Critical React Server Vulnerability Exposes Servers to Remote Code Execution: Patch Immediately

Security experts are sounding the alarm following the discovery of a maximum-severity vulnerability in the React Server framework, a popular open-source JavaScript library widely used in web and cloud-based applications. The vulnerability, tracked as CVE-2025-55182, allows attackers to execute arbitrary, malicious code on servers running vulnerable versions of React, with no authentication required. Researchers are urging developers and system administrators to patch affected systems immediately.

What Is the React Vulnerability?

The flaw, identified in React Server Components, affects several versions of the React framework, including 19.0.1, 19.1.2, and 19.2.1. These versions contain an unsafe deserialization vulnerability in the Flight protocol, which is integral to React’s functionality. Deserialization is the process of converting data, such as strings or byte streams, into usable objects in code. If the deserialization is not handled securely, an attacker can inject malicious code that is executed on the server, giving them full control.

In practical terms, exploiting this vulnerability requires only a single HTTP request containing a specially crafted payload. As a result, the flaw poses a critical risk, allowing attackers to remotely execute privileged JavaScript code on the server with almost 100% success rate in testing, according to security firm Wiz.

The Widespread Impact of React

React is embedded in a wide range of web applications and cloud environments, making it one of the most commonly used front-end frameworks in the world. It speeds up website performance by only re-rendering parts of the page that have changed, rather than reloading the entire page. This efficiency is why approximately 6% of all websites and 39% of cloud environments rely on React for faster content delivery.

However, this widespread usage also amplifies the risk posed by the vulnerability. Even systems that don’t explicitly use React’s functionality may still be vulnerable, as other frameworks and plugins like Next.js, RedwoodSDK, and Vite RSC plugin integrate React components by default.

Exploitation and Severity Rating

The vulnerability’s severity has been rated 10/10, the highest possible rating, by security experts due to its ease of exploitation and the potential for devastating attacks. Attackers do not need to be authenticated or have direct access to the server; a single malformed HTTP request is enough to trigger the exploit.

In response to the threat, security defenders and software engineers have urged swift action. One researcher famously commented on social media: “I usually don’t say this, but patch right freakin’ now,” highlighting the urgency of applying the fix.

Affected Versions and Components

Versions of React between 19.0.1 and 19.2.1 are directly affected by the vulnerability, but it also extends to any third-party components or plugins that rely on the vulnerable React codebase. A list of popular frameworks and libraries that may be impacted includes:

• Next.js
• Vite RSC plugin
• Parcel RSC plugin
• React Router RSC preview
• RedwoodSDK
• Waku

Each of these tools embeds React components and could be vulnerable if using a vulnerable version. Developers using these frameworks are advised to check for updates and apply patches without delay.

How Does the Exploit Work?

The vulnerability arises from unsafe deserialization, where the server fails to properly validate incoming data before processing it. This flaw allows attackers to send a malformed payload that manipulates the server’s logic, leading to the execution of arbitrary code. Since this attack vector requires no authentication, it is especially dangerous for remote servers accessible over the internet.

Once the malicious payload is executed, attackers can take full control of the server, posing a significant security risk to any system relying on these versions of React. Researchers emphasized that this vulnerability can be triggered remotely, making it a prime target for cybercriminals seeking to exploit it.

Steps to Protect Your Servers

Security experts recommend immediate action to mitigate the risk posed by the vulnerability. Here’s what you need to do:

1. Update React: Ensure you are running the latest patched version of React. Developers should upgrade to versions that have fixed the deserialization issue and applied stricter validation checks.
2. Check Third-Party Plugins: Review and update any third-party frameworks or plugins that rely on React, including those in your tech stack like Next.js or Vite. For example, Next.js has assigned its own tracking ID CVE-2025-66478 for the vulnerability.
3. Test and Scan: Use vulnerability scanning tools to detect any instances of the exploit in your codebase. Developers can also manually check for any vulnerable React versions used in their applications and repositories.
4. Monitor Security Patches: Stay updated on security advisories for both React and any other affected tools. Regular patching and monitoring are crucial in keeping your systems secure.

Conclusion

The React CVE-2025-55182 vulnerability represents a serious and widespread threat to servers running affected versions of the React framework. With the ease of exploitation and the potential for remote code execution, it is crucial that developers and administrators take immediate action to apply patches and secure their systems. As security researchers continue to analyze this vulnerability, the best course of action is to stay proactive, update affected software, and remain vigilant against potential exploits.

For further information on patching and securing your React components, check with the official React documentation or security advisories from your frameworks’ maintainers.