{"history":[{"alert":0,"cve":"CVE-2025-55182","id":22938,"kind":"epss","observed_at":1794500401,"payload":"{\"date\": \"2026-11-12\", \"epss\": 0.99731, \"percentile\": 0.99953}"},{"alert":0,"cve":"CVE-2025-55182","id":20558,"kind":"epss","observed_at":1794327601,"payload":"{\"date\": \"2026-11-10\", \"epss\": 0.99731, \"percentile\": 0.99953}"},{"alert":0,"cve":"CVE-2025-55182","id":18526,"kind":"epss","observed_at":1794241201,"payload":"{\"date\": \"2026-11-09\", \"epss\": 0.99731, \"percentile\": 0.99953}"},{"alert":0,"cve":"CVE-2025-55182","id":16591,"kind":"epss","observed_at":1794154800,"payload":"{\"date\": \"2026-11-08\", \"epss\": 0.99731, \"percentile\": 0.99952}"},{"alert":0,"cve":"CVE-2025-55182","id":14569,"kind":"epss","observed_at":1794068402,"payload":"{\"date\": \"2026-11-07\", \"epss\": 0.99731, \"percentile\": 0.99953}"},{"alert":0,"cve":"CVE-2025-55182","id":12351,"kind":"epss","observed_at":1793982001,"payload":"{\"date\": \"2026-11-06\", \"epss\": 0.99731, \"percentile\": 0.99953}"},{"alert":0,"cve":"CVE-2025-55182","id":10337,"kind":"epss","observed_at":1793938800,"payload":"{\"date\": \"2026-11-05\", \"epss\": 0.99731, \"percentile\": 0.99953}"},{"alert":0,"cve":"CVE-2025-55182","id":7886,"kind":"epss","observed_at":1793809200,"payload":"{\"date\": \"2026-11-04\", \"epss\": 0.99731, \"percentile\": 0.99953}"},{"alert":0,"cve":"CVE-2025-55182","id":5663,"kind":"epss","observed_at":1793722800,"payload":"{\"date\": \"2026-11-03\", \"epss\": 0.99731, \"percentile\": 0.99953}"},{"alert":1,"cve":"CVE-2025-55182","id":3971,"kind":"cna","observed_at":1793722800,"payload":"{\"containers\": {\"adp\": [{\"metrics\": [{\"other\": {\"content\": {\"id\": \"CVE-2025-55182\", \"options\": [{\"Exploitation\": \"active\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"role\": \"CISA Coordinator\", \"timestamp\": \"2026-08-04T03:56:02.696515Z\", \"version\": \"2.0.3\"}, \"type\": \"ssvc\"}}, {\"other\": {\"content\": {\"dateAdded\": \"2025-12-05\", \"reference\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-55182\"}, \"type\": \"kev\"}}], \"problemTypes\": [{\"descriptions\": [{\"cweId\": \"CWE-502\", \"description\": \"CWE-502 Deserialization of Untrusted Data\", \"lang\": \"en\", \"type\": \"CWE\"}]}], \"providerMetadata\": {\"dateUpdated\": \"2026-10-07T17:58:00.859Z\", \"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\"}, \"references\": [{\"tags\": [\"media-coverage\"], \"url\": \"https://aws.amazon.com/blogs/security/china-nexus-cyber-threat-groups-rapidly-exploit-react2shell-vulnerability-cve-2025-55182/\"}, {\"tags\": [\"government-resource\"], \"url\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-55182\"}], \"title\": \"CISA ADP Vulnrichment\"}, {\"providerMetadata\": {\"dateUpdated\": \"2025-12-04T17:32:12.884Z\", \"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\"}, \"references\": [{\"url\": \"http://www.openwall.com/lists/oss-security/2025/12/03/4\"}, {\"url\": \"https://news.ycombinator.com/item?id=46136026\"}], \"title\": \"CVE Program Container\", \"x_generator\": {\"engine\": \"ADPogram 0.0.1\"}}], \"cna\": {\"affected\": [{\"defaultStatus\": \"unaffected\", \"product\": \"react-server-dom-webpack\", \"vendor\": \"Meta\", \"versions\": [{\"lessThanOrEqual\": \"19.0.0\", \"status\": \"affected\", \"version\": \"19.0.0\", \"versionType\": \"semver\"}, {\"lessThanOrEqual\": \"19.1.1\", \"status\": \"affected\", \"version\": \"19.1.0\", \"versionType\": \"semver\"}, {\"lessThanOrEqual\": \"19.2.0\", \"status\": \"affected\", \"version\": \"19.2.0\", \"versionType\": \"semver\"}]}, {\"defaultStatus\": \"unaffected\", \"product\": \"react-server-dom-turbopack\", \"vendor\": \"Meta\", \"versions\": [{\"lessThanOrEqual\": \"19.0.0\", \"status\": \"affected\", \"version\": \"19.0.0\", \"versionType\": \"semver\"}, {\"lessThanOrEqual\": \"19.1.1\", \"status\": \"affected\", \"version\": \"19.1.0\", \"versionType\": \"semver\"}, {\"lessThanOrEqual\": \"19.2.0\", \"status\": \"affected\", \"version\": \"19.2.0\", \"versionType\": \"semver\"}]}, {\"defaultStatus\": \"unaffected\", \"product\": \"react-server-dom-parcel\", \"vendor\": \"Meta\", \"versions\": [{\"lessThanOrEqual\": \"19.0.0\", \"status\": \"affected\", \"version\": \"19.0.0\", \"versionType\": \"semver\"}, {\"lessThanOrEqual\": \"19.1.1\", \"status\": \"affected\", \"version\": \"19.1.0\", \"versionType\": \"semver\"}, {\"lessThanOrEqual\": \"19.2.0\", \"status\": \"affected\", \"version\": \"19.2.0\", \"versionType\": \"semver\"}]}], \"dateAssigned\": \"2025-12-02T00:00:00.000Z\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.