# Security Advisory: Critical RCE Vulnerabilities in React Server Components (CVE-2025-55182)

DevFeed: [Security Advisory: Critical RCE Vulnerabilities in React Server Components (CVE-2025-55182)](<https://devfeed.tech/articles/security-advisory-critical-rce-vulnerabilities-in-react-server-components-cve-2025-55182-8087.md>)

Original publisher: [Read original article](<https://snyk.io/blog/security-advisory-critical-rce-vulnerabilities-react-server-components/>)

Author: Stephen Thoemmes

Published: 2025-12-03T05:00:00Z

Content type: article

Language: en

Sources: [Blog RSS Feed | Snyk](<https://devfeed.tech/sources/blog-rss-feed-snyk.md>)

Topics: [React](<https://devfeed.tech/topics/react.md>), [Vulnerabilities](<https://devfeed.tech/topics/vulnerabilities.md>), [Next.js](<https://devfeed.tech/topics/next-js.md>), [Exploit](<https://devfeed.tech/topics/exploit.md>), [Security](<https://devfeed.tech/topics/security.md>), [Flight](<https://devfeed.tech/topics/flight.md>), [HTTP](<https://devfeed.tech/topics/http.md>)

Tags: [awareness](<https://devfeed.tech/tags/awareness.md>), [blog](<https://devfeed.tech/tags/blog.md>), [cloud-security](<https://devfeed.tech/tags/cloud-security.md>), [code-security](<https://devfeed.tech/tags/code-security.md>), [container-security](<https://devfeed.tech/tags/container-security.md>), [cve](<https://devfeed.tech/tags/cve.md>), [developer](<https://devfeed.tech/tags/developer.md>), [devrel](<https://devfeed.tech/tags/devrel.md>), [docker](<https://devfeed.tech/tags/docker.md>), [engineering](<https://devfeed.tech/tags/engineering.md>), [http](<https://devfeed.tech/tags/http.md>), [incident](<https://devfeed.tech/tags/incident.md>), [next-js](<https://devfeed.tech/tags/next-js.md>), [react](<https://devfeed.tech/tags/react.md>), [remote](<https://devfeed.tech/tags/remote.md>), [remote-code-execution](<https://devfeed.tech/tags/remote-code-execution.md>), [security](<https://devfeed.tech/tags/security.md>), [upgrade](<https://devfeed.tech/tags/upgrade.md>), [vulnerabilities](<https://devfeed.tech/tags/vulnerabilities.md>), [vulnerability-insights](<https://devfeed.tech/tags/vulnerability-insights.md>)

## AI overview

The article reports critical unauthenticated remote code execution vulnerabilities in React Server Components and Next.js caused by unsafe deserialization of attacker-controlled data in the RSC "Flight" protocol. It explains that default configurations were exploitable, identifies affected React and Next.js releases and other tools embedding RSC, and urges immediate patching.

## Source excerpt

Critical RCE vulnerabilities (CVE-2025-55182/CVE-2025-66478) were found in React Server Components and Next.js via unsafe deserialization. Immediate upgrade to patched versions is mandatory to prevent unauthenticated remote code execution. Learn how to detect and mitigate the critical flaw.