CVE-2025-55182 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	NIST	10 CRITICAL	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Meta	CNA	10 CRITICAL				CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CISA-ADP	ADP	---				---
CVE	ADP	---				---

Awaiting analysis

This vulnerability is currently awaiting analysis.

Base Score

CVSS 3.x

EPSS Score

Percentile: Unknown

Vulnerability Media Exposure

[ENGLISH] 'Exploitation is imminent' as 39 percent of cloud environs have max-severity React hole
Finish reading this, then patch A maximum-severity flaw in the widely used JavaScript library React, and several React-based frameworks including Next.js allows unauthenticated, remote attackers to execute malicious code on vulnerable instances. The flaw is easy to abuse, and mass exploitation is "imminent," according to security researchers.…
Published: 2025-12-03T21:55:37+00:00
[ENGLISH] Critical RSC Bugs in React and Next.js Allow Unauthenticated Remote Code Execution
A maximum-severity security flaw has been disclosed in React Server Components (RSC) that, if successfully exploited, could result in remote code execution. The vulnerability, tracked as CVE-2025-55182, carries a CVSS score of 10.0. The vulnerability has been codenamed React2shell. It allows "unauthenticated remote code execution by exploiting a flaw in how React decodes payloads sent to React
Published: 2025-12-03T23:49:00+05:30
[GERMAN] Jetzt patchen! Kritische Schadcodelücke bedroht React
Die JavaScript-Programmbibliothek React und bestimmte damit erstellte Apps sind verwundbar. Sicherheitsupdates stehen zum Download bereit.
Published: 2025-12-04T09:22:00+00:00
[GERMAN] Auch Next.js betroffen: Kritische React-Lücke gefährdet unzählige Serversysteme
Angreifer können die Sicherheitslücke ausnutzen, um Schadcode einzuschleusen. Etwa 39 Prozent aller Cloudumgebungen sollen anfällig sein. ( Sicherheitslücke , Server )
Published: 2025-12-04T08:58:05+01:00
[ENGLISH] Critical React, Next.js flaw lets hackers execute code on servers
A maximum severity vulnerability, dubbed 'React2Shell', in the React Server Components (RSC) 'Flight' protocol allows remote code execution without authentication in React and Next.js applications. [...]
Published: 2025-12-04T10:11:54-05:00
[GERMAN] Vercel Next.js und React Server Components (React2Shell): Schwachstelle ermöglicht Codeausführung
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Vercel Next.js und React ausnutzen, um beliebigen Programmcode auszuführen.
Published: 2025-12-03T23:00:00+00:00

References

https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components

https://www.facebook.com/security/advisories/cve-2025-55182

http://www.openwall.com/lists/oss-security/2025/12/03/4

https://news.ycombinator.com/item?id=46136026