\"}], \"metrics\": [{\"cvssV3_1\": {\"baseScore\": 10, \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\", \"version\": \"3.1\"}, \"format\": \"CVSS\", \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"problemTypes\": [{\"descriptions\": [{\"description\": \"Deserialization of Untrusted Data (CWE-502)\", \"lang\": \"en\"}]}], \"providerMetadata\": {\"dateUpdated\": \"2025-12-11T20:15:37.699Z\", \"orgId\": \"4fc57720-52fe-4431-a0fb-3d2c8747b827\", \"shortName\": \"Meta\"}, \"references\": [{\"tags\": [\"x_refsource_CONFIRM\"], \"url\": \"https://www.facebook.com/security/advisories/cve-2025-55182\"}, {\"tags\": [\"x_refsource_CONFIRM\"], \"url\": \"https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components\"}]}}, \"cveMetadata\": {\"assignerOrgId\": \"4fc57720-52fe-4431-a0fb-3d2c8747b827\", \"assignerShortName\": \"Meta\", \"cveId\": \"CVE-2025-55182\", \"datePublished\": \"2025-12-03T15:40:56.894Z\", \"dateReserved\": \"2025-08-08T18:21:47.119Z\", \"dateUpdated\": \"2026-10-07T17:58:00.859Z\", \"state\": \"PUBLISHED\"}, \"dataType\": \"CVE_RECORD\", \"dataVersion\": \"5.2\"}"},{"alert":0,"cve":"CVE-2025-55182","id":3445,"kind":"epss","observed_at":1793665375,"payload":"{\"date\": \"2026-11-02\", \"epss\": 0.99802, \"percentile\": 0.99958}"},{"alert":1,"cve":"CVE-2025-55182","id":299,"kind":"kev","observed_at":1793665375,"payload":"{\"cveID\": \"CVE-2025-55182\", \"cwes\": [], \"dateAdded\": \"2025-12-05\", \"dueDate\": \"2025-12-12\", \"forensicTriage\": \"No\", \"knownRansomwareCampaignUse\": \"Known\", \"notes\": \"Check for signs of potential compromise on all internet accessible REACT instances after applying mitigations. For more information, please see: https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components ; https://github.com/vercel-labs/fix-react2shell-next?tab=readme-ov-file ; https://nvd.nist.gov/vuln/detail/CVE-2025-55182\", \"product\": \"React Server Components\", \"requiredAction\": \"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.\", \"shortDescription\": \"Meta React Server Components contains a remote code execution vulnerability that could allow unauthenticated remote code execution by exploiting a flaw in how React decodes payloads sent to React Server Function endpoints. Please note CVE-2025-66478 has been rejected, but it is associated with CVE-2025- 55182.\", \"vendorProject\": \"Meta\", \"vulnerabilityName\": \"Meta React Server Components Remote Code Execution Vulnerability\"}"}],"record":{"affected":[{"defaultStatus":"unaffected","product":"react-server-dom-webpack","vendor":"Meta","versions":[{"lessThanOrEqual":"19.0.0","status":"affected","version":"19.0.0","versionType":"semver"},{"lessThanOrEqual":"19.1.1","status":"affected","version":"19.1.0","versionType":"semver"},{"lessThanOrEqual":"19.2.0","status":"affected","version":"19.2.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"react-server-dom-turbopack","vendor":"Meta","versions":[{"lessThanOrEqual":"19.0.0","status":"affected","version":"19.0.0","versionType":"semver"},{"lessThanOrEqual":"19.1.1","status":"affected","version":"19.1.0","versionType":"semver"},{"lessThanOrEqual":"19.2.0","status":"affected","version":"19.2.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"react-server-dom-parcel","vendor":"Meta","versions":[{"lessThanOrEqual":"19.0.0","status":"affected","version":"19.0.0","versionType":"semver"},{"lessThanOrEqual":"19.1.1","status":"affected","version":"19.1.0","versionType":"semver"},{"lessThanOrEqual":"19.2.0","status":"affected","version":"19.2.0","versionType":"semver"}]}],"cna":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2025-55182","options":[{"Exploitation":"active"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","timestamp":"2026-08-04T03:56:02.696515Z","version":"2.0.3"},"type":"ssvc"}},{"other":{"content":{"dateAdded":"2025-12-05","reference":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-55182"},"type":"kev"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-502","description":"CWE-502 Deserialization of Untrusted Data","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-10-07T17:58:00.859Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"references":[{"tags":["media-coverage"],"url":"https://aws.amazon.com/blogs/security/china-nexus-cyber-threat-groups-rapidly-exploit-react2shell-vulnerability-cve-2025-55182/"},{"tags":["government-resource"],"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-55182"}],"title":"CISA ADP Vulnrichment"},{"providerMetadata":{"dateUpdated":"2025-12-04T17:32:12.884Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"url":"http://www.openwall.com/lists/oss-security/2025/12/03/4"},{"url":"https://news.ycombinator.com/item?id=46136026"}],"title":"CVE Program Container","x_generator":{"engine":"ADPogram 0.0.1"}}],"cna":{"affected":[{"defaultStatus":"unaffected","product":"react-server-dom-webpack","vendor":"Meta","versions":[{"lessThanOrEqual":"19.0.0","status":"affected","version":"19.0.0","versionType":"semver"},{"lessThanOrEqual":"19.1.1","status":"affected","version":"19.1.0","versionType":"semver"},{"lessThanOrEqual":"19.2.0","status":"affected","version":"19.2.