CVE-2025-55182Critical· 10.0▾ Hadal⚠ Exploited in the wildPoC availableA pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-serve…
▾ Hadal zone — Critical and actively exploited (CISA KEV / 0day)
impact 55 · likelihood 20 · exploitation 25 · ransomware 5
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 4 sources. Availability, not in-the-wild use.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Aug 4.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Federal remediation due Dec 12, 2025
100%
100% → 100%
Last analysed / modified upstream
Exploit-DB · 456 GitHub repos · Metasploit ×1 · Nuclei ×1 (last check)
Added to the CISA catalog on Dec 5, 2025. Federal remediation due Dec 12, 2025. View catalog ↗
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.
react = 19.0.0react = 19.1.0react = 19.1.1react = 19.2.0next.js >= 15.0.0, < 15.0.5next.js >= 15.1.0, < 15.1.9next.js >= 15.2.0, < 15.2.6next.js >= 15.3.0, < 15.3.6next.js >= 15.4.0, < 15.4.8next.js >= 15.5.0, < 15.5.7next.js >= 16.0.0, < 16.0.7next.js = 14.3.0next.js = 15.6.0next.js = 16.0.0Upgrade past the affected range:
next.js 16.0.7Connected by shared product, vendor, weakness, or advisory.
CVE-2025-67779High· 7.5It was found that the fix addressing CVE-2025-55184 in React Server Components was incomplete and does not prevent a denial of service attack in a specific case
CVE-2025-55184High· 7.5A pre-authentication denial of service vulnerability exists in React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following packages: react-server-dom-parcel, react-server-dom-turbopa…
CVE-2025-26399Critical· 9.8SolarWinds Web Help Desk was found to be susceptible to an unauthenticated AjaxProxy deserialization remote code execution vulnerability that, if exploited, would allow an attacker to run commands on the host machine
CVE-2021-23758High· 8.1All versions of package ajaxpro.2 are vulnerable to Deserialization of Untrusted Data due to the possibility of deserialization of arbitrary .NET classes, which can be abused to gain remote code execution.
CVE-2020-0618High· 8.8A remote code execution vulnerability exists in Microsoft SQL Server Reporting Services when it incorrectly handles page requests, aka 'Microsoft SQL Server Reporting Services Remote Code Execution Vulnerability'.
CVE-2021-26857High· 7.8Microsoft Exchange Server Remote Code Execution Vulnerability