CVE-2025-55182

Remote Code Execution in Meta React Server Components. CISA confirmed attackers exploit it and added it to its Known Exploited Vulnerabilities catalog on 5 December 2025.

Product: Meta React Server Components
Added to CISA's catalog: 5 December 2025
Federal fix-by date: 12 December 2025
Ransomware: Known to be used in ransomware
Vendor advisories: react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components
github.com/vercel-labs/fix-react2shell-next
Sources: CISA’s catalog, NVD entry

CISA’s description.

Meta React Server Components contains a remote code execution vulnerability that could allow unauthenticated remote code execution by exploiting a flaw in how React decodes payloads sent to React Server Function endpoints. Please note CVE-2025-66478 has been rejected, but it is associated with CVE-2025- 55182.

Every flaw CISA confirmed exploited in the last 30 days is on the exploit watch. This is not security advice. Check the vendor’s advisory before acting. From CISA’s catalog of 4 November 2026.