Meta React Server Components Remote Code Execution Vulnerability

What happened

Meta React Server Components contains a remote code execution vulnerability that could allow unauthenticated remote code execution by exploiting a flaw in how React decodes payloads sent to React Server Function endpoints. Please note CVE-2025-66478 has been rejected, but it is associated with CVE-2025- 55182.

Affected versions

React Server Components: 19.0.0 through 19.0.0 (semver); 19.1.0 through 19.1.1 (semver); 19.2.0 through 19.2.0 (semver) Fixed: See vendor advisory.

Why it matters

This source correlation may provide earlier visibility while structured CVE metadata is still being updated.

Detection & mitigation

• Review the original advisory and validate affected versions.
• Apply vendor-provided updates or mitigations when available.