Critical Security Vulnerability in React Server Components

Everyone is scrambling to update their React Server Components dependencies today after the React team disclosed an unauthenticated remote code execution vulnerability (CVE-2025-55182, CVSS 10.0).

The issue affects React Server Components (RSC) deployments by exploiting a flaw in how React decodes payloads sent to React Server Function endpoints. In practice, an attacker can craft a malicious HTTP request that, when deserialized, results in remote code execution on the server.

Even if your app does not intentionally expose React Server Function endpoints, you may still be vulnerable if your stack supports React Server Components, since the affected packages can be pulled in indirectly through frameworks, bundlers, or plugins.

The React team says the vulnerability is present in versions 19.0, 19.1.0, 19.1.1, and 19.2.0 of:

• react-server-dom-webpack
• react-server-dom-parcel
• react-server-dom-turbopack

If your React code does not run on a server, you are not affected. If you do not use a framework, bundler, or plugin that supports React Server Components, you are not affected.

Next.js reports that App Router apps using React Server Components are affected on Next.js 15.x, Next.js 16.x, and Next.js 14.3.0-canary.77+. For patched versions and upgrade steps, see the Next.js advisory.

React has shipped fixes in 19.0.1, 19.1.2, and 19.2.1, and recommends upgrading immediately.

Some widely used frameworks and bundlers are affected because they depend on or include the vulnerable packages, including Next.js, React Router, Waku, @parcel/rsc, @vitejs/plugin-rsc, and rwsdk. If you are using one of these, follow the framework’s patched release line and upgrade guidance.

Hosting providers have applied temporary mitigations in some cases, but those are not a substitute for upgrading.

The fixes were published to npm on December 3, 2025.

RSC support is increasingly common in production React stacks, and these packages often arrive as transitive dependencies. That combination is why this is showing up as an “update everything” day across the ecosystem.

Socket customers can see if they have the vulnerable dependency by searching on the Dependencies page in the dashboard for any of the affected packages (react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack) in the 19.0 / 19.1.0 / 19.1.1 / 19.2.0 range, including when they appear as transitive dependencies via frameworks. CVE-based alerts will update shortly as newly published advisories propagate through ingestion. We are also accelerating this update path for faster turnaround on high-severity disclosures.