A vulnerability in the server components of React allows for code execution on the server.
A vulnerability (CVE-2025-55182) has been eliminated in the server components of the React web framework (RSC, React Server Components), which allowed arbitrary code execution on the server through a request to the server handler. The vulnerability has been assigned a critical danger level (10 out of 10). It manifests in the experimental components react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack, used for executing functions and rendering interface elements on the server rather than on the client side […]
