CVE-2025-55182: React Server Components Remote Code Execution Vulnerability
Summary
CVE-2025-55182: React Server Components are Vulnerable to RCE. Affects react-server-dom-webpack across 3 version ranges.
>= 19.0, < 19.0.1
>= 19.1.0, < 19.1.2
>= 19.2.0, < 19.2.1
Fixed in 19.0.1, 19.1.2 or 19.2.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
React Server Components is a powerful feature of the React library that allows developers to build modern web applications with server-rendered components. It enhances performance by enabling server-side rendering and reducing the amount of JavaScript sent to the client. However, certain versions of React Server Components have been found to be vulnerable to a critical remote code execution (RCE) issue, which could allow attackers to execute arbitrary code on the server.
Vulnerability Detail
The vulnerability arises from a flaw in the handling of server components in React, which can be exploited by an unauthenticated attacker to execute arbitrary code on the server. This could lead to severe consequences, including data breaches, unauthorized access to sensitive information, and complete server compromise. The affected versions include 19.0, 19.1.0, 19.1.1, and 19.2.0 of the packages react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack. The vulnerability has a CVSS score of 10.0, indicating its critical severity.
How To Fix
Latest published version: 19.3.1 as of 23 Oct 2026
npm install react-server-dom-webpack@19.3.1Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 19.0, < 19.0.119.0.1npm install react-server-dom-webpack@19.0.1 -
>= 19.1.0, < 19.1.219.1.2npm install react-server-dom-webpack@19.1.2 -
>= 19.2.0, < 19.2.119.2.1npm install react-server-dom-webpack@19.2.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If your application does not utilize a server or does not employ a framework, bundler, or plugin that supports React Server Components, it is not affected by this vulnerability. However, if you must continue using an affected version, consider isolating the vulnerable components or restricting access to your server until an upgrade can be performed.
Conclusion
The React Server Components vulnerability (CVE-2025-55182) poses a significant risk due to its potential for remote code execution. It is crucial for developers using the affected versions to upgrade to the patched releases immediately to safeguard their applications from potential exploitation.
See every vulnerability recorded for react-server-dom-webpack →
FAQ
The vulnerability is a remote code execution (RCE) flaw that allows unauthenticated attackers to execute arbitrary code on the server.
The affected versions include 19.0, 19.1.0, 19.1.1, and 19.2.0 of react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check if your application is affected by this vulnerability using the Vulert playground at Vulert Scanner without any signup.
If an immediate upgrade is not possible, consider isolating the vulnerable components or restricting access to your server to mitigate potential risks.
The CVSS score of this vulnerability is 10.0, indicating its critical severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for react-server-dom-webpack.
