Executive brief
A critical vulnerability has been identified in React and Next.js, popular web development frameworks used to build modern user interfaces. This flaw exists in the way the frameworks handle server-side components and could allow an attacker to execute malicious code on the application server. If exploited, this could lead to a complete compromise of the server, unauthorized access to customer data, and disruption of business operations.
Technical details
A remote code execution (RCE) vulnerability exists in the React Server Flight protocol, specifically affecting React Server Components (RSC) and Server Functions. The flaw allows an unauthenticated remote attacker to execute arbitrary code on the application server by sending specially crafted requests. The issue is triggered during the processing of server actions, as evidenced by WAF mitigation strategies targeting 'next-action' and 'rsc-action-id' headers. Patches are available in React versions 19.0.1, 19.1.2, and 19.2.1, as well as updated Next.js releases. AWS managed services are not affected, but self-hosted environments require immediate updates.
Affected products
- Meta React 19.0, 19.1, 19.2
- Vercel Next.js 15.x, 16.x, 14.3.0-canary.77 and later canary releases
CVE identifiers
- CVE-2025-55182
- CVE-2025-66478
Timeline
- 2025-12-03: advisory: AWS published security bulletin AWS-2025-030.
- 2025-12-04: disclosed: Public disclosure of the vulnerability.