CVE-2025-55182
Description
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.
Summary dbcve.org
React Server Components versions 19.0.0 through 19.2.0 contain a pre-authentication remote code execution vulnerability in the react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack packages. The vulnerability stems from unsafe deserialization of payloads received at Server Function HTTP endpoints, allowing attackers to execute arbitrary code without authentication.
Mitigation
Immediately update React Server Components packages to the latest patched version once available, or downgrade to a stable version if a patch is not yet released. Implement network-level restrictions on Server Function endpoints as a temporary measure until the update is applied.