Critical Security Vulnerability in React Server Components ![rw-book-cover](https://react.dev/images/og-blog.png) ## Metadata - Author: [[react.dev]] - Full Title: Critical Security Vulnerability in React Server Components - Category: #articles - Document Note: tags: [security, react, vulnerability] author: react.dev source: react.dev reference: [https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components] date created: 2025-12-08 10:00 --- # 🏷️ Title: Critical Security Vulnerability in React Server Components ## 🧭 Table of Contents - [📝 Summary](#-summary) - [📖 Main Content](#-main-content) - [🗒️ Notes](#️-notes) - [📚 References](#-references) - [🗣️ Paraphrase](#️-paraphrase) - [📰 Newsletter](#-newsletter) - [✅ Action Items](#-action-items) - [🧪 Hypotheses](#-hypotheses) - [📊 Methodology](#-methodology) - [❓ Questions](#-questions) - [🔮 Future Research](#-future-research) - [💡 Implications](#-implications) - [🧠 Learning Styles Assessment](#-learning-styles-assessment) - [📊 Accessibility Assessment](#-accessibility-assessment) - [🌍 DEIB Assessment](#-deib-assessment) - [✅ Logical Validity](#-logical-validity) - [🛡️ DARVO Analysis](#-darvo-analysis) - [🎯 Conclusion](#-conclusion) ### 🔗 References - Official React blog post announcing CVE-2025-55182. - CVE database entry for CVE-2025-55182 (when available). - Documentation for React Server Components and Server Functions. - Security advisories from affected frameworks (Next.js, React Router, etc.). ## 📝 Summary - What happened: A critical remote code execution (RCE) vulnerability (CVE-2025-55182, CVSS 10.0) was found in React’s Server Components / Server Functions pipeline, affecting React 19.0, 19.1.0, 19.1.1, and 19.2.0. - Why it matters: An unauthenticated attacker can craft HTTP requests to Server Function endpoints that deserialize into arbitrary code execution on the server. - Key stakeholders: Teams using React Server Components or Server Functions; framework maintainers (Next.js, React Router, Waku, Parcel RSC, Vite RSC, rwsdk); hosting providers; end users whose data may be exposed. - Risks and tradeoffs: Immediate upgrade pressure; potential downtime for emergency patches; compatibility testing with 19.0.1/19.1.2/19.2.1; risk of exploit if systems remain unpatched. - Bottom line: If you use React with a server that supports React Server Components or Server Functions in the affected versions, you must upgrade to 19.0.1, 19.1.2, or 19.2.1 immediately or temporarily disable RSC/Server Functions. ## 📖 Main Content - Core arguments: - A flaw in how React decodes payloads for Server Functions lets an attacker send specially crafted HTTP requests that deserialize into executable code on the server, leading to unauthenticated RCE. - Even apps that do not explicitly define Server Function endpoints may be exposed if they support React Server Components through a framework or bundler. - The issue is confirmed in React 19.0, 19.1.0, 19.1.1, and 19.2.0; fixed in 19.0.1, 19.1.2, and 19.2.1. - Several popular frameworks/bundlers are impacted because they integrate React Server Components / Functions. - Context & definitions: - React Server Components (RSC): let components run on the server, streaming serialized output to the client. - React Server Functions: a mechanism where the client calls server-side functions over HTTP, with React handling serialization/deserialization. - RCE (Remote Code Execution): an attacker can execute arbitrary code on a remote machine, often leading to full compromise. - CVSS 10.0: the highest severity, indicating easy exploitation and severe impact (confidentiality, integrity, availability). - Uncertainties: - Exact technical details of the exploit chain are intentionally withheld until fixes are widely deployed. - Impact on older React versions (pre-19) is not discussed; the advisory focuses on 19.x where RSC is standard. - Real-world exploitation “in the wild” is not addressed in the text; focus is on mitigation. ### 🗒️ Notes - “On November 29th, Lachlan Davidson reported a security vulnerability in React that allows unauthenticated remote code execution by exploiting a flaw in how React decodes payloads sent to React Server Function endpoints.” - Initial report from external security researcher; vulnerability is in deserialization of Server Function payloads. - “Even if your app does not implement any React Server Function endpoints it may still be vulnerable if your app supports React Server Components.” - RSC support alone can expose you, via framework-level wiring. - “This vulnerability was disclosed as CVE-2025-55182 and is rated CVSS 10.0.” - Highest possible severity; treat as an emergency patch. - Affected React versions: - 19.0 - 19.1.0 - 19.1.1 - 19.2.0 - Fixed React versions: - “A fix was introduced in versions 19.0.1, 19.1.2, and 19.2.1. If you are using any of the above packages please upgrade to any of the fixed versions immediately.” - Scope exclusions: - “If your app’s React code does not use a server, your app is not affected by this vulnerability.” - “If your app does not use a framework, bundler, or bundler plugin that supports React Server Components, your app is not affected by this vulnerability.” - Affected frameworks and bundlers: - “The following React frameworks & bundlers are affected: next, react-router, waku, @parcel/rsc, @vitejs/plugin-rsc, and rwsdk.” - They plan to update the advisory with per-framework upgrade instructions. - Vulnerability behavior: - “React translates requests on the client into HTTP requests which are forwarded to a server. On the server, React translates the HTTP request into a function call and returns the needed data to the client.” - The attack abuses this translation layer, so malicious HTTP payloads get deserialized in a way that enables code execution. - “An unauthenticated attacker could craft a malicious