React Discloses Critical Server Components Flaw

The React development team disclosed a critical vulnerability in React Server Components on Wednesday, urging developers worldwide to immediately update affected versions to prevent potential remote code execution by unauthenticated attackers. The flaw, tracked as CVE-2025-55182 and assigned a maximum severity score of 10.0 on the CVSS scale, impacts a widely used open-source JavaScript library essential for building interactive web interfaces.

The vulnerability stems from an unsafe deserialization process in how React handles payloads for Server Function endpoints, a feature that enables client-server communication in React Server Components. According to the React team, an attacker could craft a malicious HTTP request that, when processed by the server, executes arbitrary JavaScript code. This risk extends even to applications that do not explicitly implement Server Functions but support React Server Components overall. The issue affects React versions 19.0.0 through 19.2.0, including related packages such as react-server-dom-webpack and react-server-dom-turbopack. Patches have been released in versions 19.0.1, 19.1.2, and 19.2.1, with detailed upgrade instructions provided...