CVE-2025-55182

Name of the Vulnerable Software and Affected Versions React Server Components versions 19.0.0 through 19.2.0

Description A pre-authentication remote code execution issue exists in the react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack packages. The problem stems from unsafe deserialization of payloads in HTTP requests sent to Server Function endpoints, specifically involving the requireModule() function and the hasOwnProperty parameter. This allows a remote attacker to execute arbitrary JavaScript code in the server context. Real-world exploitation has been observed, including the deployment of the EtherRAT backdoor (which uses Ethereum-based command-and-control), cryptocurrency miners, and the Weaxor ransomware. Attacks have targeted internet-facing servers running Node.js and React/Next.js workloads across various industries, including retail, finance, and business services.

Recommendations Update React Server Components to a version later than 19.2.0. As a temporary mitigation, apply WAF rules to detect and block requests targeting Server Function endpoints that exhibit patterns of unsafe deserialization.