The CVSS 10.0 React bug: one request, code execution on your server
A flaw in how React Server Components decode payloads earned a perfect 10.0 — unauthenticated remote code execution. Here is who is affected, how to check, and what to do about it.
On December 3, 2025, the React team disclosed a perfect-score vulnerability: CVE-2025-55182, CVSS 10.0, unauthenticated remote code execution. The bug was not in rendering — it was in how React Server Components decode request payloads.
If your app has no server at all, you are not affected. If it runs Next.js, React Router, Waku or anything else with RSC support, treat this as a production incident.
Who is affected
Three runtime packages are involved:
| Package | Affected | Fixed |
|---|---|---|
| react-server-dom-webpack | 19.0 / 19.1.0 / 19.1.1 / 19.2.0 | 19.0.1 / 19.1.2 / 19.2.1 |
| react-server-dom-parcel | same | same |
| react-server-dom-turbopack | same | same |
Affected frameworks and bundlers include next, react-router, waku, @parcel/rsc, @vitejs/plugin-rsc and rwsdk. Even if you never wrote a React Server Function endpoint yourself, you may still be vulnerable as long as the app supports RSC, because the flaw sits in the shared decoding path.
Why 10.0
A React Server Function call works like this: the client encodes arguments, sends them to the server, the server decodes and executes. The decoder must accept arbitrary structures. Once an attacker can shape that structure into code execution, no account and no interaction are required — a single HTTP request is enough.
The perfect score is not hype: no authentication, no user click, every app exposing an RSC endpoint is in scope, and exploitation is straightforward.
What to do now
- Check versions. Search your lockfile for react-server-dom-webpack, react-server-dom-parcel and react-server-dom-turbopack and compare against the table;
- Upgrade. Follow your framework’s patched release to the 19.0.1 / 19.1.2 / 19.2.1 equivalents;
- Look for exploitation. Unusual requests to RSC endpoints, unexpected child processes and outbound connections deserve a log review;
- Confirm hosting mitigations. Several platforms shipped temporary blocks on disclosure day. That buys time, it is not a fix.
The structural lesson
This is the same family as the deserialization RCEs of the last decade: the server accepts structured input and acts on it, so the decoder is the attack surface. RSC moved that surface into the default stack of frontend frameworks — plenty of teams installed Next.js without realising they had also installed a server-side execution entry point.
Beyond patching, two habits help: treat RSC endpoints as an exposed execution surface and monitor them accordingly, and make dependency upgrades something you can ship within an hour rather than at the next release.
The judgement
The fix is cheap — three version numbers. The cost of waiting is high — a day late may mean already scanned. What is worth remembering is the location: the bug was not in the components you wrote, but in the layer where the framework decodes requests for you.
Cover image: React blog (react.dev).
Comments
…