Exploited Vulnerabilities DailyCVE-2025-55182: Meta React Server Components
EPSS99.8%No. 151 of 1739 in KEV
CVE year2025listed the same year
Same vendor in KEV1
Same product1
| Field | Value |
|---|---|
| Vendor | Meta |
| Product | React Server Components |
| Name | Meta React Server Components Remote Code Execution Vulnerability |
| Added to KEV | 2025-12-05 |
| US federal due date | 2025-12-12 |
| Ransomware use | Known |
| CWE | – |
CISA description
Meta React Server Components contains a remote code execution vulnerability that could allow unauthenticated remote code execution by exploiting a flaw in how React decodes payloads sent to React Server Function endpoints. Please note CVE-2025-66478 has been rejected, but it is associated with CVE-2025- 55182.
Data from CISA's Known Exploited Vulnerabilities (KEV) catalog. EPSS is FIRST's estimated probability of exploitation activity in the next 30 days, refreshed weekly. Always follow the vendor's official guidance.
About this page
A Meta React Server Components vulnerability added to CISA's Known Exploited Vulnerabilities catalog on 2025-12-05.