The vulnerability of the requireModule() function in the React framework-based JavaScript libraries react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack, which are used for building custom user interfaces, allows a hacker to execute arbitrary code.

🗓️ 04 Dec 2025 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 3 Views

Deserialization flaw in requireModule() of React server libraries enables arbitrary code execution via crafted requests.

Reporter	Title	Published	Views	Family All 481
GithubExploit	Exploit for Deserialization of Untrusted Data in Facebook React	31 Dec 202514:20	–	githubexploit
GithubExploit	Exploit for Deserialization of Untrusted Data in Facebook React	9 Dec 202506:46	–	githubexploit
GithubExploit	Exploit for CVE-2025-55182	4 Dec 202501:26	–	githubexploit
GithubExploit	Exploit for CVE-2025-55182	5 Dec 202517:47	–	githubexploit
GithubExploit	Exploit for Deserialization of Untrusted Data in Facebook React	7 Jan 202620:51	–	githubexploit
GithubExploit	Exploit for Deserialization of Untrusted Data in Facebook React	15 Dec 202514:56	–	githubexploit
GithubExploit	Exploit for Deserialization of Untrusted Data in Facebook React	6 Dec 202517:32	–	githubexploit
GithubExploit	Exploit for CVE-2025-55182	5 Dec 202508:40	–	githubexploit
GithubExploit	Exploit for CVE-2025-55182	4 Dec 202518:30	–	githubexploit
GithubExploit	Exploit for Deserialization of Untrusted Data in Facebook React	9 Dec 202503:48	–	githubexploit

Vulners

Node

OR

meta_platforms react-server-dom-webpackRange<19.0.1

meta_platforms react-server-dom-webpackRange<19.1.2

meta_platforms react-server-dom-webpackRange<19.2.1

meta_platforms react-server-dom-parcelRange<19.0.1

meta_platforms react-server-dom-parcelRange<19.1.2

meta_platforms react-server-dom-parcelRange<19.2.1

meta_platforms react-server-dom-turbopackRange<19.0.1

meta_platforms react-server-dom-turbopackRange<19.1.2

meta_platforms react-server-dom-turbopackRange<19.2.1

vercel next.jsRange<15.0.5

vercel next.jsRange<15.1.9

vercel next.jsRange<15.2.6

vercel next.jsRange<15.3.6

vercel next.jsRange<15.4.8

vercel next.jsRange<15.5.7

vercel next.jsRange<16.0.7

vercel next.jsRange≤14.3.0-canary.77

redwoodjs_core redwood_sdkRange<1.0.0-alpha.0

Source	Link
react	www.react.dev/versions
react	www.react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components
nextjs	www.nextjs.org/blog/CVE-2025-66478
github	www.github.com/Ashwesker/Blackash-CVE-2025-55182
github	www.github.com/fatguru/CVE-2025-55182-scanner
github	www.github.com/sickwell/CVE-2025-55182
github	www.github.com/ejpir/CVE-2025-55182-poc
cisa	www.cisa.gov/sites/default/files/csv/known_exploited_vulnerabilities.csv
bleepingcomputer	www.bleepingcomputer.com/news/security/hackers-exploit-react2shell-in-automated-credential-theft-campaign/
web	www.web.nvd.nist.gov/view/vuln/detail

06 May 2026 00:00Current

7.5High risk

Vulners AI Score7.5

CVSS 210

CVSS 310

EPSS0.99562

RequireModule vulnerability React server libraries Arbitrary code execution Crafted requests