Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2025-66478 (GCVE-0-2025-66478)
Vulnerability from cvelistv5
This CVE is a duplicate of CVE-2025-55182.
Replaced by CVE-2025-55182
Show details on NVD website{
"containers": {
"cna": {
"providerMetadata": {
"dateUpdated": "2025-12-03T18:04:08.459Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"rejectedReasons": [
{
"lang": "en",
"value": "This CVE is a duplicate of CVE-2025-55182."
}
],
"replacedBy": [
"CVE-2025-55182"
]
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2025-66478",
"dateRejected": "2025-12-03T18:04:08.459Z",
"dateReserved": "2025-12-02T17:09:52.015Z",
"dateUpdated": "2025-12-03T18:04:08.459Z",
"state": "REJECTED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2025-66478\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2025-12-03T18:15:47.200\",\"lastModified\":\"2025-12-03T18:15:47.200\",\"vulnStatus\":\"Rejected\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Rejected reason: This CVE is a duplicate of CVE-2025-55182.\"}],\"metrics\":{},\"references\":[]}}"
}
}
fkie_cve-2025-66478
Vulnerability from fkie_nvd
Published
2025-12-03 18:15
Modified
2025-12-03 18:15
Severity ?
Summary
Rejected reason: This CVE is a duplicate of CVE-2025-55182.
References
| URL | Tags |
|---|
Impacted products
| Vendor | Product | Version |
|---|
{
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Rejected reason: This CVE is a duplicate of CVE-2025-55182."
}
],
"id": "CVE-2025-66478",
"lastModified": "2025-12-03T18:15:47.200",
"metrics": {},
"published": "2025-12-03T18:15:47.200",
"references": [],
"sourceIdentifier": "security-advisories@github.com",
"vulnStatus": "Rejected"
}
ghsa-9qr9-h5gf-34mp
Vulnerability from github
Published
2025-12-03 19:07
Modified
2025-12-04 20:07
Severity ?
VLAI Severity ?
Summary
Next.js is vulnerable to RCE in React flight protocol
Details
A vulnerability affects certain React packages1 for versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 and frameworks that use the affected packages, including Next.js 15.x and 16.x using the App Router. The issue is tracked upstream as CVE-2025-55182.
Fixed in: React: 19.0.1, 19.1.2, 19.2.1 Next.js: 15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7, 16.0.7
The vulnerability also affects experimental canary releases starting with 14.3.0-canary.77. Users on any of the 14.3 canary builds should either downgrade to a 14.x stable release or 14.3.0-canary.76.
All users of stable 15.x or 16.x Next.js versions should upgrade to a patched, stable version immediately.
1 The affected React packages are: - react-server-dom-parcel - react-server-dom-turbopack - react-server-dom-webpack
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "next"
},
"ranges": [
{
"events": [
{
"introduced": "14.3.0-canary.77"
},
{
"fixed": "15.0.5"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "next"
},
"ranges": [
{
"events": [
{
"introduced": "15.1.0-canary.0"
},
{
"fixed": "15.1.9"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "next"
},
"ranges": [
{
"events": [
{
"introduced": "15.2.0-canary.0"
},
{
"fixed": "15.2.6"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "next"
},
"ranges": [
{
"events": [
{
"introduced": "15.3.0-canary.0"
},
{
"fixed": "15.3.6"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "next"
},
"ranges": [
{
"events": [
{
"introduced": "15.4.0-canary.0"
},
{
"fixed": "15.4.8"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "next"
},
"ranges": [
{
"events": [
{
"introduced": "15.5.0-canary.0"
},
{
"fixed": "15.5.7"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "next"
},
"ranges": [
{
"events": [
{
