New React RSC Vulnerabilities Enable DoS and Source Code Exposure

CVE-2025-55182 is a critical (CVSS 10.0) pre-authentication remote code execution flaw (CWE-502, deserialization of untrusted data) in React Server Components, specifically the react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack packages in versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0. It is triggered when the vulnerable code unsafely deserializes payloads from HTTP requests sent to Server Function endpoints, requiring no authentication or user interaction. An attacker gains arbitrary code execution on the affected server (CVSS scope changed, with high impact to confidentiality, integrity, and availability), and reporting notes a campaign in which hackers used the flaw to breach 766 Next.js hosts and steal credentials. Any React/Next.js application exposing Server Functions with the affected React versions is in scope, which given the ubiquity of React and Next.js is a very large deployed base. Exploitation is confirmed in the wild: the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2025-12-05 with known ransomware use, EPSS puts the 30-day exploitation probability at 99.8%, multiple public PoC/scanner repositories are available, and coverage has dubbed the flaw React2Shell.

Do: Upgrade the react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack packages to the vendor-patched releases (any version later than the vulnerable 19.0.0, 19.1.0, 19.1.1, and 19.2.0 line) and update Next.js per Vercel's advisory; as a KEV entry, U.S. federal agencies must apply vendor mitigations per BOD 22-01 or discontinue use. Audit internet-exposed Server Function endpoints for the vulnerable React versions and review logs for exploitation activity, including the reported campaign that breached 766 Next.js hosts and stole credentials, then rotate any exposed credentials.

CVE-2025-55183 is an information-disclosure flaw in specific configurations of React Server Components in versions 19.0.0, 19.0.1, 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, affecting the packages react-server-dom-parcel, react-server-dom-turbopack and react-server-dom-webpack. A specially crafted HTTP request sent to a vulnerable Server Function can cause it to unsafely return the source code of any Server Function, but only when the application has a Server Function that explicitly or implicitly exposes a stringified argument. An attacker gains unauthenticated read access to server-side application source code (CVSS 5.3, network-exploitable with no privileges or user interaction, confidentiality-only impact), which is valuable reconnaissance that can enable follow-on attacks alongside the related React RSC denial-of-service flaws. Affected are any applications running the listed React 19.x RSC packages, most prominently Next.js deployments that use React Server Components and Server Functions. A vendor advisory with public exploit guidance was published on December 11, 2025, reporting of 'React2Shell' fallout indicates public exploits are circulating, and EPSS assigns a 64.2% probability of exploitation within 30 days (99th percentile), though the flaw is not yet in CISA KEV.

Do: Upgrade react-server-dom-webpack, react-server-dom-turbopack and react-server-dom-parcel to patched releases newer than the affected 19.0.0-19.2.1 versions, and update Next.js's bundled React accordingly, following the React team's December 11, 2025 advisory. Audit your application for Server Functions that explicitly or implicitly expose stringified arguments, since exploitation requires such a function to exist. Until patched, restrict and monitor external access to Server Function endpoints; no CISA KEV deadline applies yet.

CVE-2025-55184 is a pre-authentication denial-of-service flaw in the deserialization logic of the React Server Components packages react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack in versions 19.0.0 through 19.2.1. An attacker triggers it by sending a crafted, unauthenticated HTTP request to any Server Function endpoint, where unsafe deserialization of the payload causes an infinite loop that hangs the server process. Successful attacks cause high availability impact: the affected process stops responding and subsequent HTTP requests are no longer served until the process is restarted, with no expected confidentiality or integrity loss. Any application using React 19 Server Components is affected, including Next.js deployments whose Server Functions rely on these packages. No public proof-of-concept or confirmed in-the-wild exploitation is known for this specific flaw, but the very high EPSS score (66.9% within 30 days, 99th percentile) and ongoing exploitation of related React RSC flaws (React2Shell) indicate elevated risk.

Do: Inventory all applications using React 19 Server Components (react-server-dom-webpack, -turbopack, -parcel), including Next.js builds that bundle them, and upgrade to a React 19.x release newer than 19.2.1 with the patched packages as soon as available. As an interim mitigation, restrict and rate-limit access to Server Function endpoints and monitor or auto-restart server processes that hang under crafted requests. Prioritize patching given that related React RSC vulnerabilities are already being exploited in the wild.

It was found that the fix addressing CVE-2025-55184 in React Server Components was incomplete and does not prevent a denial of service attack in a specific case. React Server Components versions 19.0.2, 19.1.3 and 19.2.2 are affected, allowing unsafe deserialization of payloads from HTTP requests to Server Function endpoints. This can cause an infinite loop that hangs the server process and may prevent future HTTP requests from being served.