Read the docs
TI-2025-34861 Aliases CVE-2025-55182GHSA-fv66-9v8q-g76r

Deserialization of untrusted data in Meta react-server-dom-webpack

Priority CRITICAL 100Exploited in the wildCWE-502Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-502.

Summary

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.

Why it matters now

Exploitation Active In CISA KEV since 2025-12-05CISA due date 2025-12-12Known ransomware use
EPSS 0.99731 99th percentileScored 2026-11-07
Fix Fixed react-server-dom-webpack (npm): 19.0.1, 19.1.2, 19.2.1react-server-dom-turbopack (npm): 19.0.1, 19.1.2, 19.2.1+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Active
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Metareact-server-dom-webpack19.0.0 – 19.0.0; 19.1.0 – 19.1.1; 19.2.0 – 19.2.0—No fix listedCNA
Metareact-server-dom-turbopack19.0.0 – 19.0.0; 19.1.0 – 19.1.1; 19.2.0 – 19.2.0—No fix listedCNA
Metareact-server-dom-parcel19.0.0 – 19.0.0; 19.1.0 – 19.1.1; 19.2.0 – 19.2.0—No fix listedCNA
—react-server-dom-webpack (npm)19.0.0 to before 19.0.119.0.1Patch availableGHSA-fv66-9v8q-g76r
—react-server-dom-webpack (npm)19.1.0 to before 19.1.219.1.2Patch availableGHSA-fv66-9v8q-g76r
—react-server-dom-webpack (npm)19.2.0 to before 19.2.119.2.1Patch availableGHSA-fv66-9v8q-g76r
—react-server-dom-turbopack (npm)19.0.0 to before 19.0.119.0.1Patch availableGHSA-fv66-9v8q-g76r
—react-server-dom-turbopack (npm)19.1.0 to before 19.1.219.1.2Patch availableGHSA-fv66-9v8q-g76r
—react-server-dom-turbopack (npm)19.2.0 to before 19.2.119.2.1Patch availableGHSA-fv66-9v8q-g76r
—react-server-dom-parcel (npm)19.0.0 to before 19.0.119.0.1Patch availableGHSA-fv66-9v8q-g76r
—react-server-dom-parcel (npm)19.1.0 to before 19.1.219.1.2Patch availableGHSA-fv66-9v8q-g76r
—react-server-dom-parcel (npm)19.2.0 to before 19.2.119.2.1Patch availableGHSA-fv66-9v8q-g76r
  • react-server-dom-webpack VendorMeta Affected 19.0.0 – 19.0.0; 19.1.0 – 19.1.1; 19.2.0 – 19.2.0 Fixed in — No fix listed CNA
  • react-server-dom-turbopack VendorMeta Affected 19.0.0 – 19.0.0; 19.1.0 – 19.1.1; 19.2.0 – 19.2.0 Fixed in — No fix listed CNA
  • react-server-dom-parcel VendorMeta Affected 19.0.0 – 19.0.0; 19.1.0 – 19.1.1; 19.2.0 – 19.2.0 Fixed in — No fix listed CNA
  • react-server-dom-webpack (npm) Vendor— Affected 19.0.0 to before 19.0.1 Fixed in 19.0.1 Patch available GHSA-fv66-9v8q-g76r
  • react-server-dom-webpack (npm) Vendor— Affected 19.1.0 to before 19.1.2 Fixed in 19.1.2 Patch available GHSA-fv66-9v8q-g76r
  • react-server-dom-webpack (npm) Vendor— Affected 19.2.0 to before 19.2.1 Fixed in 19.2.1 Patch available GHSA-fv66-9v8q-g76r
  • react-server-dom-turbopack (npm) Vendor— Affected 19.0.0 to before 19.0.1 Fixed in 19.0.1 Patch available GHSA-fv66-9v8q-g76r
  • react-server-dom-turbopack (npm) Vendor— Affected 19.1.0 to before 19.1.2 Fixed in 19.1.2 Patch available GHSA-fv66-9v8q-g76r
  • react-server-dom-turbopack (npm) Vendor— Affected 19.2.0 to before 19.2.1 Fixed in 19.2.1 Patch available GHSA-fv66-9v8q-g76r
  • react-server-dom-parcel (npm) Vendor— Affected 19.0.0 to before 19.0.1 Fixed in 19.0.1 Patch available GHSA-fv66-9v8q-g76r
  • react-server-dom-parcel (npm) Vendor— Affected 19.1.0 to before 19.1.2 Fixed in 19.1.2 Patch available GHSA-fv66-9v8q-g76r
  • react-server-dom-parcel (npm) Vendor— Affected 19.2.0 to before 19.2.1 Fixed in 19.2.1 Patch available GHSA-fv66-9v8q-g76r

