"https://github.com/pitufo1721/CVE-2025-55182-GodzillaMemoryShell"},{"source":"pocgithub","id":"alyaapm/CVE-2025-55182-shellinteractive","title":"alyaapm/CVE-2025-55182-shellinteractive","date":"2024-11-29","url":"https://github.com/alyaapm/CVE-2025-55182-shellinteractive"},{"source":"pocgithub","id":"BankkRoll/Quickcheck-CVE-2025-55182-React-and-CVE-2025-66478-Next.js","title":"BankkRoll/Quickcheck-CVE-2025-55182-React-and-CVE-2025-66478-Next.js","date":"2025-12-03","url":"https://github.com/BankkRoll/Quickcheck-CVE-2025-55182-React-and-CVE-2025-66478-Next.js"},{"source":"pocgithub","id":"atastycookie/CVE-2025-55182","title":"atastycookie/CVE-2025-55182","date":"2025-12-03","url":"https://github.com/atastycookie/CVE-2025-55182"},{"source":"pocgithub","id":"ejpir/CVE-2025-55182-research","title":"ejpir/CVE-2025-55182-research","date":"2025-12-03","url":"https://github.com/ejpir/CVE-2025-55182-research"},{"source":"metasploit","id":"exploit/multi/http/react2shell_unauth_rce_cve_2025_55182","title":"Unauthenticated RCE in React Server Components (React2Shell)","type":"exploit","platform":"Linux,Unix,Windows","date":"2025-12-03","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/multi/http/react2shell_unauth_rce_cve_2025_55182"},{"source":"pocgithub","id":"fatguru/CVE-2025-55182-scanner","title":"fatguru/CVE-2025-55182-scanner","date":"2025-12-03","url":"https://github.com/fatguru/CVE-2025-55182-scanner"},{"source":"pocgithub","id":"santihabib/CVE-2025-55182-analysis","title":"santihabib/CVE-2025-55182-analysis","date":"2025-12-03","url":"https://github.com/santihabib/CVE-2025-55182-analysis"},{"source":"pocgithub","id":"sickwell/CVE-2025-55182","title":"sickwell/CVE-2025-55182","date":"2025-12-03","url":"https://github.com/sickwell/CVE-2025-55182"},{"source":"pocgithub","id":"0xPThree/cve-2025-55182","title":"0xPThree/cve-2025-55182","date":"2025-12-04","url":"https://github.com/0xPThree/cve-2025-55182"},{"source":"pocgithub","id":"Chelsea486MHz/CVE-2025-55182-test","title":"Chelsea486MHz/CVE-2025-55182-test","date":"2025-12-04","url":"https://github.com/Chelsea486MHz/CVE-2025-55182-test"},{"source":"pocgithub","id":"Cillian-Collins/CVE-2025-55182","title":"Cillian-Collins/CVE-2025-55182","date":"2025-12-04","url":"https://github.com/Cillian-Collins/CVE-2025-55182"},{"source":"pocgithub","id":"CymulateResearch/React2Shell-Scanner","title":"CymulateResearch/React2Shell-Scanner","date":"2025-12-04","url":"https://github.com/CymulateResearch/React2Shell-Scanner"},{"source":"pocgithub","id":"Emiyelbarto/CVE-2025-55182-PoC","title":"Emiyelbarto/CVE-2025-55182-PoC","date":"2025-12-04","url":"https://github.com/Emiyelbarto/CVE-2025-55182-PoC"},{"source":"pocgithub","id":"EynaExp/CVE-2025-55182-POC","title":"EynaExp/CVE-2025-55182-POC","date":"2025-12-04","url":"https://github.com/EynaExp/CVE-2025-55182-POC"},{"source":"pocgithub","id":"M0onPu15e/next.js-scanner","title":"M0onPu15e/next.js-scanner","date":"2025-12-04","url":"https://github.com/M0onPu15e/next.js-scanner"},{"source":"pocgithub","id":"MedusaSH/POC-CVE-2025-55182","title":"MedusaSH/POC-CVE-2025-55182","date":"2025-12-04","url":"https://github.com/MedusaSH/POC-CVE-2025-55182"},{"source":"pocgithub","id":"MrR0b0t19/CVE-2025-55182-shellinteractive","title":"MrR0b0t19/CVE-2025-55182-shellinteractive","date":"2025-12-04","url":"https://github.com/MrR0b0t19/CVE-2025-55182-shellinteractive"},{"source":"pocgithub","id":"Pa2sw0rd/exploit-CVE-2025-55182-poc","title":"Pa2sw0rd/exploit-CVE-2025-55182-poc","date":"2025-12-04","url":"https://github.com/Pa2sw0rd/exploit-CVE-2025-55182-poc"},{"source":"pocgithub","id":"Rsatan/Next.js-Exploit-Tool","title":"Rsatan/Next.js-Exploit-Tool","date":"2025-12-04","url":"https://github.com/Rsatan/Next.js-Exploit-Tool"},{"source":"pocgithub","id":"Security-Phoenix-demo/react2shell-scanner-rce-react-next-CVE-2025-55182-CVE-2025-66478","title":"Security-Phoenix-demo/react2shell-scanner-rce-react-next-CVE-2025-55182-CVE-2025-66478","date":"2025-12-04","url":"https://github.com/Security-Phoenix-demo/react2shell-scanner-rce-react-next-CVE-2025-55182-CVE-2025-66478"},{"source":"pocgithub","id":"ThemeHackers/CVE-2025-55182","title":"ThemeHackers/CVE-2025-55182","date":"2025-12-04","url":"https://github.com/ThemeHackers/CVE-2025-55182"},{"source":"pocgithub","id":"acheong08/CVE-2025-55182-poc","title":"acheong08/CVE-2025-55182-poc","date":"2025-12-04","url":"https://github.com/acheong08/CVE-2025-55182-poc"},{"source":"pocgithub","id":"aquinn-r7/CVE-2025-55182-VulnCheckPOC","title":"aquinn-r7/CVE-2025-55182-VulnCheckPOC","date":"2025-12-04","url":"https://github.com/aquinn-r7/CVE-2025-55182-VulnCheckPOC"},{"source":"pocgithub","id":"assetnote/react2shell-scanner","title":"assetnote/react2shell-scanner","date":"2025-12-04","url":"https://github.com/assetnote/react2shell-scanner"},{"source":"exploitdb","id":"EDB-52506","title":"React Server 19.2.0 - Remote Code Execution","type":"webapps","platform":"multiple","date":"2026-04-09","url":"https://www.exploit-db.com/exploits/52506"},{"source":"nuclei","id":"CVE-2025-55182","title":"React Server Components - Remote Code