Description
Meta React Server Components contains a remote code execution vulnerability that could allow unauthenticated remote code execution by exploiting a flaw in how React decodes payloads sent to React Server Function endpoints. Please note CVE-2025-66478 has been rejected, but it is associated with CVE-2025- 55182.
Full record on cve.org →Affected packages
| Package | Vendor / Product | Version range | Status |
|---|---|---|---|
| react-server-dom-parcel | Meta / react-server-dom-parcel | >= 19.0.0, <= 19.0.0 | affected |
| react-server-dom-parcel | Meta / react-server-dom-parcel | >= 19.1.0, <= 19.1.1 | affected |
| react-server-dom-parcel | Meta / react-server-dom-parcel | >= 19.2.0, <= 19.2.0 | affected |
| react-server-dom-turbopack | Meta / react-server-dom-turbopack | >= 19.0.0, <= 19.0.0 | affected |
| react-server-dom-turbopack | Meta / react-server-dom-turbopack | >= 19.1.0, <= 19.1.1 | affected |
| react-server-dom-turbopack | Meta / react-server-dom-turbopack | >= 19.2.0, <= 19.2.0 | affected |
| react-server-dom-webpack | Meta / react-server-dom-webpack | >= 19.0.0, <= 19.0.0 | affected |
| react-server-dom-webpack | Meta / react-server-dom-webpack | >= 19.1.0, <= 19.1.1 | affected |
| react-server-dom-webpack | Meta / react-server-dom-webpack | >= 19.2.0, <= 19.2.0 | affected |