CVE-2025-55182: listed in the CISA KEV catalog

CVE-2025-55182 · CVSS 10.0 CRITICAL · EPSS 99.6% · KEV 2025-12-05

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.

Is CVE-2025-55182 exploited?

• Listed in the CISA KEV catalog on 2025-12-05.
• Federal remediation due 2025-12-12.
• Past that date by 246 days.
• Used in ransomware campaigns.
• EPSS puts exploitation in the next 30 days at 99.6%.
• Public exploit code: packaged in a public tool.
• Public detection rules exist.

Which products and versions are affected?

No affected package list recorded here yet.

Is there a patch?

No patch identifier recorded here yet.

What PlainSec published about CVE-2025-55182

• Outbound Traffic Is the Missing Cloud Control (2026-06-23)
• AI Models Become Persistent Attack Operators (2026-05-27)
• React Server Components Face Hour-Scale Ransomware Risk (2026-05-19)
• Exchange N-day Abuse Expands Espionage Reach Across Governments (2026-05-03)
• Node Kernel Bugs on GKE COS Nodes Enable Host Escalation (2026-04-15)
• Google Cloud Issues Multiple Linux Kernel Privilege Escalation Fixes for GKE Nodes (2026-04-07)
• Kubernetes Attacks Spike as React2Shell Enables Cloud Identity Theft (2026-04-07)
• Multiple Linux Kernel Flaws Elevate Privileges on GCP Container Nodes (2026-04-03)
• Multiple High-Severity Cloud Vulnerabilities Impact Container Nodes (2026-04-01)
• Attackers Weaponize New RCEs to Rapidly Breach Cloud (2026-03-23)

Primary sources

• NVD record
• CISA KEV catalog
• Metasploit: exploit/multi/http/react2shell_unauth_rce_cve_2025_55182
• Exploit-DB 52506
• Nuclei template

What this record does not say

• No affected package data.
• No patch identifier.

KEV and EPSS are re-checked daily. Record last updated 2026-08-15.