CVE-2025-55182

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-55182
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-55182.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-55182
Aliases
Published
2025-12-03T16:15:56.463Z
Modified
2026-03-14T08:46:59.801835Z
Severity
  • 10.0 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.

References

Affected packages

Git / github.com/facebook/react

Affected ranges

Type
GIT
Repo
https://github.com/facebook/react
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
7aa5dda3b3e4c2baa905a59b922ae7ec14734b24
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
4a9df08157f001c01b078d259748512211233dcf
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
02ef49580922f87180f32618b9d1c70b75b968b7
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
ae74234eae6ebd62f19190731278e20bc1c37d51
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
911603b46e89ae0704561a2ad9a8cbd7f2bc12f1
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
5c6ef4044610a2a325780261f41730a33a919f98
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "19.0.0"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "19.1.0"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "19.1.1"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "19.2.0"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.6.0-NA"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "16.0.0-NA"
        }
    ]
}
Type
GIT
Repo
https://github.com/vercel/next.js
Events
Introduced
51bfe3c1863b191f4b039bc230e8ed5c57b0baf3
Fixed
3d663f2141a05adb975de4e9dae4c49780791881
Introduced
dafcd43fac3ef9d0ffd94f9c94fd61db4449df25
Fixed
aeb69d97f8aad106f4760ff04f6d3aaa33597635
Introduced
b0416fbb44d1d148b6322ed79b6448d588260e49
Fixed
25ba2c26f42dc33a72c7ff39710fcad9b19d9658
Introduced
b2ff04995be722a5c93225e16e1c7fcc8bb53f91
Fixed
2f026aae46027d9575494fb3aecbd0d75fd674f0
Introduced
7ad467409b67691ae4f5dc4dc47f1a247c4ba988
Fixed
49668475daba15ef8cea1d8e469dc0f9a765b635
Introduced
7e08c8223d64bc2add7a0e5a323cbce0a84bb292
Fixed
3eaf68b09b2b6b8c0c8e080a9713e131a78dc529
Introduced
950609f96f694c5475d18cd2d72a0052ca04d4b9
Fixed
7492122a3bbc6655b64ccba04076c73ab418cdcc
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
74be1f68c2ed99671d66e3e7f1337b997e74f464
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
6cacc83dd871ec4e0f3c3586652d50a3d467a2f4
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
7fe4f41e131df2fa6b4a595a6e1647323bfd47e1
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
dfe7fc03e2268e7cb765dce6a89e02c831c922d5
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
0f1d9e9f7b267645cc03e5bc07a286d6ed9e0ff2
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
20201a11a25101febdb3735c900410d04b388760
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
4df90ac6ff1e715e989fb21287896f14381c9817
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
6fc03e70b60496afc7e36b1c7058094dbbcd0558
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
1c83394dd3e0b439c283bc7be4b1c7771ae8bda6
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
7dfb652ef1ada396a1816d5905e38ca93558e4a0
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
c4f664504107a97edb4f9bb907da16c3bdc8a640
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
c654bec6eb08382ed2ef47c90317039b6693f62a
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
4d82a4aa13ff4d5f9b0179dcaa185666df617756
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
03250cd04344ba2a527763d08b3976bf29dff226
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
f27212108372c13acf795ceec1e169405c177815
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
12a6ee4b212bc49c9ec6f339e55ca2b5b18d663c
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
74b226fe4afc7149901affc3c005476e9e592315
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
92f23dae971044dfb49f7bbbf29f02c64f6ce7b3
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
b99b353f52745ad03783b99fad8d2eb287f03fad
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
9db775049edc7e0ee29c7551492c202e01829c8d
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
7fb8bfe685a117ca87332ab5366efcda8fdbcb82
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
c072d53ce28cb680f7207e789b6b9951a21b0a8d
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
630798355931c8b24d7067aac6ff9519f201a01d
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
ea034f6ff96e54ddab4b81796ae5ad7232e05ede
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
d608590ced4f592c9939c841b9814c121bb6b20d
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
e9e5eca47b935abaffc1321bd8896a498dc3c636
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
de19200deb33869fc691b43e68aef76493d79fa1
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
42cc1a85888311a7f0745fd68fb29e4767b1d9e3
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
49b83495aab6cd7d9ad74126f93ec3917bedc4e5
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
088a519039d319ab2a48d7963d717647d943190d
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
7d9b384d1be37308484d96bc4816d435bd22ff55
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
ee87a4bb223c4270e088d97a15a6a9ad3a2d1d1f
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
e8a1342e0ec2b576465ae33e1c7392c92703e7ec
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
dbdf9ca95273198d56bef531eeb127fc38f8f8e0
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
33016f3c55f4595f2601fe9d5ced8f7c675cf7fc
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
6bf58cc8cba154d5f8e0d14ceabab3f95bf7e51b
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
a9c4a8c8fb11a235d08328225532a0b8bf9c93de
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
c298d7042f89ac8933e3848a39788217535cdef8
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
6d318d618fae8e1a04624abb83a107a1d4df5ab2
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
9f329f5a69447f328f1a635ab9bdb3d228426491
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
d300ee9930d2e2d28f5c4dce1dc7e4fe5a62d78e
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
43b8e3d6ad5acc569be6c1c12ee73dff04949c66
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
7182f909aeed45c7d791bc6f49b3afcaec8cebfe
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
bc2fa389b11263ecb6beccfd97a8b4fe2e3dad0f
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
2330e144ff88fe557b24a9320770ad808041d99f
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
67ca1e9519ed3007372baef06a58432e8965d35e
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
6f2c64048f8cd4ba6d51beb3f3b2e00aceace2f7
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
16bc1455dc928b18cea93a55b65c4b02a99da63c
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
5faac816559bbca7a984c9a56c89f9f880ffbfd4
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
d4eb8915334320a39a376b409fb2e359a630d57c
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
665977f2c7b124ba2f1f132d6ba4e3793a2aea49
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
7c0c2c6b86fe3bd44f205a2677f3622ba3fb8700
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
8acd54a8c807671b016ad9e02f108739c6563a43
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
a6c48f029d7292af04dcb525a85269f92a7f1e96
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
1da862828f4a9fccac2a2499d27f32cab4fd3882
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
52a26cdb0ccb8c27d1c484aa22c46d2c9332890e
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
fc307c4f23b18a054cdc6dfb5453749a2947b1a0
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
f69066fb20b29e591b40ff20e41181391bda1477
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
2cc84abc6254c4dec1c51ac7945300a03e9e51be
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
ed2e69df89c206d68a4ce227cda5d71e49e83290
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
69e3e629b6ea5ec67b6dca0a47bd4e7ba6eb70d4
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
79e78381c62149e8bc49696e140085e156444e61
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
8d475c5468b18cb3aad0de0a50632953d5243db1
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
e2713a423002420b3d12f6fa946205581d1151e3
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
73a4d0829a8e6a53af5be9c52bcf466e4941344c
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
323eebcee7f15d4c880654ed9cd3b46c49e80dc7
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
f7a88eb6c2f77c4e07c7dc23b9a7c822d3c0b03d
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
844abcac192d702161531468996eadfd1a1c4f13
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
33759e0be7d31f8a5d59544267f7ec9b914f37e5
Database specific 
{
    "versions": [
        {
            "introduced": "15.0.0"
        },
        {
            "fixed": "15.0.5"
        },
        {
            "introduced": "15.1.0"
        },
        {
            "fixed": "15.1.9"
        },
        {
            "introduced": "15.2.0"
        },
        {
            "fixed": "15.2.6"
        },
        {
            "introduced": "15.3.0"
        },
        {
            "fixed": "15.3.6"
        },
        {
            "introduced": "15.4.0"
        },
        {
            "fixed": "15.4.8"
        },
        {
            "introduced": "15.5.0"
        },
        {
            "fixed": "15.5.7"
        },
        {
            "introduced": "16.0.0"
        },
        {
            "fixed": "16.0.7"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "14.3.0-canary77"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "14.3.0-canary78"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "14.3.0-canary79"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "14.3.0-canary80"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "14.3.0-canary81"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "14.3.0-canary82"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "14.3.0-canary83"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "14.3.0-canary84"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "14.3.0-canary85"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "14.3.0-canary86"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "14.3.0-canary87"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.6.0-canary0"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.6.0-canary1"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.6.0-canary10"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.6.0-canary11"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.6.0-canary12"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.6.0-canary13"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.6.0-canary14"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.6.0-canary15"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.6.0-canary16"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.6.0-canary17"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.6.0-canary18"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.6.0-canary19"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.6.0-canary2"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.6.0-canary20"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.6.0-canary21"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.6.0-canary22"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.6.0-canary23"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.6.0-canary24"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.6.0-canary25"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.6.0-canary26"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.6.0-canary27"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.6.0-canary28"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.6.0-canary29"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.6.0-canary3"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.6.0-canary30"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.6.0-canary31"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.6.0-canary32"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.6.0-canary33"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.6.0-canary34"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.6.0-canary35"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.6.0-canary36"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.6.0-canary37"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.6.0-canary38"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.6.0-canary39"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.6.0-canary4"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.6.0-canary40"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.6.0-canary41"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.6.0-canary42"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.6.0-canary43"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.6.0-canary44"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.6.0-canary45"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.6.0-canary46"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.6.0-canary47"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.6.0-canary48"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.6.0-canary49"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.6.0-canary5"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.6.0-canary50"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.6.0-canary51"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.6.0-canary52"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.6.0-canary53"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.6.0-canary54"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.6.0-canary55"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.6.0-canary56"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.6.0-canary57"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.6.0-canary6"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.6.0-canary7"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.6.0-canary8"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.6.0-canary9"
        }
    ]
}

