{"basis":"claimed","id":"CVE-2025-55182","name":"Meta React Server Components Remote Code Execution Vulnerability","vendorProject":"Meta","product":"React Server Components","publishedAt":"2025-12-03","cvss":{"score":10,"severity":"CRITICAL","version":"3.1"},"exploited":{"kevAdded":"2025-12-05","dueDate":"2025-12-12","ransomware":true},"epss":{"score":0.99802,"percentile":0.99958,"date":"2026-11-02"},"coverage":{"cloudflare":{"status":"blocks","firstOn":"2025-12-03","daysToRule":null},"aws":{"status":"none","firstOn":null,"daysToRule":null},"azure":{"status":"rule","firstOn":null,"daysToRule":null},"google":{"status":"rule","firstOn":"2025-12-03","daysToRule":0},"fastly":{"status":"no_history","firstOn":null,"daysToRule":null},"f5":{"status":"rule","firstOn":"2025-12-04","daysToRule":1},"akamai":{"status":"no_source","firstOn":null,"daysToRule":null},"crs":{"status":"rule","firstOn":"2026-01-05","daysToRule":33}},"title":null,"description":"A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.","cwes":[],"vendors":[{"vendor":"cloudflare","status":"blocks","basis":"claimed","firstOn":"2025-12-03","firstIsNew":false,"daysToRule":null,"daysAtMost":0,"freePlan":true,"claims":[{"id":"ddd9937b3895a85d46d0f7c77456a4d9b48f120d74083e4b11ca54484d288f12","cve_id":"CVE-2025-55182","vendor":"cloudflare","product":"Cloudflare Managed Ruleset","rule_id":"33aa8a8a948b48b28d40450c5fb92fba","rule_name":"React - RCE - CVE:CVE-2025-55182","change":"updated","default_action":"Block","published_on":"2025-12-03","source_url":"https://developers.cloudflare.com/changelog/post/2025-12-03-emergency-waf-release/","source_title":"WAF Release - 2025-12-03 - Emergency","excerpt":"React - RCE - CVE:CVE-2025-55182. Previous action: N/A. New action: Block. Rule metadata description changed. Detection unchanged.","first_seen_at":"2026-11-02T21:00:15.584Z"},{"id":"a63123335ce7d78cd714ecca7678a0916b999a717e255af9878efd5d776339f9","cve_id":"CVE-2025-55182","vendor":"cloudflare","product":"Cloudflare Free Ruleset","rule_id":"2b5d06e34a814a889bee9a0699702280","rule_name":"React - RCE - CVE:CVE-2025-55182","change":"updated","default_action":"Block","published_on":"2025-12-03","source_url":"https://developers.cloudflare.com/changelog/post/2025-12-03-emergency-waf-release/","source_title":"WAF Release - 2025-12-03 - Emergency","excerpt":"React - RCE - CVE:CVE-2025-55182. Previous action: N/A. New action: Block. Rule metadata description changed. Detection unchanged.","first_seen_at":"2026-11-02T21:00:15.584Z"},{"id":"86d9824ffb38c95663223b7318c3b7afa9950b1243226708d2814331439796ca","cve_id":"CVE-2025-55182","vendor":"cloudflare","product":"Cloudflare Managed Ruleset","rule_id":"bc1aee59731c488ca8b5314615fce168","rule_name":"React - Remote Code Execution - CVE:CVE-2025-55182 - 2","change":"updated","default_action":"Block","published_on":"2025-12-10","source_url":"https://developers.cloudflare.com/changelog/post/2025-12-10-emergency-waf-release/","source_title":"WAF Release - 2025-12-10 - Emergency","excerpt":"React - Remote Code Execution - CVE:CVE-2025-55182 - 2. Previous action: N/A. New action: Block. This is an improved detection.","first_seen_at":"2026-11-02T21:00:15.584Z"},{"id":"bf9bd95b8871d0d07a6893960a2833689ac9cfdbbd1c2f78f468bb5803da29bc","cve_id":"CVE-2025-55182","vendor":"cloudflare","product":"Cloudflare