Exploit for Deserialization of Untrusted Data in Facebook React

React CVE-2025-55182 Vulnerability Scanner A bash script to s...

@amazeelabs/bridge-waku (>=1.1.0, <=2.0.1), @amazeelabs/executors (>=3.0.0, <=3.1.14) +52 more potentially affected by CVE-2025-55182 via react-server-dom-webpack (19.0.0-rc-6230622a1a-20240610)

react-server-dom-webpack NPM version 19.0.0-rc-6230622a1a-20240610 is affected by a known vulnerability. The following packages have a transitive dependency on react-server-dom-webpack and may be impacted: - @amazeelabs/bridge-waku =1.1.0, =3.0.0, =1.1.0, =1.1.0, =1.0.0-canary.12245,...

@redwoodjs/sdk (>=0.0.63-test.2, <=0.0.79), @storybook/experimental-nextjs-rsc (>=0.0.0-pr-31893-sha-392fa9a5, <=0.0.0-pr-31893-sha-f0bf2189) +1 more potentially affected by CVE-2025-55182 via react-server-dom-webpack (19.2.0-canary-39cad7af-20250411)

react-server-dom-webpack NPM version 19.2.0-canary-39cad7af-20250411 is affected by a known vulnerability. The following packages have a transitive dependency on react-server-dom-webpack and may be impacted: - @redwoodjs/sdk =0.0.63-test.2, =0.0.0-pr-31893-sha-392fa9a5, =0.0.79-test.2025050614455...

@amazeelabs/bridge-waku (>=1.1.0, <=2.0.1), @amazeelabs/executors (>=3.0.0, <=3.1.14) +52 more potentially affected by CVE-2025-55182 via react-server-dom-webpack (19.0.0-rc-6230622a1a-20240610)

react-server-dom-webpack NPM version 19.0.0-rc-6230622a1a-20240610 is affected by a known vulnerability. The following packages have a transitive dependency on react-server-dom-webpack and may be impacted: - @amazeelabs/bridge-waku =1.1.0, =3.0.0, =1.1.0, =1.1.0, =1.0.0-canary.12245,...

Arbitrary Code Injection

Overview react-server-dom-webpack is a React Server Components bindings for DOM using Webpack. This is intended to be integrated into meta-frameworks. It is not intended to be imported directly. Affected versions of this package are vulnerable to Arbitrary Code Injection via unsafe deserializatio...

@redwoodjs/sdk (>=0.0.63-test.2, <=0.0.79), @storybook/experimental-nextjs-rsc (>=0.0.0-pr-31893-sha-392fa9a5, <=0.0.0-pr-31893-sha-f0bf2189) +1 more potentially affected by CVE-2025-55182 via react-server-dom-webpack (19.2.0-canary-39cad7af-20250411)

react-server-dom-webpack NPM version 19.2.0-canary-39cad7af-20250411 is affected by a known vulnerability. The following packages have a transitive dependency on react-server-dom-webpack and may be impacted: - @redwoodjs/sdk =0.0.63-test.2, =0.0.0-pr-31893-sha-392fa9a5, =0.0.79-test.2025050614455...

CVE-2025-55182

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes...

CVE-2025-55182

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes...

CVE-2025-55182: Deserialization of Untrusted Data

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes...

Node.js React Server Components Unauthenticated Remote Code Execution (CVE-2025-55182)

Multiple Node.js React Server Components packages are affected by an unauthenticated remote code execution vulnerability. The following Node.js packages and versions are affected: - react-server-dom-webpack 19.0, 19.1.0, 19.1.1, 19.2.0 - react-server-dom-parcel 19.0, 19.1.0, 19.1.1, 19.2.0 -...