"introduced": "16.0.0-canary.0"
},
{
"fixed": "16.0.7"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-66478"
],
"database_specific": {
"cwe_ids": [
"CWE-502"
],
"github_reviewed": true,
"github_reviewed_at": "2025-12-03T19:07:11Z",
"nvd_published_at": "2025-12-03T18:15:47Z",
"severity": "CRITICAL"
},
"details": "A vulnerability affects certain React packages\u003csup\u003e1\u003c/sup\u003e for versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 and frameworks that use the affected packages, including Next.js 15.x and 16.x using the App Router. The issue is tracked upstream as [CVE-2025-55182](https://www.cve.org/CVERecord?id=CVE-2025-55182). \n\nFixed in:\nReact: 19.0.1, 19.1.2, 19.2.1\nNext.js: 15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7, 16.0.7\n\nThe vulnerability also affects experimental canary releases starting with 14.3.0-canary.77. Users on any of the 14.3 canary builds should either downgrade to a 14.x stable release or 14.3.0-canary.76.\n\nAll users of stable 15.x or 16.x Next.js versions should upgrade to a patched, stable version immediately.\n\n\u003csup\u003e1\u003c/sup\u003e The affected React packages are:\n- react-server-dom-parcel\n- react-server-dom-turbopack\n- react-server-dom-webpack",
"id": "GHSA-9qr9-h5gf-34mp",
"modified": "2025-12-04T20:07:06Z",
"published": "2025-12-03T19:07:11Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/vercel/next.js/security/advisories/GHSA-9qr9-h5gf-34mp"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66478"
},
{
"type": "PACKAGE",
"url": "https://github.com/vercel/next.js"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Next.js is vulnerable to RCE in React flight protocol"
}
wid-sec-w-2025-2738
Vulnerability from csaf_certbund
Published
2025-12-03 23:00
Modified
2025-12-04 23:00
Summary
Vercel Next.js und React Server Components (React2Shell): Schwachstelle ermöglicht Codeausführung
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung
Next.js ist ein Framework für React-basierte Web-Anwendungen.
React ist eine Open-Source-JavaScript-Bibliothek zur Erstellung von Benutzeroberflächen, insbesondere für Single-Page-Anwendungen.
Angriff
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Vercel Next.js und React ausnutzen, um beliebigen Programmcode auszuführen.
Betroffene Betriebssysteme
- Sonstiges
- UNIX
- Windows
{
"document": {
"aggregate_severity": {
"text": "hoch"
},
"category": "csaf_base",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "de-DE",
"notes": [
{
"category": "legal_disclaimer",
"text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
},
{
"category": "description",
"text": "Next.js ist ein Framework f\u00fcr React-basierte Web-Anwendungen.\r\nReact ist eine Open-Source-JavaScript-Bibliothek zur Erstellung von Benutzeroberfl\u00e4chen, insbesondere f\u00fcr Single-Page-Anwendungen.",
"title": "Produktbeschreibung"
},
{
"category": "summary",
"text": "Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Vercel Next.js und React ausnutzen, um beliebigen Programmcode auszuf\u00fchren.",
"title": "Angriff"
},
{
"category": "general",
"text": "- Sonstiges\n- UNIX\n- Windows",
"title": "Betroffene Betriebssysteme"
}
],
"publisher": {
"category": "other",
"contact_details": "csaf-provider@cert-bund.de",
"name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
"namespace": "https://www.bsi.bund.de"
},
"references": [
{
"category": "self",
"summary": "WID-SEC-W-2025-2738 - CSAF Version",
"url": "https://wid.cert-bund.de/.well-known/csaf/white/2025/wid-sec-w-2025-2738.json"
},
{
"category": "self",
"summary": "WID-SEC-2025-2738 - Portal Version",
