On 29 November 2025, researcher Lachlan Davidson reported a critical React vulnerability that allows unauthenticated remote code execution via specially crafted React Server Function payloads. This vulnerability was disclosed as CVE-2025-55182 (React) and CVE-2025-66478 (Next.js) and is rated CVSS 10.0.
A public proof concept has also been released so patching is of utmost importance.
Technical details
React Server Functions allow a client to call functions on a server by translating client-side requests into HTTP requests that are forwarded to a server. The server then deserializes the request, invokes the relevant function, and returns the response to the client.
CVE-2025-55182 arises from the way react-server deserializes these HTTP payloads. A specially crafted malicious request can bypass validation and influence server-side execution logic, allowing an attacker to execute arbitrary code.
The issue affects the following versions of the associated packages:
- react-server-dom-webpack
- react-server-dom-parcel
- react-server-dom-turbopack
Versions 19.0, 19.1.0, 19.1.1, and 19.2.0 are impacted.
Similarly, Next.js is vulnerable due to inheriting the vulnerable flaw through its implementation of the React Server Components Flight protocol. The vulnerability affects the following Next.js versions:
- 14.3.0-canary
- 15.x
- 16.x
Impact summary
The vulnerability exists in the default configuration of affected React and Next.js applications, meaning typical deployments are immediately exposed. Exploitation requires no authentication and can be triggered simply by sending a specially crafted request to a React Server Function endpoint. Successful exploitation allows remote code execution on the server, enabling an attacker to execute arbitrary commands, access sensitive application data, modify server-side logic, or deploy further malicious actions within the environment. Given the critical severity and ease of exploitation, urgent patching is strongly advised.
Mitigating the vulnerability
React mitigation:
A fix is available in versions:
- 19.0.1
- 19.1.2
- 19.2.1
Users of the affected packages should upgrade to one of these versions immediately. Applications that do not use a server with React, or do not rely on a framework, bundler, or plugin supporting React Server Components, are not affected by this vulnerability.
Next.js mitigation:
Patched versions of Next.js include:
- 14.3.0-canary.88
- 15.0.5
- 15.1.9
- 15.2.6
- 15.3.6
- 15.4.8
- 15.5.7
- 16.0.7
Users should upgrade to one of these versions to address the vulnerability.
How can Sentrium help?
Sentrium offer vulnerability assessment and penetration testing services that can help you identify vulnerable server component deployments and endpoint systems across your environments. Start your assessment today by completing our pentest scoping form or get in touch with our team to learn more about how our testing services can support you.
