CVE-2025-55182: Pre-auth RCE in React Server Components

CVE-2025-55182 describes a pre-authentication remote code execution vulnerability in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 in react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack packages. The flaw lies in how the code deserializes payloads received from HTTP requests to Server Function endpoints without sufficient validation. It directly impacts system administrators, DevOps teams, and developers managing critical applications on these React versions.

The vulnerability has been assigned a CVSS score of 10.0 and is classified critical. Pre-authentication RCE requires no credentials and enables arbitrary code execution on affected servers: it is the maximum degree of compromise. Non-official signals from October 31, 2026 indicate the CVE was cited among the most exploited vulnerabilities of that week. No public exploit repositories have been confirmed, but the simplicity of unsafe deserialization combined with consistent signals suggests active exploitation credibility.

Defense: 1) Inventory all React Server Components dependencies and verify which version is in use. 2) If within 19.0.0-19.2.0 range, immediately seek patch from official React repository. 3) Configure logging on all Server Function endpoints to detect anomalous payloads or deserialization errors. 4) Consider WAF or rate limiting on these endpoints if exposed. 5) Apply updates as soon as available and review historical logs for suspicious access.