Critical React Vulnerability (CVE-2025-55182) Enables Remote Code Execution in React 19 and Next.js
By
gonepivoting
Fresh out the oven, still warm. Top of the tray.
Summary
A critical security vulnerability (CVE-2025-55182) has been discovered in React Server Components' 'Flight' protocol, affecting React 19 and Next.js frameworks. The flaw enables unauthenticated remote code execution (RCE) on servers through insecure deserialization in default configurations, putting standard deployments at immediate risk. Due to high severity and ease of exploitation, organizations are urged to patch immediately as the vulnerability is being actively exploited in the wild.
Key quotes
· 5 pulledA critical vulnerability has been identified in the React Server Components (RSC) 'Flight' protocol, affecting the React 19 ecosystem and frameworks that implement it, most notably Next.js.
Assigned CVE-2025-55182, this flaw allows for unauthenticated remote code execution (RCE) on the server due to insecure deserialization.
The vulnerability exists in the default configuration of affected applications, meaning standard deployments are immediately at risk.
Due to the high severity and the ease of exploitation, immediate patching is required.
Detect and mitigate React2Shell (CVE-2025-55182), critical RCE vulnerability in React and Next.js exploited in the wild.
You might also wanna read
VS Code Remote-SSH Vulnerability Enables Lateral Movement from Developer Machines to Cloud Servers
A critical vulnerability in Visual Studio Code's Remote-SSH extension creates a post-compromise attack path enabling threat actors to pivot
cybersecuritynews.com·2d ago
Microsoft patches high-severity SharePoint RCE vulnerability CVE-2026-45659
Microsoft has patched a high-severity remote code execution vulnerability (CVE-2026-45659) in SharePoint that affects SharePoint Server Subs
helpnetsecurity.com·4d ago
Microsoft releases critical security patch for SharePoint deserialization vulnerability
Microsoft has released May updates for SharePoint servers that patch a highly critical security vulnerability (CVE-2026-45659, CVSS 8.8). Th
heise.de·3d ago