CVE-2025-55182

A flaw was found in the React Server Components (RSC) protocol in which an attacker could send a malicious package to a Server Function endpoint and cause unauthenticated remote code execution. This is possible due to the way the affected packages deserialized untrusted data.

The reference implementation of React Server Components is used by other projects such as Next.js. Next.js requested a CVE to track their impacted versions, CVE-2025-66478, but that CVE was rejected as a duplicate of this one. We list here packages which include Next.js as a dependency, but our analysis indicates that they are not affected by the vulnerability as they do not use the App Router functionality that exposes endpoints serving the vulnerable protocol.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.