Remote code execution in React Server Components (CVE-2025-55182) — a flaw beneath the code you wrote, carrying no CWE assignment
Meta React Server Components contains a remote code execution flaw. Exploiting a defect in how React decodes payloads sent to React Server Function endpoints can yield unauthenticated remote code execution. CISA added it to the KEV catalog on 2025-12-05 with a due date of 2025-12-12 — seven days.
Key facts
- CVE IDCVE-2025-55182
- Affected (vendor / product)Meta React Server Components
- ExploitationListed in CISA KEV (exploitation confirmed); also confirmed used in ransomware
- Remediation due2025-12-12 (U.S. federal civilian agencies, BOD 22-01)
Key points
- The affected product is Meta React Server Components, the framework beneath a great many web applications.
- A defect in how React decodes payloads sent to Server Function endpoints can yield unauthenticated remote code execution.
- The catalog notes that CVE-2025-66478 has been rejected but is associated with this record.
- Added to KEV 2025-12-05 with a due date of 2025-12-12 — seven days. Use in ransomware campaigns is recorded as known.
- This record carries no CWE. Of the 1,685 records this site holds as of 2026-08-31, 175 (10.4 percent) have no CWE assigned.
- Of the 1,685 records held as of 2026-08-31, 175 — 10.4 percent — carry no CWE assignment.
1Fixing your own code does not end it
Most vulnerabilities sit inside some product or some device. What this record points at is the framework that a great many web applications use as their foundation. Even where the code you wrote is sound, a defect in the parts running beneath it reaches you. Which applications are affected is decided not by the product name a user sees but by what something is built on. An asset register kept by product name cannot be matched against a flaw of this kind.
2The weak point is where a payload is decoded
What the catalog cites is a defect in how React decodes payloads sent to Server Function endpoints. Any mechanism for calling functions that run on the server includes a step that interprets incoming data and assembles it into arguments. Where that interpretation is loose, something meant to be treated as data can act as an instruction to the processing.
That the record describes reaching remote code execution from an unauthenticated state reads as following from this step sitting immediately behind the entrance.
3175 of 1,685 records carry no CWE
This record has no CWE number identifying the class of vulnerability. Of the 1,685 KEV records this site holds as of 2026-08-31, 175 — 10.4 percent — carry no CWE assignment. Among those that do, CWE-20 (improper input validation) leads at 118, followed by CWE-78 (OS command injection) at 102 and CWE-416 (use-after-free) at 91.
CWE is the classification that lets similar vulnerabilities be handled together, and without it, cross-cutting search and generalization of countermeasures become harder. The deadline here is seven days, yet the entry sits on the ledger with its class still undetermined.
Why it matters
An asset register kept at the level of product names cannot be matched against a flaw in an underlying framework. Without knowing what each application is built on, identifying the blast radius takes time. That a tenth of records reach the ledger with no class assigned also shows the limits of organizing countermeasures around CWE.
FAQ
Why are you affected when your own code is sound?
What is decoding a payload?
Sources (primary)
This article is an independent organization based on the U.S. official data below. Always verify the exact, latest details and applicability with the official and vendor sources.
- CISA KEV Catalog (known exploited list)
- NVD (CVE details / CVSS)
- Vendor / reference advisory
- This product uses data from the NVD API but is not endorsed or certified by the NVD. KEV data is CC0 (public domain).