A critical unauthenticated remote code execution vulnerability (CVE-2025-55182, CVSS 10.0) in React Server Components allows attackers to craft malicious HTTP requests that execute arbitrary code through unsafe deserialization of payloads sent to Server Function endpoints.
The flaw affects react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack in versions 19.0 through 19.2.0.
If you’re running Next.js, React Router, Waku, or other RSC frameworks, congratulations, you’re probably vulnerable.
The oss-security heads-up links the fix, and the HN thread has the usual mix of panic and “I told you so” comments.
Careful with the PoCs: the most-starred repo of a GitHub account farming fake exploits was one for this CVE.
In-the-wild exploitation is already happening: Beelzebub.ai documented the PCPcat campaign which compromised over 59,000 Next.js servers through automated scanning, achieving a 64.6% success rate via prototype pollution attacks that extract .env files, SSH keys, and cloud credentials. Their C2 server was helpfully exposing operational metrics through unauthenticated endpoints. Why hack when you can just read the dashboard?