[Hackers]

CVE-2025-55182 is major. One of the biggest vulns to hit this year in terms of how widespread and nutty this RCE is.

The vulnerability is present in versions 19.0, 19.1.0, 19.1.1, and 19.2.0 of:

react-server-dom-webpack
react-server-dom-parcel
react-server-dom-turbopack

Some React frameworks and bundlers depended on, had peer dependencies for, or included the vulnerable React packages. The following React frameworks & bundlers are affected: next, react-router, waku, @parcel/rsc, @vitejs/plugin-rsc, and rwsdk.

React Server Functions allow a client to call a function on a server. React provides integration points and tools that frameworks and bundlers use to help React code run on both the client and the server. React translates requests on the client into HTTP requests which are forwarded to a server. On the server, React translates the HTTP request into a function call and returns the needed data to the client.

An unauthenticated attacker could craft a malicious HTTP request to any Server Function endpoint that, when deserialized by React, achieves remote code execution on the server. Further details of the vulnerability will be provided after the rollout of the fix is complete.

Make sure your Github is secure:
https://github.com//BankkRoll//Quickchec...78-Next.js

Check your personal servers:
https://github.com//fatguru//CVE-2025-55182-scanner

Pentest your own personal server:
https://github.com//Ashwesker//Blackash-CVE-2025-55182

[Terry A. Davis]

First time in a hot minute I've seen something like this.

Actually, I think it's the first time I've seen a 10 on the scale as well. Sheesh Kebab engineers around the world aren't going to have the greatest of days today.

[Money-]

Another next.js hot CVE again after last year 2024 one. We spamming scans now to hit a target lul.

[Hackers]

First time in a hot minute I've seen something like this.

Actually, I think it's the first time I've seen a 10 on the scale as well. Sheesh Kebab engineers around the world aren't going to have the greatest of days today.

Another next.js hot CVE again after last year 2024 one. We spamming scans now to hit a target lul.

---

Yeah, definitely a worrisome CVE compared to others.
We're all set on our side already, but I imagine some companies are scrambling to push out new production releases

I saw 1 post that recommended a downgrade, another for upgrades, depending on where you are with versioning (Next.js in that specific case). Fun lol

[Stanley]

I'm Stanley HF's helper bot. The OP (original poster) of this thread wants everyone to see this page and has elected to bump it to the top of the showthread listing. Since HF doesn't want a ton of LQP (Low Quality Posts) this is the best method of bumping your content. There is a small βyte fee for each bump. Any OP can bump any of their threads on HF from the linked icon on the top of their first post.

If you haven't already read the first post of this thread we encourage you to do so.

Thanks,
Stanley

[Hackers]

It seriously concerns me how dead this thread is with how critical & widespread this exploit was/is. There theoretically should be way more people talking about this on HF, to protect their servers.

More info on in the wild use, still ongoing:
https://cloud.google.com/blog/topics/thr...2025-55182

[Terry A. Davis]

It seriously concerns me how dead this thread is with how critical & widespread this exploit was/is. There theoretically should be way more people talking about this on HF, to protect their servers.

More info on in the wild use, still ongoing:
https://cloud.google.com/blog/topics/thr...2025-55182

Because most people would get their news elsewhere, and just simply don't care enough to check here.
Probably people do care, but not the teenagers who come on here.

They'll come in droves, in say, 90 days once most services have been patched and then ask for exploits.

[Hackers]

They'll come in droves, in say, 90 days once most services have been patched and then ask for exploits.

lmao true