CVE-2025-55182: Meta React Server Components -- Unauthenticated RCE

Background

React Server Components (RSC) is Meta’s framework extension enabling server-side rendering and streaming of React component trees, now widely used in Next.js and other production frameworks serving millions of applications. The RSC protocol communicates via a specialized serialization format between client and server, handling server functions (also called “server actions”) across an HTTP boundary.

CVE-2025-55182 represents a critical flaw in how React decodes payloads sent to React Server Function endpoints. The vulnerability is exploitable without authentication, meaning any internet-accessible RSC endpoint is a potential entry point. Note that CVE-2025-66478 was initially assigned to a related issue but has since been rejected; CVE-2025-55182 is the canonical identifier. CISA added this to the KEV catalog on 2025-12-05.

The breadth of React’s adoption — Next.js alone powers a substantial fraction of modern web infrastructure — makes this vulnerability exceptionally high-impact, affecting production applications at scale.

Technical Mechanism

The vulnerability lies in the RSC payload deserializer on the server side. React Server Function endpoints accept serialized payloads representing function arguments; the deserializer processes these payloads to reconstruct JavaScript values. A flaw in this decoding pipeline allows an attacker to craft a malicious payload that causes the server to execute attacker-controlled code during deserialization.

// Vulnerable pattern: unsafe deserialization of RSC action payload
async function handleServerAction(request) {
  const body = await request.text();
  // Bug: payload is decoded with eval-equivalent path before validation
  const args = decodeReply(body, serverModuleMap); // unsafe decode
  const result = await action(...args); // attacker controls 'action'
  return encodeReply(result);
}

By sending a specially crafted payload to a /_next/server-action (or equivalent) endpoint, an attacker can cause arbitrary code to execute in the Node.js server process, with all the privileges of the web application.

Real-World Exploitation Evidence

CISA confirmed active exploitation and marked this as a Known Ransomware-Associated Vulnerability. Ransomware operators have moved rapidly to weaponize this flaw given the wide deployment surface. Exploitation is straightforward — no credentials, tokens, or prior access are required. Post-exploitation typically involves deploying web shells, establishing reverse shells, exfiltrating environment variables (including cloud credentials and API keys), and in ransomware scenarios, lateral movement to connected infrastructure.

The ransomware association indicates criminal actors are using this as an initial access vector, then deploying encryptors to backend infrastructure. Cloud-deployed Node.js applications are particularly attractive targets due to IAM credential availability in environment variables.

Impact Assessment

• Unauthenticated remote code execution on any server hosting RSC endpoints
• Full compromise of server environment and environment variables (cloud credentials, API keys)
• Lateral movement to cloud infrastructure, databases, and internal services
• Ransomware deployment and data exfiltration at scale
• Supply chain risk if the affected application builds or deploys other services

Affected Versions

Remediation Steps

1. Update React and react-dom to the patched versions immediately.
2. Update Next.js (or other RSC framework) to versions that include the fix.
3. If immediate patching is not possible, disable Server Actions/RSC endpoints via WAF rules.
4. Audit server environments for signs of compromise (unexpected processes, new files, exfiltrated secrets).
5. Rotate all secrets and cloud credentials that may have been exposed.
6. Review application logs for unexpected POST requests to server action endpoints.

Detection Guidance

Log Sources: Web server/CDN logs, Node.js application logs, cloud provider audit trails.

IOCs: Malformed or oversized POST bodies to /_next/action, /api/server-action, or similar RSC endpoints; unexpected child processes spawned from Node.js; anomalous outbound connections from web servers.

Suricata rule:

alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (
  msg:"ET WEB React Server Component Malicious Payload CVE-2025-55182";
  flow:established,to_server;
  content:"POST"; http_method;
  content:"/_next/"; http_uri;
  content:"Content-Type|3a| text/x-component"; http_header;
  pcre:"/\$[A-Z][0-9]+:/";
  classtype:web-application-attack;
  sid:2099002; rev:1;
)

Timeline

References

• NVD — CVE-2025-55182
• CISA KEV — CVE-2025-55182
• MITRE CVE — CVE-2025-55182