server-side features

10 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

CVE-2025-55182: React Server Components RCE vulnerability

A critical unauthenticated remote code execution vulnerability (CVE-2025-55182, CVSS 10.0) exists in React Server Components. It was reported on November 29, 2025 by Lachlan Davidson and exploits a flaw in how React decodes payloads sent to React Server Function endpoints. An attacker could craft a malicious HTTP request to any Server Function endpoint that achieves remote code execution on the server when deserialized by React.

Vulnerable React Server DOM packages and versions

The vulnerability is present in versions 19.0, 19.1.0, 19.1.1, and 19.2.0 of: react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack.

Fixed versions for CVE-2025-55182

The fix was introduced in versions 19.0.1, 19.1.2, and 19.2.1 of react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack.

Vulnerability applies to apps without explicit Server Function endpoints

Even if an app does not implement any React Server Function endpoints, it may still be vulnerable if the app supports React Server Components.

Apps not using servers or React Server Components are unaffected

If an app's React code does not use a server, or if the app does not use a framework, bundler, or bundler plugin that supports React Server Components, the app is not affected by this vulnerability.

Affected frameworks and bundlers for CVE-2025-55182

The following React frameworks and bundlers are affected and depend on or include the vulnerable React packages: next, react-router, waku, @parcel/rsc, @vitejs/plugin-rsc, and rwsdk.

Next.js patched versions by release line

Next.js patched versions are: 14.2.35 (for 13.3.x, 13.4.x, 13.5.x, 14.x), 15.0.8 (for 15.0.x), 15.1.12 (for 15.1.x), 15.2.9 (for 15.2.x), 15.3.9 (for 15.3.x), 15.4.11 (for 15.4.x), 15.5.10 (for 15.5.x), 16.0.11 (for 16.0.x), 16.1.5 (for 16.1.x), 15.6.0-canary.60 (for 15.x canary), and 16.1.0-canary.19 (for 16.x canary).

React Server Functions allow client to call server functions

React Server Functions allow a client to call a function on a server. React translates requests on the client into HTTP requests which are forwarded to a server. On the server, React translates the HTTP request into a function call and returns the needed data to the client.

Additional vulnerabilities in React Server Components

Following the initial CVE-2025-55182, additional vulnerabilities were disclosed: CVE-2025-55184 (Denial of Service - High Severity, CVSS 7.5), CVE-2025-67779 (Denial of Service - High Severity, CVSS 7.5), CVE-2025-55183 (Source Code Exposure - Medium Severity, CVSS 5.3), and CVE-2026-23864 (Denial of Service - High Severity, CVSS 7.5, January 26, 2026).

React Native users not using react-dom unaffected

For React Native users not using a monorepo or react-dom, the react version should be pinned in package.json and there are no additional steps needed. Users in a monorepo should update only the impacted packages if installed: react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack.

Give your agent this brain