HTTP request to any Server Function endpoint that, when deserialized by React, achieves remote code execution on the server.” - Timeline: - November 29: Vulnerability reported by Lachlan Davidson. - November 30: “Meta security researchers confirmed and began working with the React team on a fix.” - December 1: Fix created; React team coordinates with hosting providers and open source projects to validate and roll out mitigations. - December 3: Fix published to npm and public disclosure as CVE-2025-55182. ## 📚 References - Critical Security Vulnerability in React Server Components (React blog). - React Server Components documentation. - React 19 release notes and changelogs. - Security advisories from: Next.js, React Router, Waku, Parcel RSC plugin, Vite RSC plugin, rwsdk (as they appear). - CVE entry for CVE-2025-55182 in NVD/MITRE. ## 🗣️ Paraphrase - Paragraph A paraphrase: A researcher discovered a bug in React’s server-side payload decoding for Server Functions that lets unauthenticated attackers send malicious HTTP requests and run code on the server, affecting apps that support Server Components, with severity tracked as CVE-2025-55182. - Paragraph B paraphrase: React 19.0, 19.1.0, 19.1.1, and 19.2.0 are vulnerable; patched releases 19.0.1, 19.1.2, and 19.2.1 are available and must be installed immediately, especially for projects using frameworks or bundlers that enable React Server Components. ## 📰 Newsletter React just disclosed a critical CVSS 10.0 RCE in Server Components / Server Functions (CVE-2025-55182), with fixes in 19.0.1, 19.1.2, and 19.2.1. If you’re running React-based WordPress headless frontends (Next.js, React Router, Vite RSC, etc.), prioritize upgrades and security reviews of your RSC configuration. Pair this with hardening your WP REST API, reviewing auth flows, and checking SBOMs for vulnerable React versions before your next deployment. ## ✅ Action Items #### DevRel - Publish clear upgrade guides for React Server Components users, including sample diffs and rollback plans. - Offer short workshops or office hours on safely adopting RSC and server-side deserialization patterns. - Update example apps, SDKs, and quickstarts to fixed React versions and highlight secure RSC usage. - Coordinate a comms campaign (blog, social, talks) emphasizing the risk and mitigation steps. - Engage framework communities (Next.js, React Router, etc.) to collect feedback and clarify edge cases. #### OSPO - Require projects using - Summary: The library for web and native user interfaces - URL: https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components On November 29th, Lachlan Davidson reported a security vulnerability in React that allows unauthenticated remote code execution by exploiting a flaw in how React decodes payloads sent to React Server Function endpoints. Even if your app does not implement any React Server Function endpoints it may still be vulnerable if your app supports React Server Components. This vulnerability was disclosed as [CVE-2025-55182](https://www.cve.org/CVERecord?id=CVE-2025-55182) and is rated CVSS 10.0. The vulnerability is present in versions 19.0, 19.1.0, 19.1.1, and 19.2.0 of: #### Immediate Action Required A fix was introduced in versions [19.0.1](https://github.com/facebook/react/releases/tag/v19.0.1), [19.1.2](https://github.com/facebook/react/releases/tag/v19.1.2), and [19.2.1](https://github.com/facebook/react/releases/tag/v19.2.1). If you are using any of the above packages please upgrade to any of the fixed versions immediately. If your app’s React code does not use a server, your app is not affected by this vulnerability. If your app does not use a framework, bundler, or bundler plugin that supports React Server Components, your app is not affected by this vulnerability. ##### Affected frameworks and bundlers Some React frameworks and bundlers depended on, had peer dependencies for, or included the vulnerable React packages. The following React frameworks & bundlers are affected: [next](https://www.npmjs.com/package/next), [react-router](https://www.npmjs.com/package/react-router), [waku](https://www.npmjs.com/package/waku), [@parcel/rsc](https://www.npmjs.com/package/@parcel/rsc), [@vitejs/plugin-rsc](https://www.npmjs.com/package/@vitejs/plugin-rsc), and [rwsdk](https://www.npmjs.com/package/rwsdk). We will update this post with upgrade instructions on how to upgrade as they become available. ##### Vulnerability overview [React Server Functions](https://react.dev/reference/rsc/server-functions) allow a client to call a function on a server. React provides integration points and tools that frameworks and bundlers use to help React code run on both the client and the server. React translates requests on the client into HTTP requests which are forwarded to a server. On the server, React translates the HTTP request into a function call and returns the needed data to the client. An unauthenticated attacker could craft a malicious HTTP request to any Server Function endpoint that, when deserialized by React, achieves remote code execution on the server. Further details of the vulnerability will be provided after the rollout of the fix is complete. ##### Timeline * **November 30th**: Meta security researchers confirmed and began working with the React team on a fix. * **December 1st**: A fix was created and the React team began working with affected hosting providers and open source projects to validate the fix, implement mitigations and roll out the fix * **December 3rd**: The fix was published to npm and the publicly disclosed as CVE-2025-55182. ##### Attribution Thank you to [Lachlan Davidson](https://github.com/lachlan2k) for discovering, reporting, and working to help fix this vulnerability., Critical Security Vulnerability in React Server Components, react.dev, 01kbk5nfgw5a6ma6tcjewn55g2.