CVE-2025-55182 Scanner
CVE-2025-55182 Scanner - Remote Code Execution (RCE) vulnerability in React Server Components and Next.js
Used 2.4k times · 4.2k assets checked · domain, subdomain, ipv4
🔴
CISA Known Exploited Vulnerability
This CVE is actively exploited in the wild. CISA mandates federal agencies to patch immediately.
CVE
CVE-2025-55182
10.0
CVSScritical
Exploitable remotely over the internet · no authentication required.
Description
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.
Attack Vector
Network
Privileges Req.
None
User Interaction
None
react-server-dom-webpackreact-server-dom-turbopackreact-server-dom-parcel
Updated Sep 26, 2026View on NVD →
S4E scanner
CVE history: react-server-dom-webpack
Predict next CVE date with AIMonitor this CVE on your assets
S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.
Create a free account →