---
title: "Critical Security Vulnerability in React Server Components – React"
url: https://daily.dev/posts/critical-security-vulnerability-in-react-server-components-react-hqdbmoipx
source_url: https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components
type: article
source: "React"
published: 2025-12-03T15:54:20.227Z
updated: 2026-08-11T01:58:15.018Z
tags: ["security", "react", "nextjs", "vulnerability"]
reading_time: 3
upvotes: 1
comments: 0
language: en
---

> ## Documentation Index
> Fetch the complete documentation index at: https://daily.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Critical Security Vulnerability in React Server Components – React

**[React](https://daily.dev/sources/react)** · 3 min read · 1 upvotes · 0 comments

## Summary

A critical remote code execution vulnerability (CVE-2025-55182, CVSS 10.0) was discovered in React Server Components affecting versions 19.0 through 19.2.0. The flaw allows unauthenticated attackers to execute arbitrary code by exploiting how React decodes payloads sent to Server Function endpoints. Patches are available in versions 19.0.1, 19.1.2, and 19.2.1. Applications using React Server Components through frameworks like Next.js, React Router, or Waku should upgrade immediately, even if they don't explicitly implement Server Function endpoints.

## Full article

daily.dev links to this article rather than hosting it. Read it at the original source: <https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components>

## Community take

How the wider developer community reacted, aggregated from 2 discussions and 24 comments across lobsters, hackernews (as of 2026-08-11).

**TL;DR:** The community is alarmed by this CVSS 10.0 RCE vulnerability in React Server Components, with much of the discussion focused on confusion over the actual exploit details and skepticism about circulating PoCs being legitimate.

**Sentiment:** 5% positive · 30% mixed · 65% skeptical

**The case for**

- Patches are already available across multiple React and Next.js versions, giving users a clear upgrade path.

**The pushback**

- The actual exploit mechanism was not publicly explained at disclosure time, leaving developers unable to assess risk independently.
- Multiple circulating proof-of-concept exploits were flagged as likely invalid or deliberately set up with extra vulnerabilities, creating confusion.
- The vulnerability affects any app using RSC-enabled frameworks even without explicitly implementing Server Function endpoints, broadening the blast radius.
- Some commenters expressed broader frustration that RSC's architecture (executing code from client-supplied payloads) makes this class of bug possible.

**By community**

- lobsters (skeptical): Discussion centered on reverse-engineering the fix and debunking circulating PoCs as invalid or AI-generated slop, with no clear consensus on the real exploit.
- hackernews (mixed): Commenters acknowledged the severity and noted framework-level fixes are available, but some used the incident to criticize RSC's design philosophy.

**Hottest debate:** Whether the publicly circulating proof-of-concept exploits are genuine or fabricated/invalid.

**Open questions**

- What is the exact technical mechanism of the vulnerability — how does the payload deserialization lead to arbitrary code execution?
- Is there a viable workaround for teams that cannot immediately upgrade?

**Highlights**

> These kind of PoC seems to be invalid according to https://react2shell.com/
> — [rw-rw-rw- on lobsters · 5 points, 1 comments](https://lobste.rs/s/6w7mnm/critical_security_vulnerability_react#c_vom87y)

> The first issue in that repo says it is probably slop and the poc server has been set up to have vulnerabilities.
> — [Zurga on lobsters · 3 points](https://lobste.rs/s/6w7mnm/critical_security_vulnerability_react#c_x3icwv)

> Kind of insane that they pseudo execute code from the client.
> — [carlana on lobsters · 1 points](https://lobste.rs/s/6w7mnm/critical_security_vulnerability_react#c_myxfpz)

> > An unauthenticated attacker could craft a malicious HTTP request to any Server Function endpoint that, when deserialized by React, achieves remote code execution on the server. ..Affected: next, react-router, waku, @parcel/rsc, @vitejs/plugin-rsc, and rwsdk. Oof, that's bad. Good thing I've only used RSC for static site generation and don't run it on a production server.
> — [lioeters on hackernews](https://news.ycombinator.com/item?id=46136795)

**Source threads**

- [lobsters](https://lobste.rs/s/6w7mnm/critical_security_vulnerability_react) · 31 points · 12 comments
- [hackernews](https://news.ycombinator.com/item?id=46135784) · 70 points · 12 comments

---

Tags: [#security](https://daily.dev/tags/security), [#react](https://daily.dev/tags/react), [#nextjs](https://daily.dev/tags/nextjs), [#vulnerability](https://daily.dev/tags/vulnerability)

[View this post on daily.dev](https://daily.dev/posts/critical-security-vulnerability-in-react-server-components-react-hqdbmoipx)