"url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2025-2738"
},
{
"category": "external",
"summary": "GitHub Advisory Database vom 2025-12-03",
"url": "https://github.com/advisories/GHSA-9qr9-h5gf-34mp"
},
{
"category": "external",
"summary": "PoC auf GitHub vom 2025-12-03",
"url": "https://github.com/joshterrill/CVE-2025-55182-realistic-poc"
},
{
"category": "external",
"summary": "NSFOCUS Notice vom 2025-12-03",
"url": "https://nsfocusglobal.com/react-next-js-remote-code-execution-vulnerability-cve-2025-55182-cve-2025-66478-notice/"
}
],
"source_lang": "en-US",
"title": "Vercel Next.js und React Server Components (React2Shell): Schwachstelle erm\u00f6glicht Codeausf\u00fchrung",
"tracking": {
"current_release_date": "2025-12-04T23:00:00.000+00:00",
"generator": {
"date": "2025-12-05T06:07:14.393+00:00",
"engine": {
"name": "BSI-WID",
"version": "1.5.0"
}
},
"id": "WID-SEC-W-2025-2738",
"initial_release_date": "2025-12-03T23:00:00.000+00:00",
"revision_history": [
{
"date": "2025-12-03T23:00:00.000+00:00",
"number": "1",
"summary": "Initiale Fassung"
},
{
"date": "2025-12-04T23:00:00.000+00:00",
"number": "2",
"summary": "Bezeichner React2Shell als Referenz aufgenommen"
}
],
"status": "final",
"version": "2"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c19.0.1",
"product": {
"name": "Open Source React \u003c19.0.1",
"product_id": "T049091"
}
},
{
"category": "product_version",
"name": "19.0.1",
"product": {
"name": "Open Source React 19.0.1",
"product_id": "T049091-fixed",
"product_identification_helper": {
"cpe": "cpe:/a:open_source:react:19.0.1"
}
}
},
{
"category": "product_version_range",
"name": "\u003c19.1.2",
"product": {
"name": "Open Source React \u003c19.1.2",
"product_id": "T049092"
}
},
{
"category": "product_version",
"name": "19.1.2",
"product": {
"name": "Open Source React 19.1.2",
"product_id": "T049092-fixed",
"product_identification_helper": {
"cpe": "cpe:/a:open_source:react:19.1.2"
}
}
},
{
"category": "product_version_range",
"name": "\u003c19.2.1",
"product": {
"name": "Open Source React \u003c19.2.1",
"product_id": "T049093"
}
},
{
"category": "product_version",
"name": "19.2.1",
"product": {
"name": "Open Source React 19.2.1",
"product_id": "T049093-fixed",
"product_identification_helper": {
"cpe": "cpe:/a:open_source:react:19.2.1"
}
}
}
],
"category": "product_name",
"name": "React"
}
],
"category": "vendor",
"name": "Open Source"
},
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c15.0.5",
"product": {
"name": "Vercel Next.js \u003c15.0.5",
"product_id": "T049080"
}
},
{
"category": "product_version",
"name": "15.0.5",
"product": {
"name": "Vercel Next.js 15.0.5",
"product_id": "T049080-fixed",
"product_identification_helper": {
"cpe": "cpe:/a:vercel:next.js:15.0.5"
}
}
},
{
"category": "product_version_range",
"name": "\u003c15.1.9",
"product": {
"name": "Vercel Next.js \u003c15.1.9",
"product_id": "T049081"
}
},
{
"category": "product_version",
"name": "15.1.9",
"product": {
"name": "Vercel Next.js 15.1.9",
"product_id": "T049081-fixed",
"product_identification_helper": {
"cpe": "cpe:/a:vercel:next.js:15.1.9"
}
}
},
{
"category": "product_version_range",
"name": "\u003c15.2.6",
"product": {
"name": "Vercel Next.js \u003c15.2.6",
"product_id": "T049082"
}
},
{
"category": "product_version",
"name": "15.2.6",
"product": {
"name": "Vercel Next.js 15.2.6",
"product_id": "T049082-fixed",
"product_identification_helper": {
"cpe": "cpe:/a:vercel:next.js:15.2.6"
}
}
},
{
"category": "product_version_range",
"name": "\u003c15.3.6",
"product": {
"name": "Vercel Next.js \u003c15.3.6",
"product_id": "T049083"
}
},
{
"category": "product_version",
"name": "15.3.6",
