PT-2025-48817 · Meta · React-Server-Dom-Turbopack+3

Published

2025-12-03

·

Updated

2026-05-10

·

CVE-2025-55182

CVSS v3.1

10

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions React Server Components versions 19.0.0 through 19.2.0
Description A pre-authentication remote code execution issue exists in React Server Components, specifically affecting the react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack packages. The flaw is caused by unsafe deserialization of payloads from HTTP requests sent to Server Function endpoints, specifically involving the hasOwnProperty parameter within the requireModule() function. This allows an unauthenticated remote attacker to execute arbitrary JavaScript code on the server.
Real-world exploitation has been extensive, including:
  • A large-scale automated campaign by threat cluster UAT-10608 using the NEXUS Listener framework, which compromised at least 766 hosts and exfiltrated over 10,120 files, including database credentials, SSH keys, and cloud API tokens.
  • Deployment of the EtherRAT Node.js backdoor, which utilizes "EtherHiding" (a technique using Ethereum smart contracts to rotate command-and-control endpoints) for persistent access.
  • Attacks by ransomware groups deploying the Weaxor strain, which involves disabling Windows Defender and deploying Cobalt Strike beacons.
  • Widespread use by botnets like Mirai and various cryptocurrency miners.
Recommendations Update React Server Components and affected packages to versions that fix this issue. Rotate and revoke all potentially exposed secrets, including API keys, database passwords, SSH keys, and cloud credentials. Enforce the use of IMDSv2 on AWS instances and apply least-privilege IAM roles. Deploy WAF or RASP rules specifically tuned to detect and block Next.js SSR deserialization attack patterns. Implement egress filtering to monitor and block unusual outbound HTTP traffic, particularly to port 8080. As a temporary mitigation, restrict access to Server Function endpoints to minimize the risk of exploitation.

Exploit

Fix

DoS

RCE

LPE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BDU:2025-15156
CVE-2025-55182
GHSA-FV66-9V8Q-G76R

Affected Products

React Server Components
React-Server-Dom-Parcel
React-Server-Dom-Turbopack
React-Server-Dom-Webpack