On December 3rd, React disclosed CVE-2025-55182 - a pre-authentication remote code execution vulnerability in React Server Components with a CVSS score of 10.0.

The vulnerability affects the react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack packages in React versions 19.0.0 through 19.2.0. If you’re running Next.js, React Router with RSC, Waku, or other frameworks using these packages, you’ll want to check your systems.

The Vulnerability

React Server Components introduce a way for clients to call server-side functions through HTTP requests. When a user interacts with a Server Action (like submitting a form), React serializes the function reference and its arguments into a multipart form payload and sends it to the server. The server then deserializes this payload, resolves the function, and executes it.

The core issue is in how React’s Flight protocol parses incoming payloads. The actual exploit technique used in the wild leverages prototype pollution through the deserialization process, not direct module loading as initially reported.

The Prototype Pollution Chain

The real-world exploit uses a prototype pollution gadget chain that’s more reliable than module-based approaches. The attack works by:

1. Polluting Promise.prototype.then via $1:__proto__:then - This hijacks how React handles resolved server chunks
2. Injecting a resolved_model status - Makes React think this is a legitimate resolved server chunk
3. Reaching Function.constructor via $1:constructor:constructor - Accesses the Function constructor through the prototype chain
4. Executing arbitrary code via the _prefix field - Code placed here gets executed when the constructor is invoked

The payload structure looks like this:

{
  "then": "$1:__proto__:then",
  "status": "resolved_model",
  "reason": -1,
  "value": "{\"then\":\"$Baced\"}",
  "_response": {
    "_prefix": "<arbitrary JavaScript code>",
    "_chunks": "$Q2",
    "_formData": {
      "get": "$1:constructor:constructor"
    }
  }
}

This is sent as a multipart form POST to any RSC endpoint. The Next-Action header triggers the Server Action handling code path.

Why This Approach Works

The prototype pollution chain is what actual attackers use because:

• Bypasses WAFs - The payload looks like normal JSON data, not obvious code injection
• Works with production error handling - Output can be extracted via the error digest field
• Exploits the actual React Flight protocol parsing bug - Not a theoretical code path
• Matches how real RSC payloads are structured - Harder to filter without breaking legitimate functionality

Early reports focused on module-based probes like vm#runInThisContext and fs#existsSync. While these work in lab environments, the prototype pollution approach is what’s being used in active exploitation because it’s more reliable against production deployments.

Real-World Prevalence

This vulnerability is widespread across production React applications.

The key factors:

• Any RSC endpoint is potentially vulnerable - Not just explicit Server Actions. The Flight protocol parsing happens before action validation.
• Default Next.js 15+ configurations expose RSC endpoints - The App Router enables RSC by default.
• The exploit bypasses common protections - WAFs and rate limiters often don’t catch it because the payload structure is valid JSON.

If you’re running React 19.0.0-19.2.0 with any RSC-enabled framework in production, assume you’re vulnerable until patched.

Detection

To detect exploitation attempts, look for:

• POST requests to RSC endpoints (/_next/action, /api/*, etc.) with Next-Action header
• Multipart form data containing __proto__, constructor, or resolved_model
• Error responses containing unexpected digest values

The vulnerability is exploited by sending a crafted multipart form payload. A safe detection method uses a canary string in the _prefix field - if the canary appears in the error digest response, the target is vulnerable.

Affected Frameworks

The following are affected when using vulnerable React versions:

• Next.js - All versions using React 19.0.0-19.2.0
• React Router - RSC APIs
• Waku
• Parcel RSC (@parcel/rsc)
• Vite RSC (@vitejs/plugin-rsc)
• Redwood SDK (rwsdk)

Patching

Upgrade to patched versions immediately:

• React: 19.0.1, 19.1.2, or 19.2.1
• Next.js: 15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7, or 16.0.7

References

• React Security Advisory
• NVD Entry
• Meta Security Advisory