Execution","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-55182.yaml"}],"exploits_more":436,"fixes":[{"ecosystem":"npm","package":"react-server-dom-webpack","fixed_in":["19.1.2","19.2.1","19.0.1"],"sources":["ghsa","osv"]},{"ecosystem":"npm","package":"react-server-dom-turbopack","fixed_in":["19.1.2","19.2.1","19.0.1"],"sources":["ghsa","osv"]},{"ecosystem":"npm","package":"react-server-dom-parcel","fixed_in":["19.1.2","19.2.1","19.0.1"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"create-next-app","fixed_in":["15.5.25-tuxcare.1","15.5.23-tuxcare.1","15.5.24-tuxcare.1","15.5.26-tuxcare.1","16.0.6-tuxcare.4"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@next/eslint-plugin-next","fixed_in":["15.5.25-tuxcare.1","15.5.23-tuxcare.1","15.5.24-tuxcare.1","15.5.26-tuxcare.1","16.0.6-tuxcare.4"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@next/bundle-analyzer","fixed_in":["15.5.25-tuxcare.1","15.5.24-tuxcare.1","15.5.23-tuxcare.1","15.5.26-tuxcare.1","16.0.6-tuxcare.4"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"next-rspack","fixed_in":["15.5.25-tuxcare.1","15.5.23-tuxcare.1","15.5.24-tuxcare.1","15.5.26-tuxcare.1","16.0.6-tuxcare.4"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@next/plugin-storybook","fixed_in":["15.5.25-tuxcare.1","15.5.23-tuxcare.1","15.5.24-tuxcare.1","15.5.26-tuxcare.1","16.0.6-tuxcare.4"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@next/polyfill-module","fixed_in":["15.5.25-tuxcare.1","15.5.23-tuxcare.1","15.5.24-tuxcare.1","15.5.26-tuxcare.1","16.0.6-tuxcare.4"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@next/polyfill-nomodule","fixed_in":["15.5.25-tuxcare.1","15.5.23-tuxcare.1","15.5.24-tuxcare.1","15.5.26-tuxcare.1","16.0.6-tuxcare.4"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@next/react-refresh-utils","fixed_in":["15.5.25-tuxcare.1","15.5.23-tuxcare.1","15.5.24-tuxcare.1","15.5.26-tuxcare.1","16.0.6-tuxcare.4"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@next/third-parties","fixed_in":["15.5.25-tuxcare.1","15.5.23-tuxcare.1","15.5.24-tuxcare.1","15.5.26-tuxcare.1","16.0.6-tuxcare.4"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@next/swc-linux-x64-gnu","fixed_in":["15.5.25-tuxcare.1","15.5.23-tuxcare.1","15.5.24-tuxcare.1","15.5.26-tuxcare.1","16.0.6-tuxcare.4","15.1.2-tuxcare.1"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@next/codemod","fixed_in":["15.5.25-tuxcare.1","15.5.23-tuxcare.1","15.5.24-tuxcare.1","15.5.26-tuxcare.1","16.0.6-tuxcare.4"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@next/mdx","fixed_in":["15.5.25-tuxcare.1","15.5.23-tuxcare.1","15.5.24-tuxcare.1","15.5.26-tuxcare.1","16.0.6-tuxcare.4"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@next/swc-linux-arm64-gnu","fixed_in":["15.5.25-tuxcare.1","15.5.23-tuxcare.1","15.5.24-tuxcare.1","15.5.26-tuxcare.1","16.0.6-tuxcare.4","15.1.2-tuxcare.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"react-server-dom-webpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"19.1.0"},{"fixed":"19.1.2"}]}]},{"source":"ghsa","ecosystem":"npm","package":"react-server-dom-webpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"19.2.0"},{"last_affected":"19.2.0"},{"fixed":"19.2.1"}]}],"versions":["19.2.0"]},{"source":"ghsa","ecosystem":"npm","package":"react-server-dom-turbopack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"19.1.0"},{"fixed":"19.1.2"}]}]},{"source":"ghsa","ecosystem":"npm","package":"react-server-dom-turbopack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"19.2.0"},{"last_affected":"19.2.0"},{"fixed":"19.2.1"}]}],"versions":["19.2.0"]},{"source":"ghsa","ecosystem":"npm","package":"react-server-dom-parcel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"19.1.0"},{"fixed":"19.1.2"}]}]},{"source":"ghsa","ecosystem":"npm","package":"react-server-dom-parcel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"19.2.0"},{"last_affected":"19.2.0"},{"fixed":"19.2.1"}]}],"versions":["19.2.0"]},{"source":"ghsa","ecosystem":"npm","package":"react-server-dom-turbopack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"19.0.0"},{"last_affected":"19.0.0"},{"fixed":"19.0.1"}]}],"versions":["19.0.0"]},{"source":"ghsa","ecosystem":"npm","package":"react-server-dom-parcel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"19.0.0"},{"last_affected":"19.0.0"},{"fixed":"19.0.1"}]}],"versions":["19.0.0"]},{"source":"ghsa","ecosystem":"npm","package":"react-server-dom-webpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"19.0.0"},{"last_affected":"19.0.0"},{"fixed":"19.0.1"}]}],"versions":["19.0.0"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"create-next-app","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.5.25-tuxcare.0"},{"fixed":"15.5.25-tuxcare.1"}]}],"versions":["15.5.25"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"create-next-app","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.5.23-tuxcare.0"},{"fixed":"15.5.23-tuxcare.1"}]}],"versions":["15.5.23"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"create-next-app","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.5.24-tuxcare.0"},{"fixed":"15.5.24-tuxcare.1"}]}],"versions":["15.5.24"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"create-next-app","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.5.26-tuxcare.0"},{"fixed":"15.5.26-tuxcare.1"}]}],"versions":["15.5.26"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"create-next-app","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.6-tuxcare.0"},{"fixed":"16.0.6-tuxcare.4"}]}],"versions":["16.0.6","16.0.6-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/eslint-plugin-next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.5.25-tuxcare.0"},{"fixed":"15.5.25-tuxcare.1"}]}],"versions":["15.5.25"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/eslint-plugin-next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.5.23-tuxcare.0"},{"fixed":"15.5.23-tuxcare.1"}]}],"versions":["15.5.23"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/eslint-plugin-next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.5.24-tuxcare.0"},{"fixed":"15.5.24-tuxcare.1"}]}],"versions":["15.5.24"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/eslint-plugin-next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.5.26-tuxcare.0"},{"fixed":"15.5.26-tuxcare.1"}]}],"versions":["15.5.26"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/eslint-plugin-next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.6-tuxcare.0"},{"fixed":"16.0.6-tuxcare.4"}]}],"versions":["16.0.6","16.0.6-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/bundle-analyzer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.5.25-tuxcare.0"},{"fixed":"15.5.25-tuxcare.1"}]}],"versions":["15.5.25"