KEV Entry

CVE-2025-55182

Known Exploited Vulnerability Entry ENISA

Back to Catalog View Vulnerability
Entry Details
Confirmed Exploited

CVE-2025-55182

2026-04-08 02:00 CEST

Timestamps

2026-04-08

2026-04-08

Scope

Affected: Meta / React Server Components | Description: Flaw in how React decodes payloads sent to React Server Function endpoints enabled unauthenticated remote code execution. Apps supporting React Server Components may still be vulnerable even if not implementing any React Server Function endpoints. | Patched since: 2025/12/03 | Exploitation type: APT | Origin source: CNW | Notes: https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components#update-instructions

References
  • {'id': 'CVE-2025-55182', 'url': 'https://www.cve.org/CVERecord?id=CVE-2025-55182'}
  • {'id': 'EUVD-2025-2009839', 'url': 'https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-2009839'}
  • {'id': 'source', 'url': 'https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components#update-instructions'}

38ac1199-3029-45c5-a206-b268578a4ac6

ENISA
cce329bf-df49-4c6e-a027-80be2e6483bd

2026-10-02 08:52 CEST

2026-10-02 08:52 CEST

Evidence
1
Type Source Signal Confidence Details GCVE Metadata
csirt_report enisa-cnw-kev successful_exploitation 0.75
View details 
{
  "catalog": "ENISA / EU CSIRTs Network (CNW) KEV JSON",
  "cwes": [],
  "dateReported": "2026/04/08",
  "euvd": "EUVD-2025-2009839",
  "exploitationType": [
    "APT"
  ],
  "notes": "https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components#update-instructions",
  "originSource": "CNW",
  "patchedSince": "2025/12/03",
  "product": "React Server Components",
  "threatActorsExploiting": [],
  "vendorProject": "Meta",
  "vulnerabilityName": ""
}
 -
Export Options
JSON Object JSON API View Full Catalog