CPE configurations NVD · 76

CPEVersionsRoleVendor
cpe:2.3:a:facebook:react:19.0.0:*:*:*:*:*:*:*19.0.0VulnerableMeta
cpe:2.3:a:facebook:react:19.1.0:*:*:*:*:*:*:*19.1.0VulnerableMeta
cpe:2.3:a:facebook:react:19.1.1:*:*:*:*:*:*:*19.1.1VulnerableMeta
cpe:2.3:a:facebook:react:19.2.0:*:*:*:*:*:*:*19.2.0VulnerableMeta
cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*15.0.0 to before 15.0.5; 15.1.0 to before 15.1.9; 15.2.0 to before 15.2.6; 15.3.0 to before 15.3.6; 15.4.0 to before 15.4.8; 15.5.0 to before 15.5.7; 16.0.0 to before 16.0.7Vulnerablevercel
cpe:2.3:a:vercel:next.js:14.3.0:canary77:*:*:*:node.js:*:*14.3.0 canary77Vulnerablevercel
cpe:2.3:a:vercel:next.js:14.3.0:canary78:*:*:*:node.js:*:*14.3.0 canary78Vulnerablevercel
cpe:2.3:a:vercel:next.js:14.3.0:canary79:*:*:*:node.js:*:*14.3.0 canary79Vulnerablevercel
cpe:2.3:a:vercel:next.js:14.3.0:canary80:*:*:*:node.js:*:*14.3.0 canary80Vulnerablevercel
cpe:2.3:a:vercel:next.js:14.3.0:canary81:*:*:*:node.js:*:*14.3.0 canary81Vulnerablevercel
  • cpe:2.3:a:facebook:react:19.0.0:*:*:*:*:*:*:* Versions 19.0.0 Vulnerable ·Meta
  • cpe:2.3:a:facebook:react:19.1.0:*:*:*:*:*:*:* Versions 19.1.0 Vulnerable ·Meta
  • cpe:2.3:a:facebook:react:19.1.1:*:*:*:*:*:*:* Versions 19.1.1 Vulnerable ·Meta
  • cpe:2.3:a:facebook:react:19.2.0:*:*:*:*:*:*:* Versions 19.2.0 Vulnerable ·Meta
  • cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:* Versions 15.0.0 to before 15.0.5; 15.1.0 to before 15.1.9; 15.2.0 to before 15.2.6; 15.3.0 to before 15.3.6; 15.4.0 to before 15.4.8; 15.5.0 to before 15.5.7; 16.0.0 to before 16.0.7 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:14.3.0:canary77:*:*:*:node.js:*:* Versions 14.3.0 canary77 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:14.3.0:canary78:*:*:*:node.js:*:* Versions 14.3.0 canary78 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:14.3.0:canary79:*:*:*:node.js:*:* Versions 14.3.0 canary79 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:14.3.0:canary80:*:*:*:node.js:*:* Versions 14.3.0 canary80 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:14.3.0:canary81:*:*:*:node.js:*:* Versions 14.3.0 canary81 Vulnerable ·vercel
Show 66 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:vercel:next.js:14.3.0:canary82:*:*:*:node.js:*:*14.3.0 canary82Vulnerablevercel
cpe:2.3:a:vercel:next.js:14.3.0:canary83:*:*:*:node.js:*:*14.3.0 canary83Vulnerablevercel
cpe:2.3:a:vercel:next.js:14.3.0:canary84:*:*:*:node.js:*:*14.3.0 canary84Vulnerablevercel
cpe:2.3:a:vercel:next.js:14.3.0:canary85:*:*:*:node.js:*:*14.3.0 canary85Vulnerablevercel
cpe:2.3:a:vercel:next.js:14.3.0:canary86:*:*:*:node.js:*:*14.3.0 canary86Vulnerablevercel
cpe:2.3:a:vercel:next.js:14.3.0:canary87:*:*:*:node.js:*:*14.3.0 canary87Vulnerablevercel
cpe:2.3:a:vercel:next.js:15.6.0:-:*:*:*:node.js:*:*15.6.0Vulnerablevercel
cpe:2.3:a:vercel:next.js:15.6.0:canary0:*:*:*:node.js:*:*15.6.0 canary0Vulnerablevercel
cpe:2.3:a:vercel:next.js:15.6.0:canary1:*:*:*:node.js:*:*15.6.0 canary1Vulnerablevercel
cpe:2.3:a:vercel:next.js:15.6.0:canary10:*:*:*:node.js:*:*15.6.0 canary10Vulnerablevercel
cpe:2.3:a:vercel:next.js:15.6.0:canary11:*:*:*:node.js:*:*15.6.0 canary11Vulnerablevercel
cpe:2.3:a:vercel:next.js:15.6.0:canary12:*:*:*:node.js:*:*15.6.0 canary12Vulnerablevercel
cpe:2.3:a:vercel:next.js:15.6.0:canary13:*:*:*:node.js:*:*15.6.0 canary13Vulnerablevercel
cpe:2.3:a:vercel:next.js:15.6.0:canary14:*:*:*:node.js:*:*15.6.0 canary14Vulnerablevercel
cpe:2.3:a:vercel:next.js:15.6.0:canary15:*:*:*:node.js:*:*15.6.0 canary15Vulnerablevercel
cpe:2.3:a:vercel:next.js:15.6.0:canary16:*:*:*:node.js:*:*15.6.0 canary16Vulnerablevercel
cpe:2.3:a:vercel:next.js:15.6.0:canary17:*:*:*:node.js:*:*15.6.0 canary17Vulnerablevercel
cpe:2.3:a:vercel:next.js:15.6.0:canary18:*:*:*:node.js:*:*15.6.0 canary18Vulnerablevercel
cpe:2.3:a:vercel:next.js:15.6.0:canary19:*:*:*:node.js:*:*15.6.0 canary19Vulnerablevercel
cpe:2.3:a:vercel:next.js:15.6.0:canary2:*:*:*:node.js:*:*15.6.0 canary2Vulnerablevercel
cpe:2.3:a:vercel:next.js:15.6.0:canary20:*:*:*:node.js:*:*15.6.0 canary20Vulnerablevercel
cpe:2.3:a:vercel:next.js:15.6.0:canary21:*:*:*:node.js:*:*15.6.0 canary21Vulnerablevercel
cpe:2.3:a:vercel:next.js:15.6.0:canary22:*:*:*:node.js:*:*15.6.0 canary22Vulnerablevercel
cpe:2.3:a:vercel:next.js:15.6.0:canary23:*:*:*:node.js:*:*15.6.0 canary23Vulnerablevercel
cpe:2.3:a:vercel:next.js:15.6.0:canary24:*:*:*:node.js:*:*15.6.0 canary24Vulnerablevercel
cpe:2.3:a:vercel:next.js:15.6.0:canary25:*:*:*:node.js:*:*15.6.0 canary25Vulnerablevercel
cpe:2.3:a:vercel:next.js:15.6.0:canary26:*:*:*:node.js:*:*15.6.0 canary26Vulnerablevercel
cpe:2.3:a:vercel:next.js:15.6.0:canary27:*:*:*:node.js:*:*15.6.0 canary27Vulnerablevercel
cpe:2.3:a:vercel:next.js:15.6.0:canary28:*:*:*:node.js:*:*15.6.0 canary28Vulnerablevercel
cpe:2.3:a:vercel:next.js:15.6.0:canary29:*:*:*:node.js:*:*15.6.0 canary29Vulnerablevercel
cpe:2.3:a:vercel:next.js:15.6.0:canary3:*:*:*:node.js:*:*15.6.0 canary3Vulnerablevercel
cpe:2.3:a:vercel:next.js:15.6.0:canary30:*:*:*:node.js:*:*15.6.0 canary30Vulnerablevercel
cpe:2.3:a:vercel:next.js:15.6.0:canary31:*:*:*:node.js:*:*15.6.0 canary31Vulnerablevercel
cpe:2.3:a:vercel:next.js:15.6.0:canary32:*:*:*:node.js:*:*15.6.0 canary32Vulnerablevercel
cpe:2.3:a:vercel:next.js:15.6.0:canary33:*:*:*:node.js:*:*15.6.0 canary33Vulnerablevercel
cpe:2.3:a:vercel:next.js:15.6.0:canary34:*:*:*:node.js:*:*15.6.0 canary34Vulnerablevercel
cpe:2.3:a:vercel:next.js:15.6.0:canary35:*:*:*:node.js:*:*15.6.0 canary35Vulnerablevercel
cpe:2.3:a:vercel:next.js:15.6.0:canary36:*:*:*:node.js:*:*15.6.0 canary36Vulnerablevercel
cpe:2.3:a:vercel:next.js:15.6.0:canary37:*:*:*:node.js:*:*15.6.0 canary37Vulnerablevercel
cpe:2.3:a:vercel:next.js:15.6.0:canary38:*:*:*:node.js:*:*15.6.0 canary38Vulnerablevercel
cpe:2.3:a:vercel:next.js:15.6.0:canary39:*:*:*:node.js:*:*15.6.0 canary39Vulnerablevercel
cpe:2.3:a:vercel:next.js:15.6.0:canary4:*:*:*:node.js:*:*15.6.0 canary4Vulnerablevercel
cpe:2.3:a:vercel:next.js:15.6.0:canary40:*:*:*:node.js:*:*15.6.0 canary40Vulnerablevercel
cpe:2.3:a:vercel:next.js:15.6.0:canary41:*:*:*:node.js:*:*15.6.0 canary41Vulnerablevercel
cpe:2.3:a:vercel:next.js:15.6.0:canary42:*:*:*:node.js:*:*15.6.0 canary42Vulnerablevercel
cpe:2.3:a:vercel:next.js:15.6.0:canary43:*:*:*:node.js:*:*15.6.0 canary43Vulnerablevercel
cpe:2.3:a:vercel:next.js:15.6.0:canary44:*:*:*:node.js:*:*15.6.0 canary44Vulnerablevercel
cpe:2.3:a:vercel:next.js:15.6.0:canary45:*:*:*:node.js:*:*15.6.0 canary45Vulnerablevercel
cpe:2.3:a:vercel:next.js:15.6.0:canary46:*:*:*:node.js:*:*15.6.0 canary46Vulnerablevercel
cpe:2.3:a:vercel:next.js:15.6.0:canary47:*:*:*:node.js:*:*15.6.0 canary47Vulnerablevercel
cpe:2.3:a:vercel:next.js:15.6.0:canary48:*:*:*:node.js:*:*15.6.0 canary48Vulnerablevercel
cpe:2.3:a:vercel:next.js:15.6.0:canary49:*:*:*:node.js:*:*15.6.0 canary49Vulnerablevercel
cpe:2.3:a:vercel:next.js:15.6.0:canary5:*:*:*:node.js:*:*15.6.0 canary5Vulnerablevercel
cpe:2.3:a:vercel:next.js:15.6.0:canary50:*:*:*:node.js:*:*15.6.0 canary50Vulnerablevercel
cpe:2.3:a:vercel:next.js:15.6.0:canary51:*:*:*:node.js:*:*15.6.0 canary51Vulnerablevercel
cpe:2.3:a:vercel:next.js:15.6.0:canary52:*:*:*:node.js:*:*15.6.0 canary52Vulnerablevercel
cpe:2.3:a:vercel:next.js:15.6.0:canary53:*:*:*:node.js:*:*15.6.0 canary53Vulnerablevercel
cpe:2.3:a:vercel:next.js:15.6.0:canary54:*:*:*:node.js:*:*15.6.0 canary54Vulnerablevercel
cpe:2.3:a:vercel:next.js:15.6.0:canary55:*:*:*:node.js:*:*15.6.0 canary55Vulnerablevercel
cpe:2.3:a:vercel:next.js:15.6.0:canary56:*:*:*:node.js:*:*15.6.0 canary56Vulnerablevercel
cpe:2.3:a:vercel:next.js:15.6.0:canary57:*:*:*:node.js:*:*15.6.0 canary57Vulnerablevercel
cpe:2.3:a:vercel:next.js:15.6.0:canary6:*:*:*:node.js:*:*15.6.0 canary6Vulnerablevercel