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/bundle-analyzer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.5.24-tuxcare.0"},{"fixed":"15.5.24-tuxcare.1"}]}],"versions":["15.5.24"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/bundle-analyzer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.5.23-tuxcare.0"},{"fixed":"15.5.23-tuxcare.1"}]}],"versions":["15.5.23"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/bundle-analyzer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.5.26-tuxcare.0"},{"fixed":"15.5.26-tuxcare.1"}]}],"versions":["15.5.26"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/bundle-analyzer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.6-tuxcare.0"},{"fixed":"16.0.6-tuxcare.4"}]}],"versions":["16.0.6","16.0.6-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"next-rspack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.5.25-tuxcare.0"},{"fixed":"15.5.25-tuxcare.1"}]}],"versions":["15.5.25"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"next-rspack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.5.23-tuxcare.0"},{"fixed":"15.5.23-tuxcare.1"}]}],"versions":["15.5.23"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"next-rspack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.5.24-tuxcare.0"},{"fixed":"15.5.24-tuxcare.1"}]}],"versions":["15.5.24"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"next-rspack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.5.26-tuxcare.0"},{"fixed":"15.5.26-tuxcare.1"}]}],"versions":["15.5.26"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"next-rspack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.6-tuxcare.0"},{"fixed":"16.0.6-tuxcare.4"}]}],"versions":["16.0.6","16.0.6-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/plugin-storybook","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.5.25-tuxcare.0"},{"fixed":"15.5.25-tuxcare.1"}]}],"versions":["15.5.25"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/plugin-storybook","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.5.23-tuxcare.0"},{"fixed":"15.5.23-tuxcare.1"}]}],"versions":["15.5.23"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/plugin-storybook","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.5.24-tuxcare.0"},{"fixed":"15.5.24-tuxcare.1"}]}],"versions":["15.5.24"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/plugin-storybook","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.5.26-tuxcare.0"},{"fixed":"15.5.26-tuxcare.1"}]}],"versions":["15.5.26"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/plugin-storybook","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.6-tuxcare.0"},{"fixed":"16.0.6-tuxcare.4"}]}],"versions":["16.0.6","16.0.6-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/polyfill-module","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.5.25-tuxcare.0"},{"fixed":"15.5.25-tuxcare.1"}]}],"versions":["15.5.25"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/polyfill-module","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.5.23-tuxcare.0"},{"fixed":"15.5.23-tuxcare.1"}]}],"versions":["15.5.23"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/polyfill-module","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.5.24-tuxcare.0"},{"fixed":"15.5.24-tuxcare.1"}]}],"versions":["15.5.24"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/polyfill-module","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.5.26-tuxcare.0"},{"fixed":"15.5.26-tuxcare.1"}]}],"versions":["15.5.26"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/polyfill-module","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.6-tuxcare.0"},{"fixed":"16.0.6-tuxcare.4"}]}],"versions":["16.0.6","16.0.6-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/polyfill-nomodule","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.5.25-tuxcare.0"},{"fixed":"15.5.25-tuxcare.1"}]}],"versions":["15.5.25"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/polyfill-nomodule","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.5.23-tuxcare.0"},{"fixed":"15.5.23-tuxcare.1"}]}],"versions":["15.5.23"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/polyfill-nomodule","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.5.24-tuxcare.0"},{"fixed":"15.5.24-tuxcare.1"}]}],"versions":["15.5.24"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/polyfill-nomodule","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.5.26-tuxcare.0"},{"fixed":"15.5.26-tuxcare.1"}]}],"versions":["15.5.26"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/polyfill-nomodule","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.6-tuxcare.0"},{"fixed":"16.0.6-tuxcare.4"}]}],"versions":["16.0.6","16.0.6-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/react-refresh-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.5.25-tuxcare.0"},{"fixed":"15.5.25-tuxcare.1"}]}],"versions":["15.5.25"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/react-refresh-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.5.23-tuxcare.0"},{"fixed":"15.5.23-tuxcare.1"}]}],"versions":["15.5.23"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/react-refresh-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.5.24-tuxcare.0"},{"fixed":"15.5.24-tuxcare.1"}]}],"versions":["15.5.24"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/react-refresh-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.5.26-tuxcare.0"},{"fixed":"15.5.26-tuxcare.1"}]}],"versions":["15.5.26"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/react-refresh-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.6-tuxcare.0"},{"fixed":"16.0.6-tuxcare.4"}]}],"versions":["16.0.6","16.0.6-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/third-parties","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.5.25-tuxcare.0"},{"fixed":"15.5.25-tuxcare.1"}]}],"versions":["15.5.25"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/third-parties","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.5.23-tuxcare.0"},{"fixed":"15.5.23-tuxcare.1"}]}],"versions":["15.5.23"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/third-parties","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.5.24-tuxcare.0"},{"fixed":"15.5.24-tuxcare.1"}]}],"versions":["15.5.24"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/third-parties","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.5.26-tuxcare.0"},{"fixed":"15.5.26-tuxcare.1"}]}],"versions":["15.5.26"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/third-parties","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.6-tuxcare.0"},{"fixed":"16.0.6-tuxcare.4"}]}],"versions":["16.0.6","16.0.6-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/swc-linux-x64-gnu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.5.25-tuxcare.0"},{"fixed":"15.5.25-tuxcare.1"}]}],"versions":["15.5.25"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/swc-linux-x64-gnu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.5.23-tuxcare.0"},{"fixed":"15.5.23-tuxcare.1"}]}],"versions":["15.5.23"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/swc-linux-x64-gnu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.5.24-tuxcare.0"},{"fixed":"15.5.24-tuxcare.1"}]}],"versions":["15.5.24"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/swc-linux-x64-gnu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.5.26-tuxcare.0"},{"fixed":"15.5.26-tuxcare.1"}]}],"versions":["15.5.26"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/swc-linux-x64-gnu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.6-tuxcare.0"},{"fixed":"16.0.6-tuxcare.4"}]}],"versions":["16.0.6","16.0.6-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/swc-linux-x64-gnu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.1.2-tuxcare.0"},{"fixed":"15.1.2-tuxcare.1"}]}],"versions":["15.1.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/codemod","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.5.25-tuxcare.0"},{"fixed":"15.5.25-tuxcare.1"}]}],"versions":["15.5.25"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/codemod","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.5.23-tuxcare.0"},{"fixed":"15.5.23-tuxcare.1"}]}],"versions":["15.5.23"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/codemod","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.5.24-tuxcare.0"},{"fixed":"15.5.24-tuxcare.1"}]}],"versions":["15.5.24"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/codemod","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.5.26-tuxcare.0"},{"fixed":"15.5.26-tuxcare.1"}]}],"versions":["15.5.26"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/codemod","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.6-tuxcare.0"},{"fixed":"16.0.6-tuxcare.4"}]}],"versions":["16.0.6","16.0.6-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/mdx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.5.25-tuxcare.0"},{"fixed":"15.5.25-tuxcare.1"}]}],"versions":["15.5.25"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/mdx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.5.23-tuxcare.0"},{"fixed":"15.5.23-tuxcare.1"}]}],"versions":["15.5.23"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/mdx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.5.24-tuxcare.0"},{"fixed":"15.5.24-tuxcare.1"}]}],"versions":["15.5.24"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/mdx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.5.26-tuxcare.0"},{"fixed":"15.5.26-tuxcare.1"}]}],"versions":["15.5.26"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/mdx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.6-tuxcare.0"},{"fixed":"16.0.6-tuxcare.4"}]}],"versions":["16.0.6","16.0.6-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/swc-linux-arm64-gnu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.5.25-tuxcare.0"},{"fixed":"15.5.25-tuxcare.1"}]}],"versions":["15.5.25"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/swc-linux-arm64-gnu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.5.23-tuxcare.0"},{"fixed":"15.5.23-tuxcare.1"}]}],"versions":["15.5.23"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/swc-linux-arm64-gnu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.5.24-tuxcare.0"},{"fixed":"15.5.24-tuxcare.1"}]}],"versions":["15.5.24"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/swc-linux-arm64-gnu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.5.26-tuxcare.0"},{"fixed":"15.5.26-tuxcare.1"}]}],"versions":["15.5.26"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/swc-linux-arm64-gnu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.6-tuxcare.0"},{"fixed":"16.0.6-tuxcare.4"}]}],"versions":["16.0.6","16.0.6-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/swc-linux-arm64-gnu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.1.2-tuxcare.0"},{"fixed":"15.1.2-tuxcare.1"}]}],"versions":["15.1.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"react-server-dom-turbopack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"19.0.0-tuxcare.0"},{"fixed":"19.0.0-tuxcare.2"}]}],"versions":["19.0.0"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"react-server-dom-webpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"19.0.0-tuxcare.0"},{"fixed":"19.0.0-tuxcare.3"}]}],"versions":["19.0.0"],"bundled":2},{"source":"osv","ecosystem":"npm","package":"react-server-dom-webpack","ranges":[{"type":"SEMVER","events":[{"introduced":"19.0.0"},{"fixed":"19.0.1"}]}],"versions":["19.0.0"]},{"source":"osv","ecosystem":"npm","package":"react-server-dom-webpack","ranges":[{"type":"SEMVER","events":[{"introduced":"19.1.0"},{"fixed":"19.1.2"}]}]},{"source":"osv","ecosystem":"npm","package":"react-server-dom-webpack","ranges":[{"type":"SEMVER","events":[{"introduced":"19.2.0"},{"fixed":"19.2.1"}]}],"versions":["19.2.0"]},{"source":"osv","ecosystem":"npm","package":"react-server-dom-turbopack","ranges":[{"type":"SEMVER","