PoC Index85,079 CVEs with PoCs

CVE-2025-55182

KEV RANSOMWARECRITICAL 10.0EPSS 99.8%

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.

Affected
Meta · react-server-dom-webpack · react-server-dom-turbopack · react-server-dom-parcel
CVSS v3.1 FB
10.0 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
EPSS
99.80% chance of exploitation in the next 30 days, 100th percentile
CISA KEV
added 2025-12-05, used in ransomware campaigns
Nuclei
critical · CWE-502
Published
2025-12-03
Updated
2026-10-07

Proof-of-concept exploits (328)

Nuclei templates (1)

Metasploit modules (1)

ExploitDB entries (1)

Vulhub environments (1)

Exploit collections (1)

Security advisories

References

Related