cpe:2.3:a:vercel:next.js:15.6.0:canary7:*:*:*:node.js:*:*15.6.0 canary7Vulnerablevercel
cpe:2.3:a:vercel:next.js:15.6.0:canary8:*:*:*:node.js:*:*15.6.0 canary8Vulnerablevercel
cpe:2.3:a:vercel:next.js:15.6.0:canary9:*:*:*:node.js:*:*15.6.0 canary9Vulnerablevercel
cpe:2.3:a:vercel:next.js:16.0.0:-:*:*:*:node.js:*:*16.0.0Vulnerablevercel
  • cpe:2.3:a:vercel:next.js:14.3.0:canary82:*:*:*:node.js:*:* Versions 14.3.0 canary82 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:14.3.0:canary83:*:*:*:node.js:*:* Versions 14.3.0 canary83 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:14.3.0:canary84:*:*:*:node.js:*:* Versions 14.3.0 canary84 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:14.3.0:canary85:*:*:*:node.js:*:* Versions 14.3.0 canary85 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:14.3.0:canary86:*:*:*:node.js:*:* Versions 14.3.0 canary86 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:14.3.0:canary87:*:*:*:node.js:*:* Versions 14.3.0 canary87 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:15.6.0:-:*:*:*:node.js:*:* Versions 15.6.0 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:15.6.0:canary0:*:*:*:node.js:*:* Versions 15.6.0 canary0 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:15.6.0:canary1:*:*:*:node.js:*:* Versions 15.6.0 canary1 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:15.6.0:canary10:*:*:*:node.js:*:* Versions 15.6.0 canary10 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:15.6.0:canary11:*:*:*:node.js:*:* Versions 15.6.0 canary11 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:15.6.0:canary12:*:*:*:node.js:*:* Versions 15.6.0 canary12 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:15.6.0:canary13:*:*:*:node.js:*:* Versions 15.6.0 canary13 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:15.6.0:canary14:*:*:*:node.js:*:* Versions 15.6.0 canary14 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:15.6.0:canary15:*:*:*:node.js:*:* Versions 15.6.0 canary15 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:15.6.0:canary16:*:*:*:node.js:*:* Versions 15.6.0 canary16 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:15.6.0:canary17:*:*:*:node.js:*:* Versions 15.6.0 canary17 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:15.6.0:canary18:*:*:*:node.js:*:* Versions 15.6.0 canary18 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:15.6.0:canary19:*:*:*:node.js:*:* Versions 15.6.0 canary19 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:15.6.0:canary2:*:*:*:node.js:*:* Versions 15.6.0 canary2 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:15.6.0:canary20:*:*:*:node.js:*:* Versions 15.6.0 canary20 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:15.6.0:canary21:*:*:*:node.js:*:* Versions 15.6.0 canary21 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:15.6.0:canary22:*:*:*:node.js:*:* Versions 15.6.0 canary22 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:15.6.0:canary23:*:*:*:node.js:*:* Versions 15.6.0 canary23 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:15.6.0:canary24:*:*:*:node.js:*:* Versions 15.6.0 canary24 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:15.6.0:canary25:*:*:*:node.js:*:* Versions 15.6.0 canary25 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:15.6.0:canary26:*:*:*:node.js:*:* Versions 15.6.0 canary26 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:15.6.0:canary27:*:*:*:node.js:*:* Versions 15.6.0 canary27 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:15.6.0:canary28:*:*:*:node.js:*:* Versions 15.6.0 canary28 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:15.6.0:canary29:*:*:*:node.js:*:* Versions 15.6.0 canary29 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:15.6.0:canary3:*:*:*:node.js:*:* Versions 15.6.0 canary3 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:15.6.0:canary30:*:*:*:node.js:*:* Versions 