Free Ruleset","rule_id":"cbdd3f48396e4b7389d6efd174746aff","rule_name":"React - Remote Code Execution - CVE:CVE-2025-55182 - 2","change":"updated","default_action":"Block","published_on":"2025-12-10","source_url":"https://developers.cloudflare.com/changelog/post/2025-12-10-emergency-waf-release/","source_title":"WAF Release - 2025-12-10 - Emergency","excerpt":"React - Remote Code Execution - CVE:CVE-2025-55182 - 2. Previous action: N/A. New action: Block. This is an improved detection.","first_seen_at":"2026-11-02T21:00:15.584Z"}]},{"vendor":"aws","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"azure","status":"rule","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[{"id":"df0f869756b3e09ee5bb39425969ea12fe790cf4efdc03f549e063bfb7aabbce","cve_id":"CVE-2025-55182","vendor":"azure","product":"Application Gateway WAF (DRS/CRS)","rule_id":"99001018","rule_name":"Attempted React2Shell remote code execution exploitation CVE-2025-55182","change":"listed","default_action":null,"published_on":null,"source_url":"https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/application-gateway-crs-rulegroups-rules","source_title":"Application Gateway WAF (DRS/CRS) rule groups and rules","excerpt":"Rule 99001018: Critical - 5 · 1 · Attempted React2Shell remote code execution exploitation CVE-2025-55182","first_seen_at":"2026-11-02T21:00:19.183Z"},{"id":"2073cfa91d5e2db714fee750df2eb7e585ee538c61340952128836e1f61ec87e","cve_id":"CVE-2025-55182","vendor":"azure","product":"Application Gateway WAF (DRS/CRS)","rule_id":"800115","rule_name":"Attempted React2Shell remote code execution exploitation CVE-2025-55182","change":"listed","default_action":null,"published_on":null,"source_url":"https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/application-gateway-crs-rulegroups-rules","source_title":"Application Gateway WAF (DRS/CRS) rule groups and rules","excerpt":"Rule 800115: Critical - 5 · PL1 · Attempted React2Shell remote code execution exploitation CVE-2025-55182","first_seen_at":"2026-11-02T21:00:19.183Z"}]},{"vendor":"google","status":"rule","basis":"claimed","firstOn":"2025-12-03","firstIsNew":true,"daysToRule":0,"daysAtMost":null,"freePlan":false,"claims":[{"id":"5b4b4604afffa485a1e6eb9bd848d0d50a44f3353782e047c725830777408eb4","cve_id":"CVE-2025-55182","vendor":"google","product":"Cloud Armor","rule_id":"cve-canary","rule_name":"cve-canary","change":"new","default_action":null,"published_on":"2025-12-03","source_url":"https://docs.cloud.google.com/armor/docs/release-notes#December_03_2025","source_title":"Cloud Armor release notes","excerpt":"Security The Cloud Armor cve-canary rules include the google-mrs-v202512-id000001-rce signature to help detect and mitigate CVE-2025-55182 .","first_seen_at":"2026-11-02T21:00:21.696Z"},{"id":"ebb9e652d7fab460e74e7bf703c080e70d65603cfa0764c3ec834e6298e052f5","cve_id":"CVE-2025-55182","vendor":"google","product":"Cloud Armor","rule_id":"cve-canary","rule_name":"cve-canary","change":"new","default_action":null,"published_on":"2025-12-06","source_url":"https://docs.cloud.google.com/armor/docs/release-notes#December_06_2025","source_title":"Cloud Armor release notes","excerpt":"Security The Cloud Armor cve-canary rules include the google-mrs-v202512-id000002-rce signature to help detect and mitigate CVE-2025-55182 .","first_seen_at":"2026-11-02T21:00:21.696Z"},{"id":"e4b03c4466d46436c7f520d1056309babe3ce8c652bb114e2e1891f5b791e505","cve_id":"CVE-2025-55182","vendor":"google","product":"Cloud Armor preconfigured rules","rule_id":"google-mrs-v202512-id000001-rce","rule_name":"React RCE vulnerability to help detect and mitigate CVE-2025-55182","change":"listed","default_action":null,"published_on":null,"source_url":"https://docs.cloud.google.com/armor/docs/waf-rules","source_title":"Cloud Armor preconfigured WAF rules","excerpt":"Signature google-mrs-v202512-id000001-rce (sensitivity 0): React RCE vulnerability to help detect and mitigate CVE-2025-55182","first_seen_at":"2026-11-02T21:00:21.696Z"},{"id":"7d090a7ce79626c11813abaa063ba4a4de9c199813a0f105d6260158768457c2","cve_id":"CVE-2025-55182","vendor":"google","product":"Cloud Armor preconfigured rules","rule_id":"google-mrs-v202512-id000002-rce","rule_name":"React RCE vulnerability to help detect and mitigate CVE-2025-55182","change":"listed","default_action":null,"published_on":null,"source_url":"https://docs.cloud.google.com/armor/docs/waf-rules","source_title":"Cloud Armor preconfigured WAF rules","excerpt":"Signature google-mrs-v202512-id000002-rce (sensitivity 0): React RCE vulnerability to help detect and mitigate CVE-2025-55182","first_seen_at":"2026-11-02T21:00:21.696Z"}]},{"vendor":"fastly","status":"no_history","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"f5","status":"rule","basis":"claimed","firstOn":"2025-12-04","firstIsNew":true,"daysToRule":1,"daysAtMost":null,"freePlan":false,"claims":[{"id":"7281da63e767aa17f915dc07541384e7d8de132dc0e1cd2bc3986b9012d0b5ec","cve_id":"CVE-2025-55182","vendor":"f5","product":"Attack signatures","rule_id":"200204048","rule_name":"React Server Components RCE","change":"new","default_action":null,"published_on":"2025-12-04","source_url":"https://docs.cloud.f5.com/docs-v2/platform/changelogs/security-details-changelog","source_title":"F5 Distributed Cloud attack signatures changelog","excerpt":"Added: signature 200204048 \"React Server Components RCE\" (Server Side Code Injection, risk High), systems: Node.js, JavaScript, ReactJS. References: CVE-2025-55182, CVE-2025-66478.","first_seen_at":"2026-11-02T21:00:25.304Z"},{"id":"5f085e47334fc9a34bb697a7dfde7f8645357149eb3cfba30961f74ea5058803","cve_id":"CVE-2025-55182","vendor":"f5","product":"Attack signatures","rule_id":"200204048","rule_name":"React Server Components RCE","change":"updated","default_action":null,"published_on":"2025-12-12","source_url":"https://docs.cloud.f5.com/docs-v2/platform/changelogs/security-details-changelog","source_title":"F5 Distributed Cloud attack signatures changelog","excerpt":"Updated: signature 200204048 \"React Server Components RCE\" (Server Side Code Injection, risk High), systems: Node.js, JavaScript, ReactJS. References: CVE-2025-55182, CVE-2025-66478.","first_seen_at":"2026-11-02T21:00:28.819Z"},{"id":"7da235581043b2b00f0041c18c133aeb96c8c814fac320d9a34c0bb9336586dd","cve_id":"CVE-2025-55182","vendor":"f5","product":"Attack signatures","rule_id":"200204050","rule_name":"Next.js RSC Remote Code Execution","change":"updated","default_action":null,"published_on":"2025-12-12","source_url":"https://docs.cloud.f5.com/docs-v2/platform/changelogs/security-details-changelog","source_title":"F5 Distributed Cloud attack