Meta Vulnerabilities and Affected Products
Vulnerabilities associated with React Server Components.
Products
Clear product- react-server-dom-parcel8 vulnerabilities
- react-server-dom-turbopack8 vulnerabilities
- react-server-dom-webpack8 vulnerabilities
- WhatsApp Business for Android2 vulnerabilities
- WhatsApp Business for iOS2 vulnerabilities
- WhatsApp for Android2 vulnerabilities
- WhatsApp for iOS2 vulnerabilities
- React Developer Tools Extension1 vulnerability
- React Server Components1 vulnerability
- tac_plus1 vulnerability
- Tacquito1 vulnerability
- WhatsApp cloud service1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2025-55182CRITICAL | React Server Components are Vulnerable to RCEA pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints. | CVSS10.0v3.1 | EPSS99.6% | PoCs435 | SignalsListed in CISA KEVKnown ransomware use1 Nuclei template | STIX |