SecOps SignalSecurity Intelligence Workspace
Collection Degraded30 / 46 Sources HealthyPublic Intel Only
Vulnerabilities/CVE-2025-55182Public Intelligence Dossier
Source: facebook · Limited verification•Last verified: •Collection Degraded
CVE-2025-55182ListedCRITICAL (raw)CVSS 10.0CWE-502

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack

Published: 03 Dec 2025•Last updated: 18 Oct 2026, 10:40 PM IST•Source identifier: cve-assign@fb.com
Dossier completeness: source-provided sections 3 / 3 · rule guidance available. Missing source facts count as incomplete.
Official source
CISA KEV catalog
Listed
Added05 Dec 2025
Due12 Dec 2025
RansomwareKnown
CVSS score
10.0CRITICAL (raw)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Metric sourcecve-assign@fb.com
EPSS probability
—
Percentile—
Weakness type
CWE-502
No further CWE recorded
Remediation
Patch status unknown
No fixed version or KB recorded

Why It Matters

Analysis dossier

Why It Matters

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.

SOC priority

Immediate Attention

Actively exploited

Yes

Publicly disclosed

Unknown

Risk basis: CISA KEV exploitation signal; CRITICAL severity; Known exploitation signal from CISA KEV or ransomware metadata

Affected Products & Remediation

2 source-backed products
Affected products and versions (source)
  • facebook react · 19.0.0; 19.1.0; 19.1.1; 19.2.0 · NVD CPE · Source
  • vercel next.js · >= 15.0.0 < 15.0.5; >= 15.1.0 < 15.1.9; >= 15.2.0 < 15.2.6; >= 15.3.0 < 15.3.6; >= 15.4.0 < 15.4.8; >= 15.5.0 < 15.5.7; >= 16.0.0 < 16.0.7; 14.3.0; 15.6.0; 16.0.0 · NVD CPE · Source
Recorded patch / KBNot provided by source

Vendor or catalog guidance (source)

  • CISA KEV: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Known exploitation (source facts)

Only what a source states. Unknown means no source has said either way; it is not "not exploited".

CISA KEV
Listed
Exploited (source statement)
Yes
Publicly disclosed (source)
Unknown

CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Suggested hunting (rule-based inference)

SecOps Signal recommendation (rule-based inference). These steps are hunting hypotheses from the vulnerability class; they do not state or imply that exploitation occurred here or anywhere.

Matched kev-network-exposure (CVSS AV:N, CISA KEV Listed); deserialization (CWE-502)

Exposure

  1. Identify assets with the exact CVE and confirm the affected product/version against the advisory.Telemetry: DeviceTvmSoftwareVulnerabilities · KEV listing raises urgency, but inventory is needed to establish local exposure. · Rule kev-network-exposure
  2. Find installations of the affected component and confirm the source-stated version range.Telemetry: Application inventory · Deserialization risk requires component and version evidence. · Rule deserialization

Exploitation evidence

  1. Review relevant edge or application access logs for unusual requests around the advisory window.Telemetry: CommonSecurityLog · Log review is a hunting hypothesis; KEV listing alone does not show local exploitation. · Rule kev-network-exposure
Show more (2)

Exploitation evidence

  1. Review unusual child processes or network connections from the affected service.Telemetry: DeviceProcessEvents · Unexpected behavior may support investigation but is not proof by itself. · Rule deserialization

Response

  1. Recheck the affected assets after the source-stated mitigation or update is applied.Telemetry: DeviceTvmSoftwareVulnerabilities · A follow-up inventory check verifies local remediation. · Rule kev-network-exposure

CISA KEV Record

Catalog entry
05 Dec 2025
Required action due
12 Dec 2025
Known ransomware use
Known

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Change History & Source Data

— No recorded material change

CNA / source
cve-assign@fb.com
Record status · verification
NEW · CISA KEV confirmed
CPE
cpe:2.3:a:facebook:react:19.0.0:*:*:*:*:*:*:*, cpe:2.3:a:facebook:react:19.1.0:*:*:*:*:*:*:*, cpe:2.3:a:facebook:react:19.1.1:*:*:*:*:*:*:*, cpe:2.3:a:facebook:react:19.2.0:*:*:*:*:*:*:*, cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*, cpe:2.3:a:vercel:next.js:14.3.0:canary77:*:*:*:node.js:*:*, cpe:2.3:a:vercel:next.js:14.3.0:canary78:*:*:*:node.js:*:*, cpe:2.3:a:vercel:next.js:14.3.0:canary79:*:*:*:node.js:*:*, cpe:2.3:a:vercel:next.js:14.3.0:canary80:*:*:*:node.js:*:*, cpe:2.3:a:vercel:next.js:14.3.0:canary81:*:*:*:node.js:*:*

Evidence & Provenance

4 public sources
CISA KEV CatalogAdded 2025-12-05react.devSource recordnvd.nist.govSource recordfacebook.comSource record

Linked by the query's stored exact CVE association. Review required tables and validation status before use.

Detection Hunting Query
Target: DeviceTvmSoftwareVulnerabilities•Defender XDR
Detect endpoints exposed to CVE-2025-55182
Purpose: Exposure assessment (Category: Exposure Check)Why linked: Query metadata names CVE-2025-55182
DeviceTvmSoftwareVulnerabilities| where CveId == "CVE-2025-55182"| project DeviceId, DeviceName, OSPlatform, OSVersion, SoftwareVendor, SoftwareName, SoftwareVersion, CveId, VulnerabilitySeverityLevel, RecommendedSecurityUpdate, RecommendedSecurityUpdateId| sort by VulnerabilitySeverityLevel desc
Schema Checked · Not runtime validatedSource: SecOps Signal deterministic template · Limited verificationStatic screening: Passed structure and schema checks; tenant execution is not verified.
Open KQL Library

Correlated briefings

Microsoft Defender for Endpoint releases · Limited verificationmacOS | December 2025 | Platform: 101.25102.0019Publisher date unavailableMicrosoft Defender for Endpoint releases · Limited verificationLinux | January 2026 | Platform: 101.25102.0005Publisher date unavailableMicrosoft Defender for Endpoint releases · Limited verificationLinux | December 2025 | Platform: 101.25092.0005Publisher date unavailable
SecOps Signal surfaces public advisory facts only. A missing value means the source has not published it, not that your environment is unaffected. No tenant inventory is connected.