15.6.0 canary30 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:15.6.0:canary31:*:*:*:node.js:*:* Versions 15.6.0 canary31 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:15.6.0:canary32:*:*:*:node.js:*:* Versions 15.6.0 canary32 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:15.6.0:canary33:*:*:*:node.js:*:* Versions 15.6.0 canary33 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:15.6.0:canary34:*:*:*:node.js:*:* Versions 15.6.0 canary34 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:15.6.0:canary35:*:*:*:node.js:*:* Versions 15.6.0 canary35 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:15.6.0:canary36:*:*:*:node.js:*:* Versions 15.6.0 canary36 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:15.6.0:canary37:*:*:*:node.js:*:* Versions 15.6.0 canary37 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:15.6.0:canary38:*:*:*:node.js:*:* Versions 15.6.0 canary38 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:15.6.0:canary39:*:*:*:node.js:*:* Versions 15.6.0 canary39 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:15.6.0:canary4:*:*:*:node.js:*:* Versions 15.6.0 canary4 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:15.6.0:canary40:*:*:*:node.js:*:* Versions 15.6.0 canary40 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:15.6.0:canary41:*:*:*:node.js:*:* Versions 15.6.0 canary41 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:15.6.0:canary42:*:*:*:node.js:*:* Versions 15.6.0 canary42 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:15.6.0:canary43:*:*:*:node.js:*:* Versions 15.6.0 canary43 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:15.6.0:canary44:*:*:*:node.js:*:* Versions 15.6.0 canary44 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:15.6.0:canary45:*:*:*:node.js:*:* Versions 15.6.0 canary45 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:15.6.0:canary46:*:*:*:node.js:*:* Versions 15.6.0 canary46 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:15.6.0:canary47:*:*:*:node.js:*:* Versions 15.6.0 canary47 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:15.6.0:canary48:*:*:*:node.js:*:* Versions 15.6.0 canary48 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:15.6.0:canary49:*:*:*:node.js:*:* Versions 15.6.0 canary49 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:15.6.0:canary5:*:*:*:node.js:*:* Versions 15.6.0 canary5 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:15.6.0:canary50:*:*:*:node.js:*:* Versions 15.6.0 canary50 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:15.6.0:canary51:*:*:*:node.js:*:* Versions 15.6.0 canary51 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:15.6.0:canary52:*:*:*:node.js:*:* Versions 15.6.0 canary52 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:15.6.0:canary53:*:*:*:node.js:*:* Versions 15.6.0 canary53 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:15.6.0:canary54:*:*:*:node.js:*:* Versions 15.6.0 canary54 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:15.6.0:canary55:*:*:*:node.js:*:* Versions 15.6.0 canary55 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:15.6.0:canary56:*:*:*:node.js:*:* Versions 15.6.0 canary56 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:15.6.0:canary57:*:*:*:node.js:*:* Versions 15.6.0 canary57 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:15.6.0:canary6:*:*:*:node.js:*:* Versions 15.6.0 canary6 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:15.6.0:canary7:*:*:*:node.js:*:* Versions 15.6.0 canary7 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:15.6.0:canary8:*:*:*:node.js:*:* Versions 15.6.0 canary8 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:15.6.0:canary9:*:*:*:node.js:*:* Versions 15.6.0 canary9 Vulnerable ·vercel
  • cpe:2.3:a:vercel:next.js:16.0.0:-:*:*:*:node.js:*:* Versions 16.0.0 Vulnerable ·vercel