events":[{"introduced":"19.0.0"},{"fixed":"19.0.1"}]}],"versions":["19.0.0"]},{"source":"osv","ecosystem":"npm","package":"react-server-dom-turbopack","ranges":[{"type":"SEMVER","events":[{"introduced":"19.1.0"},{"fixed":"19.1.2"}]}]},{"source":"osv","ecosystem":"npm","package":"react-server-dom-turbopack","ranges":[{"type":"SEMVER","events":[{"introduced":"19.2.0"},{"fixed":"19.2.1"}]}],"versions":["19.2.0"]},{"source":"osv","ecosystem":"npm","package":"react-server-dom-parcel","ranges":[{"type":"SEMVER","events":[{"introduced":"19.0.0"},{"fixed":"19.0.1"}]}],"versions":["19.0.0"]},{"source":"osv","ecosystem":"npm","package":"react-server-dom-parcel","ranges":[{"type":"SEMVER","events":[{"introduced":"19.1.0"},{"fixed":"19.1.2"}]}]},{"source":"osv","ecosystem":"npm","package":"react-server-dom-parcel","ranges":[{"type":"SEMVER","events":[{"introduced":"19.2.0"},{"fixed":"19.2.1"}]}],"versions":["19.2.0"]}],"products":[{"vendor":"facebook","product":"react"},{"vendor":"meta","product":"react server components"},{"vendor":"meta","product":"react-server-dom-parcel"},{"vendor":"meta","product":"react-server-dom-turbopack"},{"vendor":"meta","product":"react-server-dom-webpack"},{"vendor":"vercel","product":"next.js"}],"references":[{"url":"https://www.facebook.com/security/advisories/cve-2025-55182","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory","web"]},{"url":"https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components","tags":["x_refsource_CONFIRM","Patch","Vendor Advisory","fix","web"]},{"url":"https://aws.amazon.com/blogs/security/china-nexus-cyber-threat-groups-rapidly-exploit-react2shell-vulnerability-cve-2025-55182/","tags":["media-coverage","Third Party Advisory","advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-55182","tags":["government-resource","US Government Resource","web"]},{"url":"http://www.openwall.com/lists/oss-security/2025/12/03/4","tags":["Mailing List","Patch","Third Party Advisory","fix","web"]},{"url":"https://news.ycombinator.com/item?id=46136026","tags":["Issue Tracking","report","web"]},{"url":"https://github.com/facebook/react/security/advisories/GHSA-fv66-9v8q-g76r","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-55182","tags":["advisory"]},{"url":"https://github.com/facebook/react/pull/35277","tags":["web"]},{"url":"https://github.com/facebook/react/commit/7dc903cd29dac55efb4424853fd0442fef3a8700","tags":["web"]},{"url":"https://github.com/facebook/react/releases/tag/v19.0.1","tags":["web"]},{"url":"https://github.com/facebook/react/releases/tag/v19.1.2","tags":["web"]},{"url":"https://github.com/facebook/react/releases/tag/v19.2.1","tags":["web"]},{"url":"https://github.com/ejpir/CVE-2025-55182-poc","tags":["web"]},{"url":"https://github.com/advisories/GHSA-fv66-9v8q-g76r"},{"url":"https://github.com/facebook/react","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2025-55182","description":"A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.","status":"published","published":"2025-12-03T15:40:56.894Z","modified":"2026-10-07T17:58:00.859Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:32:52.839698Z"}],"euvd":[{"id":"EUVD-2025-200983","description":"A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.","status":"published","published":"2025-12-03T15:40:56Z","modified":"2026-10-07T17:58:00Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"exploited_since":"2025-12-05","updated_at":"2026-11-02T17:27:34.353796Z"}],"ghsa":[{"id":"GHSA-fv66-9v8q-g76r","title":"React Server Components are Vulnerable to RCE","description":"### Impact\n\nThere is an unauthenticated remote code execution vulnerability in React Server Components.\n\nWe recommend upgrading immediately.\n\nThe vulnerability is present in versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 of:\n* [react-server-dom-webpack](https://www.npmjs.com/package/react-server-dom-webpack)\n* [react-server-dom-parcel](https://www.npmjs.com/package/react-server-dom-parcel)\n* [react-server-dom-turbopack](https://www.npmjs.com/package/react-server-dom-turbopack?activeTab=readme)\n\n### Patches\n\nA fix was introduced in versions [19.0.1](https://github.com/facebook/react/releases/tag/v19.0.1), [19.1.2](https://github.com/facebook/react/releases/tag/v19.1.2), and [19.2.1](https://github.com/facebook/react/releases/tag/v19.2.1). If you are using any of the above packages please upgrade to any of the fixed versions immediately.\n\nIf your app’s React code does not use a server, your app is not affected by this vulnerability. If your app does not use a framework, bundler, or bundler plugin that supports React Server Components, your app is not affected by this vulnerability.\n\n### References\n\nSee the [blog post](https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components) for more information and upgrade instructions.","status":"published","published":"2025-12-03T19:07:39Z","modified":"2025-12-09T16:53:25Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:39:12.222121Z"}],"kev":[{"id":"CVE-2025-55182","title":"Meta React Server Components Remote Code Execution Vulnerability","description":"Meta React Server Components contains a remote code execution vulnerability that could allow unauthenticated remote code execution by exploiting a flaw in how React decodes payloads sent to React Server Function endpoints. Please note CVE-2025-66478 has been rejected, but it is associated with CVE-2025- 55182.","kev":{"date_added":"2025-12-05","due_date":"2025-12-12","required_action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","known_ransomware_use":"Known"},"updated_at":"2026-11-02T17:00:15.999436Z"}],"nvd":[{"id":"CVE-2025-55182","description":"A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.","status":"published","published":"2025-12-03T16:15:56.463Z","modified":"2026-10-18T17:10:00.11Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:11:47.746175Z"}],"osv":[{"id":"CVE-2025-55182","description":"A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.","status":"published","published":"2025-12-03T16:15:56.463Z","modified":"2026-10-24T10:30:28.975549294Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:50.863921Z"},{"id":"GHSA-fv66-9v8q-g76r","title":"React Server Components are Vulnerable to RCE","description":"### Impact\n\nThere is an unauthenticated remote code execution vulnerability in React Server Components.\n\nWe recommend upgrading immediately.\n\nThe vulnerability is present in versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 of:\n* [react-server-dom-webpack](https://www.npmjs.com/package/react-server-dom-webpack)\n* [react-server-dom-parcel](https://www.npmjs.com/package/react-server-dom-parcel)\n* [react-server-dom-turbopack](https://www.npmjs.com/package/react-server-dom-turbopack?activeTab=readme)\n\n### Patches\n\nA fix was introduced in versions [19.0.1](https://github.com/facebook/react/releases/tag/v19.0.1), [19.1.2](https://github.com/facebook/react/releases/tag/v19.1.2), and [19.2.1](https://github.com/facebook/react/releases/tag/v19.2.1). If you are using any of the above packages please upgrade to any of the fixed versions immediately.\n\nIf your app’s React code does not use a server, your app is not affected by this vulnerability. If your app does not use a framework, bundler, or bundler plugin that supports React Server Components, your app is not affected by this vulnerability.\n\n### References\n\nSee the [blog post](https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components) for more information and upgrade instructions.","status":"published","published":"2025-12-03T19:07:39Z","modified":"2025-12-09T17:46:07.154758Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T15:46:46.760785Z"},{"id":"CLSA-2026-1789473405","title":"TuxCare security update for 22 packages (1 CVE)","description":"TuxCare rebuilt 22 packages to address 1 CVE. Fixed in 16.0.6-tuxcare.4.","status":"withdrawn","published":"2026-09-15T11:56:45Z","modified":"2026-10-26T13:21:31Z","updated_at":"2026-11-02T15:43:47.938828Z"},{"id":"CLSA-2026-1790850263","title":"TuxCare security update for 9 packages (1 CVE)","description":"TuxCare rebuilt 9 packages to address 1 CVE. Fixed in 15.1.2-tuxcare.1.","status":"withdrawn","published":"2026-10-01T10:24:23Z","modified":"2026-10-26T13:21:31Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1790853485","title":"TuxCare security update for 21 packages (1 CVE)","description":"TuxCare rebuilt 21 packages to address 1 CVE. Fixed in 15.5.25-tuxcare.1.","status":"withdrawn","published":"2026-10-01T11:18:05Z","modified":"2026-10-26T13:21:31Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1790864321","title":"TuxCare security update for 21 packages (1 CVE)","description":"TuxCare rebuilt 21 packages to address 1 CVE. Fixed in 15.5.23-tuxcare.1.","status":"withdrawn","published":"2026-10-01T14:18:41Z","modified":"2026-10-26T13:21:31Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1790866117","title":"TuxCare security update for 21 packages (1 CVE)","description":"TuxCare rebuilt 21 packages to address 1 CVE. Fixed in 15.5.24-tuxcare.1.","status":"withdrawn","published":"2026-10-01T14:48:37Z","modified":"2026-10-26T13:21:31Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1790866219","title":"TuxCare security update for 21 packages (1 CVE)","description":"TuxCare rebuilt 21 packages to address 1 CVE. Fixed in 15.5.26-tuxcare.1.","status":"withdrawn","published":"2026-10-01T14:50:19Z","modified":"2026-10-26T13:21:31Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1792195716","title":"TuxCare security update for create-next-app (1 CVE)","description":"TuxCare rebuilt create-next-app to address 1 CVE. Fixed in 15.5.25-tuxcare.1.","status":"published","published":"2026-10-17T00:08:35Z","modified":"2026-10-17T01:30:11.406823119Z","updated_at":"2026-11-02T15:43:51.747192Z"},{"id":"CLSA-2026-1792195717","title":"TuxCare security update for create-next-app (1 CVE)","description":"TuxCare rebuilt create-next-app to address 1 CVE. Fixed in 15.5.23-tuxcare.1.","status":"published","published":"2026-10-17T00:08:36Z","modified":"2026-10-17T01:30:10.199644354Z","updated_at":"2026-11-02T15:43:51.747192Z"},{"id":"CLSA-2026-1792195718","title":"TuxCare security update for create-next-app (1 CVE)","description":"TuxCare rebuilt create-next-app to address 1 CVE. Fixed in 15.5.24-tuxcare.1.","status":"published","published":"2026-10-17T00:08:36Z","modified":"2026-10-17T01:30:10.596334989Z","updated_at":"2026-11-02T15:43:51.747192Z"},{"id":"CLSA-2026-1792195719","title":"TuxCare security update for create-next-app (1 CVE)","description":"TuxCare rebuilt create-next-app to address 1 CVE. Fixed in 15.5.26-tuxcare.1.","status":"published","published":"2026-10-17T00:08:37Z","modified":"2026-10-17T01:30:10.193422794Z","updated_at":"2026-11-02T15:43:51.747192Z"},{"id":"CLSA-2026-1792195755","title":"TuxCare security update for create-next-app (1 CVE)","description":"TuxCare rebuilt create-next-app to address 1 CVE. Fixed in 16.0.6-tuxcare.4.","status":"published","published":"2026-10-17T00:09:14Z","modified":"2026-10-17T01:30:10.607259008Z","updated_at":"2026-11-02T15:43:51.747192Z"},{"id":"CLSA-2026-1792196702","title":"TuxCare security update for @next/eslint-plugin-next (1 CVE)","description":"TuxCare rebuilt @next/eslint-plugin-next to address 1 CVE. Fixed in 15.5.25-tuxcare.1.","status":"published","published":"2026-10-17T00:25:02Z","modified":"2026-10-17T01:30:11.29606271Z","updated_at":"2026-11-02T15:43:51.747192Z"},{"id":"CLSA-2026-1792196704","title":"TuxCare security update for @next/eslint-plugin-next (1 CVE)","description":"TuxCare rebuilt @next/eslint-plugin-next to address 1 CVE. Fixed in 15.5.23-tuxcare.1.","status":"published","published":"2026-10-17T00:25:04Z","modified":"2026-10-17T01:30:09.594525678Z","updated_at":"2026-11-02T15:43:51.747192Z"},{"id":"CLSA-2026-1792196706","title":"TuxCare