Breaking! React & Next.js Hit by CVSS 10.0 Bug
Every so often, a vulnerability drops that cuts through the noise — not because of the hype, but because it touches a large part of the modern web stack. CVE-2025-55182 is one of those.
This is an emerging, critical-severity issue in the React Server Components (RSC) ecosystem. Teams worldwide are rushing to understand what it means for them, what is at risk, and how fast they need to move.
The bottom line: This bug lets an attacker send a specially crafted payload to a vulnerable server and get it to execute arbitrary code — without any authentication or prior access. If the server is exposed and running a vulnerable version, it is open to remote exploitation.
React Server Components (RSC) extend React's rendering model to the server. Server Components run exclusively on the server and stream their output to the client through an internal protocol called Flight.
Sign in to read this course
A free account unlocks all 514 courses. 20 are readable without one.
What's inside
2 sections- 1 Table of Contents
- 2 Module 1: Remote Code Execution in React Server Components — CVE-2025-55182
More Vulnerability Briefings courses
View all 30Apache Commons Text Vulnerability: What You Should Know
Because the library is freely available, widely trusted, and saves developers from writing boilerplate text-processing code, it has been incorporated into a very large number of Java-base...
Atlassian Vulnerability: What You Should Know
This document covers a group of critical advisories describing a series of Remote Code Execution (RCE) vulnerabilities in Atlassian products. The vulnerabilities span multiple products —...
Authentication Bypass at the Security Edge: What You Should Know
Once all required configuration changes were made, attackers established SSL VPN tunnels to the affected devices using the newly created or hijacked accounts.
Next.js Authentication Bypass Vulnerability: What You Should Know
Next.js is a React-based web development framework created and maintained by Vercel. It is widely used to build fast, scalable, and SEO-friendly web applications.
ConnectWise ScreenConnect Vulnerability - What You Should Know
Critical security advisory covering CVE-2024-1709 (CVSS 10.0) and CVE-2024-1708 (CVSS 8.4) — authentication bypass and path traversal vulnerabilities in ConnectWise ScreenConnect.
Critical Code Injection in Ivanti EPMM: Breaking News
CVE-2026-1281 (and its close relative, CVE-2026-1340) demonstrate how a single unauthenticated code injection flaw in a mobile device management platform can translate into full-server co...
Interested in this course?
Contact us to book it or get a custom training plan for your team.