"product": {
"name": "Vercel Next.js 15.3.6",
"product_id": "T049083-fixed",
"product_identification_helper": {
"cpe": "cpe:/a:vercel:next.js:15.3.6"
}
}
},
{
"category": "product_version_range",
"name": "\u003c15.4.8",
"product": {
"name": "Vercel Next.js \u003c15.4.8",
"product_id": "T049084"
}
},
{
"category": "product_version",
"name": "15.4.8",
"product": {
"name": "Vercel Next.js 15.4.8",
"product_id": "T049084-fixed",
"product_identification_helper": {
"cpe": "cpe:/a:vercel:next.js:15.4.8"
}
}
},
{
"category": "product_version_range",
"name": "\u003c15.5.7",
"product": {
"name": "Vercel Next.js \u003c15.5.7",
"product_id": "T049085"
}
},
{
"category": "product_version",
"name": "15.5.7",
"product": {
"name": "Vercel Next.js 15.5.7",
"product_id": "T049085-fixed",
"product_identification_helper": {
"cpe": "cpe:/a:vercel:next.js:15.5.7"
}
}
},
{
"category": "product_version_range",
"name": "\u003c16.0.7",
"product": {
"name": "Vercel Next.js \u003c16.0.7",
"product_id": "T049086"
}
},
{
"category": "product_version",
"name": "16.0.7",
"product": {
"name": "Vercel Next.js 16.0.7",
"product_id": "T049086-fixed",
"product_identification_helper": {
"cpe": "cpe:/a:vercel:next.js:16.0.7"
}
}
}
],
"category": "product_name",
"name": "Next.js"
}
],
"category": "vendor",
"name": "Vercel"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-55182",
"product_status": {
"known_affected": [
"T049084",
"T049083",
"T049082",
"T049093",
"T049081",
"T049092",
"T049086",
"T049085",
"T049080",
"T049091"
]
},
"release_date": "2025-12-03T23:00:00.000+00:00",
"title": "CVE-2025-55182"
},
{
"cve": "CVE-2025-66478",
"product_status": {
"known_affected": [
"T049084",
"T049083",
"T049082",
"T049093",
"T049081",
"T049092",
"T049086",
"T049085",
"T049080",
"T049091"
]
},
"release_date": "2025-12-03T23:00:00.000+00:00",
"title": "CVE-2025-66478"
}
]
}
CERTFR-2025-ALE-014
Vulnerability from certfr_alerte
[Mise à jour du 08 décembre 2025]
Le CERT-FR a connaissance d'exploitations pour la vulnérabilité CVE-2025-55182.
[Publication initiale]
Le 3 décembre 2025, React a publié un avis de sécurité relatif à la vulnérabilité CVE-2025-55182 affectant React Server Components et qui permet à un attaquant non authentifié de provoquer une exécution de code arbitraire à distance. L'éditeur de Next.js a également publié un avis de sécurité faisant référence à l'identifiant CVE-2025-66478. Cet identifiant a été rejeté en raison du doublon avec l'identifiant utilisé par React. Cette faille de sécurité est également connue sous le nom de React2Shell.
Cette vulnérabilité concerne plus précisément les React Server Functions. Même si une application n'utilise pas explicitement de telles fonctions, elle peut être vulnérable si elle supporte les React Server Components. En particulier, plusieurs cadriciels tels que Next.js implémentent de telles fonctions par défaut.
Les technologies React Server Components et React Server Functions sont relativement récentes (la version 19 de React a été publiée fin 2024) et toutes les applications utilisant la technologie React ne sont ainsi pas nécessairement affectées. Veuillez vous référer à la section systèmes affectés pour plus d'informations.
Le CERT-FR a connaissance de preuves de concept publiques pour cette vulnérabilité et anticipe des exploitations en masse.
Note : Le CERT-FR a connaissance de la mise en place de règles de blocages de la vulnérabilité au niveau de plusieurs pare-feu applicatifs web populaires. Bien que ces mécanismes puissent rendre l'exploitation de la vulnérabilité plus difficile, ils ne peuvent pas remplacer une mise à jour vers une version corrective.
Solutions
Le CERT-FR recommande de mettre à jour au plus vite les composants vers les versions correctives listées dans les avis éditeurs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| N/A | N/A | Expo sans les versions correctives de react-server-dom-webpack | ||
| N/A | N/A | Redwood SDK versions antérieures à 1.0.0-alpha.0 | ||
| Vercel | Next.js | Next.js versions 15.0.x antérieures à 15.0.5 | ||
| N/A | N/A | Waku sans les versions correctives de react-server-dom-webpack | ||
| Vercel | Next.js | Next.js versions 15.1.x antérieures à 15.1.9 | ||
| Vercel | Next.js | Next.js versions 15.5.x antérieures à 15.5.7 | ||
| Meta | React | react-server-dom-webpack, react-server-dom-parcel et react-server-dom-turbopack versions 19.2.x antérieures à 19.2.1 | ||
| Vercel | Next.js | Next.js versions 14.x canary | ||
| Vercel | Next.js | Next.js versions 15.3.x antérieures à 15.3.6 | ||
| N/A | N/A | React router avec le support de l'API RSC sans les derniers correctifs de sécurité | ||
| Meta | React | react-server-dom-webpack, react-server-dom-parcel et react-server-dom-turbopack versions 19.0.x antérieures à 19.0.1 | ||
| Vercel | Next.js | Next.js versions 15.4.x antérieures à 15.4.8 | ||
| Meta | React | react-server-dom-webpack, react-server-dom-parcel et react-server-dom-turbopack versions 19.1.x antérieures à 19.1.2 | ||
| Vercel | Next.js | Next.js versions 16.0.x antérieures à 16.0.7 | ||
| N/A | N/A | Vitejs avec le greffon plugin-rsc sans les derniers correctifs de sécurité | ||
| Vercel | Next.js | Next.js versions 15.2.x antérieures à 15.2.6 |
References
| Title | Publication Time | Tags | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Expo sans les versions correctives de react-server-dom-webpack",
"product": {
"name": "N/A",
"vendor": {
"name": "N/A",
"scada": false
}
}
},
{
"description": "Redwood SDK versions ant\u00e9rieures \u00e0 1.0.0-alpha.0",
"product": {
"name": "N/A",
"vendor": {
"name": "N/A",
"scada": false
}
}
},
{
"description": "Next.js versions 15.0.x ant\u00e9rieures \u00e0 15.0.5",
"product": {
"name": "Next.js",
"vendor": {
"name": "Vercel",
"scada": true
}
}
},
{
"description": "Waku sans les versions correctives de react-server-dom-webpack",
"product": {
"name": "N/A",
"vendor": {
"name": "N/A",
"scada": false
}
}
},
{
"description": "Next.js versions 15.1.x ant\u00e9rieures \u00e0 15.1.9",
"product": {
"name": "Next.js",
"vendor": {
"name": "Vercel",
"scada": true
}
}
},
{
"description": "Next.js versions 15.5.x ant\u00e9rieures \u00e0 15.5.7",
"product": {
"name": "Next.js",
"vendor": {
"name": "Vercel",
"scada": true
}
}
},
{
"description": "react-server-dom-webpack, react-server-dom-parcel et react-server-dom-turbopack versions 19.2.x ant\u00e9rieures \u00e0 19.2.1",
"product": {
"name": "React",
"vendor": {
"name": "Meta",
"scada": false
}
}
},
{
"description": "Next.js versions 14.x canary",
"product": {
"name": "Next.js",
"vendor": {
"name": "Vercel",
"scada": true
}
}
},
{
"description": "Next.js versions 15.3.x ant\u00e9rieures \u00e0 15.3.6",
"product": {
"name": "Next.js",
"vendor": {
"name": "Vercel",
"scada": true
}
}
},
{
"description": "React router avec le support de l\u0027API RSC sans les derniers correctifs de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "N/A",
"scada": false
}
}
},
{
"description": "react-server-dom-webpack, react-server-dom-parcel et react-server-dom-turbopack versions 19.0.x ant\u00e9rieures \u00e0 19.0.1",