Remediation

  • Fix · GHSA-fv66-9v8q-g76r react-server-dom-webpack (npm) Fixed in 19.0.1 Advisory →
  • Fix · GHSA-fv66-9v8q-g76r react-server-dom-webpack (npm) Fixed in 19.1.2 Advisory →
  • Fix · GHSA-fv66-9v8q-g76r react-server-dom-webpack (npm) Fixed in 19.2.1 Advisory →
  • Fix · GHSA-fv66-9v8q-g76r react-server-dom-turbopack (npm) Fixed in 19.0.1 Advisory →
  • Fix · GHSA-fv66-9v8q-g76r react-server-dom-turbopack (npm) Fixed in 19.1.2 Advisory →
  • Fix · GHSA-fv66-9v8q-g76r react-server-dom-turbopack (npm) Fixed in 19.2.1 Advisory →
  • Fix · GHSA-fv66-9v8q-g76r react-server-dom-parcel (npm) Fixed in 19.0.1 Advisory →
  • Fix · GHSA-fv66-9v8q-g76r react-server-dom-parcel (npm) Fixed in 19.1.2 Advisory →
  • Fix · GHSA-fv66-9v8q-g76r react-server-dom-parcel (npm) Fixed in 19.2.1 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Critical. Red Hat's page for this CVE →

Not affected: 9 products
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat Enterprise Linux AI (RHEL AI) 3
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat Trusted Artifact Signer
  • streams for Apache Kafka 2
  • streams for Apache Kafka 3

Timeline

  1. 2025-12-05 Added to CISA KEV
  2. 2026-10-02 Threatist record created from CVE-2025-55182
  3. 2026-10-03 Alias added: GHSA-fv66-9v8q-g76r
  4. 2026-10-07 Weakness changed · CISA ADP
  5. 2026-10-07 CISA SSVC decision points changed

References

Patch 2

Advisory 3

Other 9

  • TI-2025-34863 Deserialization of untrusted data in Meta react-server-dom-webpack CVSS 3.1HIGH 7.5
  • TI-2025-34862 Deserialization of untrusted data in Meta react-server-dom-webpack CVSS 3.1MEDIUM 5.3
  • TI-2025-41449 Uncontrolled resource consumption in Meta react-server-dom-parcel CVSS 3.1HIGH 7.5
  • TI-2026-19225 Uncontrolled resource consumption in Meta react-server-dom-webpack CVSS 3.1HIGH 7.5
  • TI-2018-04665 Cross-site scripting in Meta react-dom CVSS 3.1MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences