Overview

React Servers are affected by a critical vulnerability. The vulnerability could allow an unauthenticated remote attacker to execute arbitrary code on the affected device.

Description

React Server Components are affected by a critical vulnerability tracked as CVE-2025-55182 with a CVSS base score of 10. This vulnerability results from a flaw in how React decodes payloads sent to React Server Function endpoints. Successful exploitation of this vulnerability could allow an unauthenticated attacker to perform remote code execution on an affected device or system.

Impact

Successful exploitation of this vulnerability may allow the attacker to take control of the affected system.

Solution

React has released security patches for this vulnerability. Users and administrators are encouraged to apply necessary updates.

References

• 1. https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components