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"react-server-dom-turbopack","vendor":"Meta","versions":[{"lessThanOrEqual":"19.0.0","status":"affected","version":"19.0.0","versionType":"semver"},{"lessThanOrEqual":"19.1.1","status":"affected","version":"19.1.0","versionType":"semver"},{"lessThanOrEqual":"19.2.0","status":"affected","version":"19.2.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"react-server-dom-parcel","vendor":"Meta","versions":[{"lessThanOrEqual":"19.0.0","status":"affected","version":"19.0.0","versionType":"semver"},{"lessThanOrEqual":"19.1.1","status":"affected","version":"19.1.0","versionType":"semver"},{"lessThanOrEqual":"19.2.0","status":"affected","version":"19.2.0","versionType":"semver"}]}],"dateAssigned":"2025-12-02T00:00:00.000Z","descriptions":[{"lang":"en","value":"A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints."}],"metrics":[{"cvssV3_1":{"baseScore":10,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"description":"Deserialization of Untrusted Data (CWE-502)","lang":"en"}]}],"providerMetadata":{"dateUpdated":"2025-12-11T20:15:37.699Z","orgId":"4fc57720-52fe-4431-a0fb-3d2c8747b827","shortName":"Meta"},"references":[{"tags":["x_refsource_CONFIRM"],"url":"https://www.facebook.com/security/advisories/cve-2025-55182"},{"tags":["x_refsource_CONFIRM"],"url":"https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components"}]}},"cveMetadata":{"assignerOrgId":"4fc57720-52fe-4431-a0fb-3d2c8747b827","assignerShortName":"Meta","cveId":"CVE-2025-55182","datePublished":"2025-12-03T15:40:56.894Z","dateReserved":"2025-08-08T18:21:47.119Z","dateUpdated":"2026-10-07T17:58:00.859Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"cna_checked":1794457201,"cve":"CVE-2025-55182","description":"A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.","epss":{"date":"2026-11-12","epss":0.99731,"percentile":0.99953},"epss_checked":1794522003,"first_seen":1793665375,"kev":{"cveID":"CVE-2025-55182","cwes":[],"dateAdded":"2025-12-05","dueDate":"2025-12-12","forensicTriage":"No","knownRansomwareCampaignUse":"Known","notes":"Check for signs of potential compromise on all internet accessible REACT instances after applying mitigations. For more information, please see: https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components ; https://github.com/vercel-labs/fix-react2shell-next?tab=readme-ov-file ; https://nvd.nist.gov/vuln/detail/CVE-2025-55182","product":"React Server Components","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","shortDescription":"Meta React Server Components contains a remote code execution vulnerability that could allow unauthenticated remote code execution by exploiting a flaw in how React decodes payloads sent to React Server Function endpoints. Please note CVE-2025-66478 has been rejected, but it is associated with CVE-2025- 55182.","vendorProject":"Meta","vulnerabilityName":"Meta React Server Components Remote Code Execution Vulnerability"},"kev_checked":1794522003,"products":"Meta react-server-dom-webpack, Meta react-server-dom-turbopack, Meta react-server-dom-parcel","references":["https://www.facebook.com/security/advisories/cve-2025-55182","https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components","https://aws.amazon.com/blogs/security/china-nexus-cyber-threat-groups-rapidly-exploit-react2shell-vulnerability-cve-2025-55182/","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-55182","http://www.openwall.com/lists/oss-security/2025/12/03/4","https://news.ycombinator.com/item?id=46136026"],"score":{"baseScore":10,"baseSeverity":"CRITICAL","provider":"Meta","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"solutions":"","state":"PUBLISHED","title":"Meta React Server Components Remote Code Execution Vulnerability","updated_at":1794500401,"workarounds":""},"sources":[{"canonical_url":"https://www.blackfog.com/how-teampcp-turned-developer-tools-into-a-route-for-data-theft/","id":238,"publisher":"BlackFog","title":"How TeamPCP Turned Developer Tools Into a Route for Data Theft - BlackFog"}]}