security update for @next/eslint-plugin-next (1 CVE)","description":"TuxCare rebuilt @next/eslint-plugin-next to address 1 CVE. Fixed in 15.5.24-tuxcare.1.","status":"published","published":"2026-10-17T00:25:06Z","modified":"2026-10-17T01:30:07.61537893Z","updated_at":"2026-11-02T15:43:51.747192Z"},{"id":"CLSA-2026-1792196707","title":"TuxCare security update for @next/eslint-plugin-next (1 CVE)","description":"TuxCare rebuilt @next/eslint-plugin-next to address 1 CVE. Fixed in 15.5.26-tuxcare.1.","status":"published","published":"2026-10-17T00:25:07Z","modified":"2026-10-17T01:30:08.646702394Z","updated_at":"2026-11-02T15:43:51.747192Z"},{"id":"CLSA-2026-1792196895","title":"TuxCare security update for @next/eslint-plugin-next (1 CVE)","description":"TuxCare rebuilt @next/eslint-plugin-next to address 1 CVE. Fixed in 16.0.6-tuxcare.4.","status":"published","published":"2026-10-17T00:28:15Z","modified":"2026-10-17T01:30:12.312384343Z","updated_at":"2026-11-02T15:43:51.747192Z"},{"id":"CLSA-2026-1792206276","title":"TuxCare security update for @next/bundle-analyzer (1 CVE)","description":"TuxCare rebuilt @next/bundle-analyzer to address 1 CVE. Fixed in 15.5.25-tuxcare.1.","status":"published","published":"2026-10-17T03:04:35Z","modified":"2026-10-17T07:00:34.470610843Z","updated_at":"2026-11-02T15:43:51.747192Z"},{"id":"CLSA-2026-1792206277","title":"TuxCare security update for @next/bundle-analyzer (1 CVE)","description":"TuxCare rebuilt @next/bundle-analyzer to address 1 CVE. Fixed in 15.5.24-tuxcare.1.","status":"published","published":"2026-10-17T03:04:37Z","modified":"2026-10-17T07:00:34.468789751Z","updated_at":"2026-11-02T15:43:51.747192Z"},{"id":"CLSA-2026-1792206278","title":"TuxCare security update for @next/bundle-analyzer (1 CVE)","description":"TuxCare rebuilt @next/bundle-analyzer to address 1 CVE. Fixed in 15.5.23-tuxcare.1.","status":"published","published":"2026-10-17T03:04:37Z","modified":"2026-10-17T07:00:34.715219247Z","updated_at":"2026-11-02T15:43:51.747192Z"},{"id":"CLSA-2026-1792206279","title":"TuxCare security update for @next/bundle-analyzer (1 CVE)","description":"TuxCare rebuilt @next/bundle-analyzer to address 1 CVE. Fixed in 15.5.26-tuxcare.1.","status":"published","published":"2026-10-17T03:04:38Z","modified":"2026-10-17T07:00:34.427959388Z","updated_at":"2026-11-02T15:43:51.747192Z"},{"id":"CLSA-2026-1792206328","title":"TuxCare security update for @next/bundle-analyzer (1 CVE)","description":"TuxCare rebuilt @next/bundle-analyzer to address 1 CVE. Fixed in 16.0.6-tuxcare.4.","status":"published","published":"2026-10-17T03:05:27Z","modified":"2026-10-17T07:00:40.078375991Z","updated_at":"2026-11-02T15:43:51.747192Z"},{"id":"CLSA-2026-1792256955","title":"TuxCare security update for next-rspack (1 CVE)","description":"TuxCare rebuilt next-rspack to address 1 CVE. Fixed in 15.5.25-tuxcare.1.","status":"published","published":"2026-10-17T17:09:15Z","modified":"2026-10-17T19:00:44.332123461Z","updated_at":"2026-11-02T15:43:52.288832Z"},{"id":"CLSA-2026-1792256956","title":"TuxCare security update for next-rspack (1 CVE)","description":"TuxCare rebuilt next-rspack to address 1 CVE. Fixed in 15.5.23-tuxcare.1.","status":"published","published":"2026-10-17T17:09:16Z","modified":"2026-10-17T19:00:57.358484275Z","updated_at":"2026-11-02T15:43:52.288832Z"},{"id":"CLSA-2026-1792256957","title":"TuxCare security update for next-rspack (1 CVE)","description":"TuxCare rebuilt next-rspack to address 1 CVE. Fixed in 15.5.24-tuxcare.1.","status":"published","published":"2026-10-17T17:09:16Z","modified":"2026-10-17T19:01:44.970395479Z","updated_at":"2026-11-02T15:43:52.288832Z"},{"id":"CLSA-2026-1792256958","title":"TuxCare security update for next-rspack (1 CVE)","description":"TuxCare rebuilt next-rspack to address 1 CVE. Fixed in 15.5.26-tuxcare.1.","status":"published","published":"2026-10-17T17:09:17Z","modified":"2026-10-17T19:01:25.834205862Z","updated_at":"2026-11-02T15:43:52.288832Z"},{"id":"CLSA-2026-1792256967","title":"TuxCare security update for next-rspack (1 CVE)","description":"TuxCare rebuilt next-rspack to address 1 CVE. Fixed in 16.0.6-tuxcare.4.","status":"published","published":"2026-10-17T17:09:23Z","modified":"2026-10-17T19:01:45.485807396Z","updated_at":"2026-11-02T15:43:52.288832Z"},{"id":"CLSA-2026-1792272210","title":"TuxCare security update for @next/plugin-storybook (1 CVE)","description":"TuxCare rebuilt @next/plugin-storybook to address 1 CVE. Fixed in 15.5.25-tuxcare.1.","status":"published","published":"2026-10-17T21:23:30Z","modified":"2026-10-18T01:30:33.585563727Z","updated_at":"2026-11-02T15:43:52.288832Z"},{"id":"CLSA-2026-1792272211","title":"TuxCare security update for @next/plugin-storybook (1 CVE)","description":"TuxCare rebuilt @next/plugin-storybook to address 1 CVE. Fixed in 15.5.23-tuxcare.1.","status":"published","published":"2026-10-17T21:23:31Z","modified":"2026-10-18T01:30:33.885413371Z","updated_at":"2026-11-02T15:43:52.288832Z"},{"id":"CLSA-2026-1792272212","title":"TuxCare security update for @next/plugin-storybook (1 CVE)","description":"TuxCare rebuilt @next/plugin-storybook to address 1 CVE. Fixed in 15.5.24-tuxcare.1.","status":"published","published":"2026-10-17T21:23:32Z","modified":"2026-10-18T01:30:36.590809882Z","updated_at":"2026-11-02T15:43:52.288832Z"},{"id":"CLSA-2026-1792272214","title":"TuxCare security update for @next/plugin-storybook (1 CVE)","description":"TuxCare rebuilt @next/plugin-storybook to address 1 CVE. Fixed in 15.5.26-tuxcare.1.","status":"published","published":"2026-10-17T21:23:34Z","modified":"2026-10-18T01:30:34.195070482Z","updated_at":"2026-11-02T15:43:52.288832Z"},{"id":"CLSA-2026-1792272250","title":"TuxCare security update for @next/plugin-storybook (1 CVE)","description":"TuxCare rebuilt @next/plugin-storybook to address 1 CVE. Fixed in 