Critical RCE Threat: Uncovering the Hidden Danger in React Server…

In the fast-paced world of web development, security vulnerabilities can emerge at any time, leaving developers and businesses vulnerable to potential threats. One such critical vulnerability, identified as CVE-2025-55182, has recently been discovered in Next.js applications utilizing React Server Components (RSC) and Server Actions. This vulnerability, stemming from insecure deserialization within the underlying “Flight” protocol used by React, poses a significant risk to the security of modern web applications. Unauthenticated remote attackers can exploit this flaw to execute arbitrary code on the server, potentially leading to a complete compromise of the application and underlying system.

Given the widespread adoption of Next.js and the critical severity of the flaw (CVSS 10.0), immediate action is required. In this article, we will delve into the details of this vulnerability, its impact on affected products, and the steps developers can take to mitigate the risk and protect their applications.

Affected Products

The vulnerability affects the React Server Components ecosystem, which is heavily integrated into modern frameworks like Next.js. Specifically, it impacts the `react-server-dom-parcel`, `react-server-dom-turbopack`, and `react-server-dom-webpack` packages. These packages are crucial components of the React Server Components architecture, enabling developers to build interactive and dynamic user interfaces on the server side.

Affected Versions

The vulnerability has been identified in specific versions of React Server Components and Next.js. Here are the affected versions:

• React Server Components: Versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0.
• Next.js: Applications using App Router (Next.js 15.x, 16.x) or experimental Server Actions are likely affected by default.

It is essential to note that the vulnerability is not limited to these specific versions but may also affect other versions of React Server Components and Next.js that utilize the affected packages. Developers should carefully review their dependencies and ensure they are using the latest patched versions to mitigate the risk.

Vulnerability Details

CVE-2025-55182 is an insecure deserialization vulnerability that occurs at “Server Function endpoints.” This vulnerability arises due to the server-side handler for the React “Flight” protocol unsafely deserializing payloads from HTTP requests. The server fails to properly validate serialized input before processing it, making it susceptible to malicious attacks.

Exploitation

An attacker can trigger this vulnerability by sending a specially crafted `POST` request to the root path containing:

1. Specific `Next-Action` headers.
2. Malformed multipart data payloads.

When processed, this malformed payload triggers the insecure deserialization, allowing the attacker to inject and execute malicious code remotely. The attacker can exploit this vulnerability to gain unauthorized access to the server, steal sensitive data, or even take complete control of the application and underlying system.

Detection

Detectify customers can now test whether their applications are exposed to this RCE. The vulnerability assessment released by Detectify checks for the presence of the insecure deserialization flaw by sending a specially crafted `POST` request to the root path with `Next-Action` headers and malformed multipart data. The test safely identifies the vulnerability by observing specific error responses from the server that confirm the deserialization failure, without executing malicious code.

Steps to Detect the Vulnerability

To detect the vulnerability in your applications, follow these steps:

1. Ensure you have the latest version of the Detectify vulnerability assessment tool.
2. Configure the tool to target your Next.js application.
3. Run the vulnerability assessment and monitor the results.
4. If the assessment identifies the insecure deserialization flaw, take immediate action to mitigate the risk.

Mitigation

The most effective mitigation for this vulnerability is to upgrade the affected packages to their patched versions. Developers should prioritize this action to ensure the security of their applications and protect against potential exploits.

Upgrading to Patched Versions

To mitigate the risk, upgrade the affected packages to their patched versions:

• React Server Components: Upgrade `react-server-dom-` packages to versions 19.0.1, 19.1.2, or 19.2.1 (or later).
• Next.js: Upgrade to the latest patch release for your major version (e.g., Next.js 15.0.5+, 16.0.7+).

If immediate patching is not feasible, developers may consider applying Web Application Firewall (WAF) rules to block requests containing suspicious `Next-Action` headers or malformed multipart bodies. However, it is crucial to note that this is not a substitute for patching and should be used as a temporary measure until the affected packages can be updated.

Patch Availability

The vulnerability is fixed in the following versions:

• React Server Components: 19.0.1, 19.1.2, and 19.2.1.
• Next.js: Various patch releases (check the official Next.js release log for your specific version branch).

Users are strongly advised to update to these versions to ensure the security of their applications and protect against potential exploits. Customers can always find updates in the “What’s New at Detectify” product log. Any questions can be directed to Customer Success representatives or Support. If you’re not already a customer, click here to sign up for a demo or a free trial and immediately start scanning. Go hack yourself!

Conclusion

The discovery of CVE-2025-55182 in React Server Components and Next.js highlights the importance of proactive security measures in web development. Developers must stay vigilant and prioritize the security of their applications to protect against potential threats. By upgrading to the latest patched versions and implementing additional security measures, developers can mitigate the risk and ensure the integrity of their applications.

FAQ

What is CVE-2025-55182?

CVE-2025-55182 is a critical Remote Code Execution (RCE) vulnerability discovered in Next.js applications utilizing React Server Components (RSC) and Server Actions. It stems from insecure deserialization within the underlying “Flight” protocol used by React.

Which versions of React Server Components and Next.js are affected?

The vulnerability affects specific versions of React Server Components (19.0.0, 19.1.0, 19.1.1, and 19.2.0) and Next.js applications using App Router (Next.js 15.x, 16.x) or experimental Server Actions.

How can I detect the vulnerability in my applications?

Detectify customers can test their applications for the vulnerability using the Detectify vulnerability assessment tool. The tool checks for the presence of the insecure deserialization flaw by sending a specially crafted POST request to the root path with Next-Action headers and malformed multipart data.

What are the recommended mitigation steps?

The most effective mitigation is to upgrade the affected packages to their patched versions. If immediate patching is not feasible, developers may consider applying Web Application Firewall (WAF) rules to block requests containing suspicious Next-Action headers or malformed multipart bodies.

Where can I find more information about the vulnerability?

For more information, refer to the Vendor Advisory and the Security Update: Critical RCE in React Server Components & Next.js (CVE-2025-55182) article on the Detectify blog.