React Server Components RCE (CVE-2025-55182): pre-auth deserialization flaw

What happened

On 3 December 2025, the React team disclosed CVE-2025-55182, a pre-authentication remote code execution vulnerability in React Server Components. A crafted request to an RSC endpoint could achieve code execution without any login.

The announcement (React blog, 3 Dec 2025) names react-server-dom-parcel, react-server-dom-webpack, and react-server-dom-turbopack in the 19.0.0, 19.1.0, 19.1.1, and 19.2.0 lines. Bundlers and frameworks that expose the RSC flight protocol — Next.js App Router deployments prominently among them — inherited the exposure until they bumped the underlying React packages.

Impact

Pre-auth RCE on the storefront tier is the worst starting position: no credential phishing needed, just a direct request. A compromised Node process can read server environment (API keys, Magento integration tokens, payment webhooks), poison SSR output for all visitors, and pivot into internal services that trust the frontend.

Because the vulnerable code sits deep in shared packages, many teams did not realize they shipped it — npm ls react-server-dom-webpack was the moment of discovery.

Root cause in one paragraph

The RSC flight decoder deserialized attacker-influenced data without sufficient validation of the component graph it was asked to reconstruct; a payload that abused that trust chain escaped the intended data plane and reached code execution in the server process.

What to do now

• Upgrade React to the patched releases (19.0.1, 19.1.2, 19.2.1 or later per line) and redeploy every SSR host — a lockfile bump without a redeploy changes nothing.
• Upgrade Next.js (or your RSC framework) to a release that pins the fixed React packages.
• Run npm ls / pnpm why for react-server-dom-* across all apps; patch internal tools and preview environments too, not just production.
• Block RSC flight paths (/_next/*, custom flight endpoints) from untrusted origins at the WAF if you cannot patch immediately — this is mitigation, not a fix.
• Rotate server-side secrets (Magento API tokens, payment keys, search keys) on any host that ran a vulnerable version while exposed.

What this means for Magento stores

If your storefront is traditional Luma or Hyva (PHP-rendered), this CVE does not execute against Magento itself — but it executes against the Node tier in front of it. Treat SSR hosts with the same seriousness as PHP: minimal env, read-only filesystem where possible, no long-lived admin tokens in process.env of an edge-rendered app, and ownership checks re-applied in Magento's GraphQL layer even when the frontend claims the user is logged in.

Sources

• NVD: CVE-2025-55182
• React blog: critical vulnerability announcement, 3 Dec 2025
• Canadian Centre for Cyber Security advisory AL25-018

Next in this series: Fortinet FortiOS signature bypass (CVE-2025-59718) — /blog/cve-2025-fortinet-59718