CVE-2025-55182

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2025-55182 10.0

Meta · React Server Components · Added 2025-12-05 · Published 2025-12-03

3-Day Required PoC Available KEV Automatable Active Exploitation

Details

VulnerabilityMeta React Server Components Remote Code Execution Vulnerability

VendorMeta

ProductReact Server Components

Date added2025-12-05

Due date2025-12-12

CISA catalogView on CISA KEV catalog

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CWECWE-502

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Descriptions

KEV: Meta React Server Components contains a remote code execution vulnerability that could allow unauthenticated remote code execution by exploiting a flaw in how React decodes payloads sent to React Server Function endpoints. Please note CVE-2025-66478 has been rejected, but it is associated with CVE-2025- 55182.

NVD: A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.

Compliance SSVC + BOD 26-04

Automatableyes

Technical impacttotal

Exploitation statusactive

3-day qualifyingYes

Public timeline3 days + forensic

Non-public timeline3 days + forensic

Forensic (public)Required

Forensic (non-public)Required

Research metadata

Last researched2026-08-29 13:42 UTC

Wall time120.0s

Searches7

Component defaultyes

Hunting hypothesis agent

Hunt proxy logs for POST requests with Next-Action headers carrying multipart JSON with resolved_model status and $@0 circular refs — the Flight Protocol deserialization resolves attacker $B blob handler calls to Function(code) for RCE.

Research details

ComponentReact Flight Protocol deserialization in packages react-server-dom-webpack, react-server-dom-turbopack, react-server-dom-parcel (versions 19.0.0–19.2.0). The vulnerable code path is: `decodeReply()` → `initializeModelChunk()` → `reviveModel()` → `parseModelString()` handler `$B` for blob references. The `getOutlinedModel()` function allows prototype chain traversal via colon-separated path references (e.g., `$1:constructor:constructor`) without `hasOwnProperty` validation. The `$B` handler calls `response._formData.get(response._prefix + id)`, enabling invocation of the Function constructor with attacker-controlled code. Next.js Server Action handler (`action-handler.ts`) calls `decodeReplyFromBusboy()`

Preconditions1) Target must be running React 19.0.0, 19.1.0, 19.1.1, or 19.2.0 with any of the react-server-dom-* packages; 2) The application must use Server Functions/Server Actions (enabled by default in Next.js App Router); 3) Network access to any endpoint that accepts multipart/form-data POST requests and processes React Flight Protocol payloads; 4) No authentication required — the vulnerability is triggered during deserialization BEFORE the requested Server Action is validated; 5) Any arbitrary `Next-Action` header value is sufficient to reach the vulnerable code path; 6) The attacker crafts a malicious multipart/form-data body containing three specially crafted form fields with self-referential chunk objects that exploit the `$B` handler and `getOutlinedModel()` prototype traversal to invoke `Function()` with arbitrary JavaScript code. The exploit is triggered solely through HTTP request deserialization with no user interaction required. agent

DeliveryCrafted multipart/form-data HTTP POST request to any React Server Function endpoint (typically routed via Next.js `/_next/...` Server Action handlers or the application root URL). The request must include a `Next-Action` header with an arbitrary value and a multipart body containing at least three form fields: (1) a fake chunk object with `then` self-referencing `$1:__proto__:then`, `status: "resolved_model"`, and a nested `value` JSON string containing `"$B"` blob reference; (2) a reference field containing `"$@0"` creating a circular self-reference; (3) an empty array for `_chunks`. The `_response._prefix` field contains the attacker's JavaScript code, and `_response._formData.get` points to `"$1:constructor:constructor"` resolving to the `Function` constructor. The exploit is fully delivered via a single HTTP request with no prior authentication or user interaction required.

Public PoCyes

PoC URLs https://github.com/msanft/CVE-2025-55182
https://github.com/ejpir/CVE-2025-55182-research
https://github.com/ejpir/CVE-2025-55182-bypass
https://github.com/hulh122/CVE-2025-55182
https://github.com/mrknow001/RSC_Detector
https://github.com/ynsmroztas/NextRce
https://github.com/pyroxenites/Nextjs_RCE_Exploit_Tool
https://github.com/Rsatan/Next.js-Exploit-Tool
https://github.com/l4rm4nd/CVE-2025-55182
https://github.com/freeqaz/react2shell Third-party repos; verify before use.

Advisoryhttps://www.facebook.com/security/advisories/cve-2025-55182

Exploit notesCVSS attack complexity LOW (AC:L) — no authentication, no user interaction, no privileges required, and no special conditions. The payload is a standard multipart/form-data POST with JSON-encoded form fields. Public PoCs exist with full working exploit chains, lowering the barrier to entry significantly. The exploit uses a 3-field multipart form with self-referential chunk objects, prototype chain traversal (`$1:constructor:constructor` → Function constructor), and the `$B` handler call gadget (`response._formData.get(response._prefix + id)`). The vulnerability is triggered during deserialization (before action validation), so any `Next-Action` header value suffices. WAF bypass is possible via unicode encoding in JSON, chunked transfer encoding, or oversized body padding exceeding WAF inspection limits. Exploitation was observed in the wild within hours of public disclosure by multiple threat actors including state-sponsored groups. The only effective mitigation is patching — signature-based WAF rules cannot reliably block this attack due to the encoding flexibility of JSON and JavaScript.

SummaryCVE-2025-55182 (React2Shell) is a CVSS 10.0 critical unauthenticated remote code execution vulnerability in Meta's React Server Components, affecting React 19.0.0 through 19.2.0. The flaw resides in the React Flight Protocol deserialization logic where the `getOutlinedModel()` function permits prototype chain traversal via colon-separated path references without proper `hasOwnProperty` validation, allowing attackers to access the JavaScript `Function` constructor. By crafting malicious multipart/form-data requests with self-referential chunk objects that exploit the `$B` blob handler in `parseModelString()`, an unauthenticated attacker can invoke `Function()` with arbitrary code, achieving full RCE on any Next.js or React application using Server Functions. Public proof-of-concept exploits were released within hours of disclosure, and widespread in-the-wild exploitation by multiple threat actors was observed within days. Vendors have released patches (React 19.0.1+, 19.1.2+, 19.2.1+; Next.js 15.0.5+ and 16.0.7+), and immediate upgrading is the only reliable mitigation.

Tia coverage

First reported2026-07-02

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

chocopoc-malware-targets-security-researchers-via-trojanized-poc the-gentlemen-ransomware-storm-2697-fastest-growing-raas-of-2026

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.