Remote Code Execution Vulnerability in React and Next.js Frameworks: December 2025
On December 3, 2025, the React team released a security advisory regarding a vulnerability, CVE-2025-55182, in the React server that could allow an unauthenticated, remote attacker to perform remote code execution on an affected device or system. For a description of this vulnerability, see the public React Security Advisory ["https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components"]. Cisco's standard practice is to update integrated third-party software components to later versions as they become available.
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2025-55182US | —OT kritisch | KEV | ||
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-serve… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- Security Vulnerability Policyexternal
- public React Security Advisoryexternal
- Remote Code Execution Vulnerability in React and Next.js Frameworks: December 2025self
- Cisco Security Vulnerability Policyexternal
- considering software upgradesexternal
- Cisco Support and Downloadsexternal
- Cisco Technical Assistance Center (TAC)external
- the advisoriesexternal
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan