CVE entry · CVE-2025-55182
CVE-2025-55182: Meta React Server Components Remote Code Execution Vulnerability
Meta React Server Components contains a remote code execution vulnerability that could allow unauthenticated remote code execution by exploiting a flaw in how React decodes payloads sent to React Server Function endpoints. Please note CVE-2025-66478 has been rejected, but it is associated with CVE-2025- 55182.
- Actively exploited: added to CISA’s KEV catalog on December 5, 2025.
- Used by ransomware, according to CISA.
- Remediation deadline for US federal agencies: December 12, 2025.
- CERT-FR alert CERTFR-2025-ALE-014 of December 5, 2025.
Description from CISA’s KEV catalog.
CERT-FR alerts and notices
-
CERTFR-2025-ALE-014[MàJ] Vulnérabilité dans React Server Components (05 décembre 2025)
What to do
- Check whether your estate includes Meta React Server Components, including internet-facing devices.
- Apply the vendor’s patch or mitigations (references below). Failing that, isolate the product or stop using it, as CISA requires of US federal agencies.
- An exploited vulnerability has often been used before it was fixed: look for signs of compromise, especially on internet-facing devices.