16.0.6-tuxcare.4.","status":"published","published":"2026-10-17T21:24:06Z","modified":"2026-10-18T01:30:41.356968408Z","updated_at":"2026-11-02T15:43:52.288832Z"},{"id":"CLSA-2026-1792292985","title":"TuxCare security update for @next/polyfill-module (1 CVE)","description":"TuxCare rebuilt @next/polyfill-module to address 1 CVE. Fixed in 15.5.25-tuxcare.1.","status":"published","published":"2026-10-18T03:09:45Z","modified":"2026-10-18T07:15:13.512960003Z","updated_at":"2026-11-02T15:43:52.288832Z"},{"id":"CLSA-2026-1792292986","title":"TuxCare security update for @next/polyfill-module (1 CVE)","description":"TuxCare rebuilt @next/polyfill-module to address 1 CVE. Fixed in 15.5.23-tuxcare.1.","status":"published","published":"2026-10-18T03:09:46Z","modified":"2026-10-18T07:15:12.495813475Z","updated_at":"2026-11-02T15:43:52.288832Z"},{"id":"CLSA-2026-1792292987","title":"TuxCare security update for @next/polyfill-module (1 CVE)","description":"TuxCare rebuilt @next/polyfill-module to address 1 CVE. Fixed in 15.5.24-tuxcare.1.","status":"published","published":"2026-10-18T03:09:47Z","modified":"2026-10-18T07:15:10.807226098Z","updated_at":"2026-11-02T15:43:52.288832Z"},{"id":"CLSA-2026-1792292988","title":"TuxCare security update for @next/polyfill-module (1 CVE)","description":"TuxCare rebuilt @next/polyfill-module to address 1 CVE. Fixed in 15.5.26-tuxcare.1.","status":"published","published":"2026-10-18T03:09:48Z","modified":"2026-10-18T07:15:12.60748263Z","updated_at":"2026-11-02T15:43:52.288832Z"},{"id":"CLSA-2026-1792293023","title":"TuxCare security update for @next/polyfill-module (1 CVE)","description":"TuxCare rebuilt @next/polyfill-module to address 1 CVE. Fixed in 16.0.6-tuxcare.4.","status":"published","published":"2026-10-18T03:10:22Z","modified":"2026-10-18T07:15:10.804752415Z","updated_at":"2026-11-02T15:43:52.545698Z"},{"id":"CLSA-2026-1792304696","title":"TuxCare security update for @next/polyfill-nomodule (1 CVE)","description":"TuxCare rebuilt @next/polyfill-nomodule to address 1 CVE. Fixed in 15.5.25-tuxcare.1.","status":"published","published":"2026-10-18T06:24:56Z","modified":"2026-10-18T07:15:15.099947771Z","updated_at":"2026-11-02T15:43:52.545698Z"},{"id":"CLSA-2026-1792304698","title":"TuxCare security update for @next/polyfill-nomodule (1 CVE)","description":"TuxCare rebuilt @next/polyfill-nomodule to address 1 CVE. Fixed in 15.5.23-tuxcare.1.","status":"published","published":"2026-10-18T06:24:58Z","modified":"2026-10-18T07:15:16.402237879Z","updated_at":"2026-11-02T15:43:52.545698Z"},{"id":"CLSA-2026-1792304699","title":"TuxCare security update for @next/polyfill-nomodule (1 CVE)","description":"TuxCare rebuilt @next/polyfill-nomodule to address 1 CVE. Fixed in 15.5.24-tuxcare.1.","status":"published","published":"2026-10-18T06:24:59Z","modified":"2026-10-18T07:15:08.888718355Z","updated_at":"2026-11-02T15:43:52.545698Z"},{"id":"CLSA-2026-1792304701","title":"TuxCare security update for @next/polyfill-nomodule (1 CVE)","description":"TuxCare rebuilt @next/polyfill-nomodule to address 1 CVE. Fixed in 15.5.26-tuxcare.1.","status":"published","published":"2026-10-18T06:25:01Z","modified":"2026-10-18T07:15:15.098960359Z","updated_at":"2026-11-02T15:43:52.545698Z"},{"id":"CLSA-2026-1792304746","title":"TuxCare security update for @next/polyfill-nomodule (1 CVE)","description":"TuxCare rebuilt @next/polyfill-nomodule to address 1 CVE. Fixed in 16.0.6-tuxcare.4.","status":"published","published":"2026-10-18T06:25:43Z","modified":"2026-10-18T07:15:15.10499099Z","updated_at":"2026-11-02T15:43:52.545698Z"},{"id":"CLSA-2026-1792326281","title":"TuxCare security update for @next/react-refresh-utils (1 CVE)","description":"TuxCare rebuilt @next/react-refresh-utils to address 1 CVE. Fixed in 15.5.25-tuxcare.1.","status":"published","published":"2026-10-18T12:24:40Z","modified":"2026-10-18T13:15:57.148341993Z","updated_at":"2026-11-02T15:43:52.545698Z"},{"id":"CLSA-2026-1792326282","title":"TuxCare security update for @next/react-refresh-utils (1 CVE)","description":"TuxCare rebuilt @next/react-refresh-utils to address 1 CVE. Fixed in 15.5.23-tuxcare.1.","status":"published","published":"2026-10-18T12:24:41Z","modified":"2026-10-18T13:16:01.005997974Z","updated_at":"2026-11-02T15:43:52.545698Z"},{"id":"CLSA-2026-1792326283","title":"TuxCare security update for @next/react-refresh-utils (1 CVE)","description":"TuxCare rebuilt @next/react-refresh-utils to address 1 CVE. Fixed in 15.5.24-tuxcare.1.","status":"published","published":"2026-10-18T12:24:42Z","modified":"2026-10-18T13:16:00.054744648Z","updated_at":"2026-11-02T15:43:52.545698Z"},{"id":"CLSA-2026-1792326284","title":"TuxCare security update for @next/react-refresh-utils (1 CVE)","description":"TuxCare rebuilt @next/react-refresh-utils to address 1 CVE. Fixed in 15.5.26-tuxcare.1.","status":"published","published":"2026-10-18T12:24:43Z","modified":"2026-10-18T13:15:57.151805071Z","updated_at":"2026-11-02T15:43:52.545698Z"},{"id":"CLSA-2026-1792326311","title":"TuxCare security update for @next/react-refresh-utils (1 CVE)","description":"TuxCare rebuilt @next/react-refresh-utils to address 1 CVE. Fixed in 16.0.6-tuxcare.4.","status":"published","published":"2026-10-18T12:25:08Z","modified":"2026-10-18T13:15:59.504284442Z","updated_at":"2026-11-02T15:43:52.545698Z"},{"id":"CLSA-2026-1792338221","title":"TuxCare security update for @next/third-parties (1 CVE)","description":"TuxCare rebuilt @next/third-parties to address 1 CVE. Fixed in 15.5.25-tuxcare.1.","status":"published","published":"2026-10-18T15:43:40Z","modified":"2026-10-18T19:15:40.656104146Z","updated_at":"2026-11-02T15:43:52.545698Z"},{"id":"CLSA-2026-1792338222","title":"TuxCare security update for @next/third-parties (1 CVE)","description":"TuxCare rebuilt @next/third-parties to address 1 CVE. Fixed in 15.5.23-tuxcare.1.","status":"published","published":"2026-10-18T15:43:40Z","modified":"2026-10-18T19:15:40.647495728Z","updated_at":"2026-11-02T15:43:52.545698Z"}]},"sources_more":{"osv":27}}