CVE-2025-55182

Name of the Vulnerable Software and Affected Versions react-server-dom-webpack versions 19.0.0 through 19.2.0 react-server-dom-parcel versions 19.0.0 through 19.2.0 react-server-dom-turbopack versions 19.0.0 through 19.2.0 Next.js versions 15.x through 16.x Next.js versions 14.3.0-canary.77 through 14.3.x

Description An unauthenticated remote code execution issue exists in React Server Components due to unsafe deserialization of payloads in HTTP requests sent to Server Function endpoints. The flaw is specifically linked to the requireModule() function and deficiencies in the deserialization mechanism when processing the hasOwnProperty parameter. This allows a remote attacker to execute arbitrary JavaScript code in the server context. Real-world exploitation has been observed, including the deployment of EtherRAT (a Node.js backdoor using blockchain-based C2), cryptocurrency mining, and the Weaxor ransomware, which can encrypt files and delete volume shadow copies within minutes of initial access.

Recommendations Update react-server-dom-webpack to versions 19.0.1, 19.1.2, or 19.2.1. Update react-server-dom-parcel to versions 19.0.1, 19.1.2, or 19.2.1. Update react-server-dom-turbopack to versions 19.0.1, 19.1.2, or 19.2.1. Update Next.js to versions 15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7, 16.0.7, 15.6.0-canary.58, or 16.1.0-canary.12+. Downgrade Next.js 14.3 canary builds to a 14.x stable release or version 14.3.0-canary.76. As a temporary mitigation, restrict access to Server Function endpoints or apply WAF rules to detect and block exploitation attempts.