Affected versions

1.*
1.2.5
16.*
16.0.0-beta.1
16.0.0-beta.3
16.0.0-beta.4
16.0.0-beta.5
16.1.0
16.1.0-beta
16.1.0-beta.1
16.1.0-rc
eslint-plugin-react-hooks@5.*
eslint-plugin-react-hooks@5.0.0
Other
status
v0.*
v0.0.0-88ada9819
v0.0.0-d7382b6c4
v0.0.0-experimental-27659559e
v0.0.0-experimental-8b155d261
v0.0.0-experimental-aae83a4b9
v0.0.0-experimental-d7382b6c4
v0.10.0-rc1
v0.11.0-rc1
v0.12.0-rc1
v0.13.0-rc1
v0.13.0-rc2
v0.14.0-beta1
v0.14.0-beta2
v0.14.0-beta3
v0.14.0-rc1
v0.4.0
v0.9.0-rc1
v15.*
v15.0.0-rc.1
v15.0.0-rc.2
v16.*
v16.0.0
v16.0.0-alpha.3
v16.0.0-alpha.4
v16.0.0-rc.1
v16.1.0
v16.1.1
v16.10.0
v16.11.0
v16.12.0
v16.13.0
v16.2.0
v16.3.0
v16.3.0-alpha.0
v16.3.0-alpha.1
v16.3.0-alpha.2
v16.3.0-alpha.3
v16.3.0-rc.0
v16.3.1
v16.3.2
v16.4.0
v16.4.1
v16.5.0
v16.5.2
v16.6.0
v16.6.0-alpha.0
v16.6.0-alpha.8af6728
v16.6.1
v16.7.0
v16.8.0
v16.8.2
v16.9.0
v16.9.0-alpha.0
v16.9.0-rc.0
v18.*
v18.0.0
v18.1.0
v18.2.0
v19.*
v19.0.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-55182.json"