"product": {
"name": "React",
"vendor": {
"name": "Meta",
"scada": false
}
}
},
{
"description": "Next.js versions 15.4.x ant\u00e9rieures \u00e0 15.4.8",
"product": {
"name": "Next.js",
"vendor": {
"name": "Vercel",
"scada": true
}
}
},
{
"description": "react-server-dom-webpack, react-server-dom-parcel et react-server-dom-turbopack versions 19.1.x ant\u00e9rieures \u00e0 19.1.2",
"product": {
"name": "React",
"vendor": {
"name": "Meta",
"scada": false
}
}
},
{
"description": "Next.js versions 16.0.x ant\u00e9rieures \u00e0 16.0.7",
"product": {
"name": "Next.js",
"vendor": {
"name": "Vercel",
"scada": true
}
}
},
{
"description": "Vitejs avec le greffon plugin-rsc sans les derniers correctifs de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "N/A",
"scada": false
}
}
},
{
"description": "Next.js versions 15.2.x ant\u00e9rieures \u00e0 15.2.6",
"product": {
"name": "Next.js",
"vendor": {
"name": "Vercel",
"scada": true
}
}
}
],
"affected_systems_content": "",
"closed_at": null,
"content": "## Solutions\n\nLe CERT-FR recommande de mettre \u00e0 jour au plus vite les composants vers les versions correctives list\u00e9es dans les avis \u00e9diteurs (cf. section Documentation). ",
"cves": [
{
"name": "CVE-2025-55182",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-55182"
},
{
"name": "CVE-2025-66478",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-66478"
}
],
"initial_release_date": "2025-12-05T00:00:00",
"last_revision_date": "2025-12-08T00:00:00",
"links": [
{
"title": "Bulletin d\u0027actualit\u00e9 CERTFR-2025-ACT-053 du 04 d\u00e9cembre 2025",
"url": "https://cert.ssi.gouv.fr/actualite/CERTFR-2025-ACT-053/"
}
],
"reference": "CERTFR-2025-ALE-014",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2025-12-05T00:00:00.000000"
},
{
"description": "connaissance d\u0027exploitations pour la vuln\u00e9rabilit\u00e9 CVE-2025-55182",
"revision_date": "2025-12-08T00:00:00.000000"
}
],
"risks": [
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
}
],
"summary": "**\u003cspan class=\"important-content\"\u003e[Mise \u00e0 jour du 08 d\u00e9cembre 2025]\u003c/span\u003e**\n\nLe CERT-FR a connaissance d\u0027exploitations pour la vuln\u00e9rabilit\u00e9 CVE-2025-55182.\n\n**[Publication initiale]**\n\nLe 3 d\u00e9cembre 2025, React a publi\u00e9 un avis de s\u00e9curit\u00e9 relatif \u00e0 la vuln\u00e9rabilit\u00e9 CVE-2025-55182 affectant React Server Components et qui permet \u00e0 un attaquant non authentifi\u00e9 de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance. L\u0027\u00e9diteur de Next.js a \u00e9galement publi\u00e9 un avis de s\u00e9curit\u00e9 faisant r\u00e9f\u00e9rence \u00e0 l\u0027identifiant CVE-2025-66478. Cet identifiant a \u00e9t\u00e9 rejet\u00e9 en raison du doublon avec l\u0027identifiant utilis\u00e9 par React. Cette faille de s\u00e9curit\u00e9 est \u00e9galement connue sous le nom de *React2Shell*. \n\nCette vuln\u00e9rabilit\u00e9 concerne plus pr\u00e9cis\u00e9ment les React Server Functions. M\u00eame si une application n\u0027utilise pas explicitement de telles fonctions, elle peut \u00eatre vuln\u00e9rable si elle supporte les React Server Components. En particulier, plusieurs cadriciels tels que Next.js impl\u00e9mentent de telles fonctions par d\u00e9faut. \n\nLes technologies React Server Components et React Server Functions sont relativement r\u00e9centes (la version 19 de React a \u00e9t\u00e9 publi\u00e9e fin 2024) et toutes les applications utilisant la technologie React ne sont ainsi pas n\u00e9cessairement affect\u00e9es. Veuillez vous r\u00e9f\u00e9rer \u00e0 la section syst\u00e8mes affect\u00e9s pour plus d\u0027informations.