signatures changelog","excerpt":"Updated: signature 200204050 \"Next.js RSC Remote Code Execution\" (Server Side Code Injection, risk High), systems: Node.js, JavaScript, ReactJS. References: CVE-2025-55182, CVE-2025-66478.","first_seen_at":"2026-11-02T21:00:28.819Z"}]},{"vendor":"akamai","status":"no_source","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"crs","status":"rule","basis":"claimed","firstOn":"2026-01-05","firstIsNew":true,"daysToRule":33,"daysAtMost":null,"freePlan":false,"claims":[{"id":"14c8eab2b3e8b3d1c8b4c8a1eb9ba29484bbe67c6128066b6e19bbd8ce8f2750","cve_id":"CVE-2025-55182","vendor":"crs","product":"CRS 4.22.0","rule_id":"934100","rule_name":"feat(934100): added sequence for CVE-2025-55182 POCs (https://github.com/coreruleset/coreruleset/pull/4372)","change":"new","default_action":null,"published_on":"2026-01-05","source_url":"https://github.com/coreruleset/coreruleset/blob/main/CHANGES.md","source_title":"Core Rule Set 4.22.0 changelog","excerpt":"feat(934100): added sequence for CVE-2025-55182 POCs (https://github.com/coreruleset/coreruleset/pull/4372)","first_seen_at":"2026-11-02T21:00:29.593Z"}]}],"updatedAt":"2026-11-02T23:17:40.558Z","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","ssvc":{"exploitation":"active","automatable":"yes","technicalImpact":"total"},"measured":[{"engineId":"owasp-crs","engineName":"OWASP Core Rule Set","engineVersion":"4.25.0","runtime":"Coraza v3.8.1","config":"paranoia level 1, anomaly threshold 5, default CRS settings","ranAt":"2026-11-02T13:02:57.000Z","verdict":"blocked","templateId":"CVE-2025-55182","templatePath":"http/cves/2025/CVE-2025-55182.yaml","requests":2,"blockedRequests":2,"rules":["932120","932130","933135","934100","934130","942151","942550"],"note":"","requestDetail":[{"method":"POST","path":"/","status":403,"blocked":true,"rules":["932130","933135","934100","934130","942151","942550"]},{"method":"POST","path":"/","status":403,"blocked":true,"rules":["932120","932130","933135","934100","934130","942151"]}]},{"engineId":"owasp-crs","engineName":"OWASP Core Rule Set","engineVersion":"4.25.0","runtime":"Coraza v3.8.1","config":"paranoia level 2, anomaly threshold 5, default CRS settings","ranAt":"2026-11-02T13:03:28.000Z","verdict":"blocked","templateId":"CVE-2025-55182","templatePath":"http/cves/2025/CVE-2025-55182.yaml","requests":2,"blockedRequests":2,"rules":["932120","932130","932200","932240","933135","934100","934101","934130","941340","942150","942151","942200","942300","942340","942370","942430","942550"],"note":"","requestDetail":[{"method":"POST","path":"/","status":403,"blocked":true,"rules":["932130","932200","932240","933135","934100","934101"]},{"method":"POST","path":"/","status":403,"blocked":true,"rules":["932120","932130","932200","932240","933135","934100"]}]}],"social":{"total":0,"first_seen":null,"daily":[{"day":"2026-10-20","posts":0},{"day":"2026-10-21","posts":0},{"day":"2026-10-22","posts":0},{"day":"2026-10-23","posts":0},{"day":"2026-10-24","posts":0},{"day":"2026-10-25","posts":0},{"day":"2026-10-26","posts":0},{"day":"2026-10-27","posts":0},{"day":"2026-10-28","posts":0},{"day":"2026-10-29","posts":0},{"day":"2026-10-30","posts":0},{"day":"2026-10-31","posts":0},{"day":"2026-11-01","posts":0},{"day":"2026-11-02","posts":0}],"top_posts":[],"exploit_repositories":[]}}