CriticalCVECVE-2025-55182
Critical React Server Components Flaw Lets Hackers Execute Code Remotely Without Authentication
Cyber Security News·Source published ·1 min read
What happened?
A critical security flaw in React Server Components can let attackers run code remotely without logging in. React published the advisory, tracked as GHSA-xqc2-xf4c-x3h3, on October 14, 2026. The issue carries a CVSS v4 score of 9.5, and the React team recommends immediate updates for affected applications. The flaw affects react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack. These packages support React Server Components across different build tools.
Key details
- A critical flaw in React Server Components allows unauthenticated remote code execution.
- Exploitation requires a rare response pattern with multiple typed arrays and attacker-controlled data.
- No active exploitation or public exploit details have been published.
- Applications without server-side React code or RSC framework support are not affected.
Affected
- react-server-dom-webpack versions 19.0.0 through 19.0.8, 19.1.0 through 19.1.9, 19.2.0 through 19.2.8, and 19.3.0
- react-server-dom-parcel versions 19.0.0 through 19.0.8, 19.1.0 through 19.1.9, 19.2.0 through 19.2.8, and 19.3.0
- react-server-dom-turbopack versions 19.0.0 through 19.0.8, 19.1.0 through 19.1.9, 19.2.0 through 19.2.8, and 19.3.0
Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.