\n\nLe CERT-FR a connaissance de preuves de concept publiques pour cette vuln\u00e9rabilit\u00e9 et anticipe des exploitations en masse.\n\n*Note : Le CERT-FR a connaissance de la mise en place de r\u00e8gles de blocages de la vuln\u00e9rabilit\u00e9 au niveau de plusieurs pare-feu applicatifs web populaires. Bien que ces m\u00e9canismes puissent rendre l\u0027exploitation de la vuln\u00e9rabilit\u00e9 plus difficile, ils ne peuvent pas remplacer une mise \u00e0 jour vers une version corrective.* ",
"title": "Vuln\u00e9rabilit\u00e9 dans React Server Components",
"vendor_advisories": [
{
"published_at": "2025-12-03",
"title": "Billet de blogue React relatif \u00e0 la vuln\u00e9rabilit\u00e9 CVE-2025-55182",
"url": "https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components"
},
{
"published_at": "2025-12-03",
"title": "Billet de blogue Vercel relatif \u00e0 la vuln\u00e9rabilit\u00e9 CVE-2025-55182",
"url": "https://vercel.com/changelog/cve-2025-55182"
},
{
"published_at": "2025-12-03",
"title": "Bulletin de s\u00e9curit\u00e9 Facebook CVE-2025-55182",
"url": "https://www.facebook.com/security/advisories/cve-2025-55182"
}
]
}
ncsc-2025-0380
Vulnerability from csaf_ncscnl
Published
2025-12-03 20:11
Modified
2025-12-05 12:13
Summary
Kwetsbaarheden verholpen in React Server Components
Notes
The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:
NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.
NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.
This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings.
Feiten
React heeft kwetsbaarheden verholpen in bepaalde versies van React Server Components (specifiek voor versies 19.0.0, 19.1.0, 19.1.1 en 19.2.0).
Interpretaties
Een ongeauthenticeerde aanvaller kan een malafide HTTP-verzoek sturen naar elke Server Function-endpoint dat, wanneer het door React wordt verwerkt, kan leiden tot remote code execution op de server. Echter, zelfs als een Server Function-endpoint niet is geïmplementeerd, kan exploitatie nog steeds mogelijk zijn via React Server Components. Door deze fout kunnen aanvallers op afstand willekeurige code uitvoeren, wat de integriteit van de getroffen applicaties ernstig in gevaar brengt.
De kwetsbaarheid bevindt zich in de React versies 19.0, 19.1.0, 19.1.1 en 19.2.0 van:
- react-server-dom-webpack
- react-server-dom-parcel
- react-server-dom-turbopack
Als bovengenoemde pakketten worden gebruikt, upgrade dan onmiddellijk. Deze kwetsbaarheid is verholpen in de versies 19.0.1, 19.1.2 en 19.2.1. Als de React-code van uw applicatie geen server gebruikt, is uw applicatie niet gevoelig voor deze kwetsbaarheid. Eveneens, als uw applicatie geen framework, bundler of bundler-plugin gebruikt die React Server Components ondersteunt, is uw applicatie niet getroffen.
De volgende React-frameworks en bundlers zijn getroffen:
- Next
- React Router
- Waku
- @parcel/rsc
- @vitejs/plugin-rsc
- rwsdk
De kwetsbaarheid treft ook Next.js met App Router, en heeft hiervoor aanvankelijk het kenmerk CVE-2025-66478 toegewezen gekregen, maar is inmiddels als zelfstandig CVE-id teruggetrokken. De kwetsbaarheid bevindt zich in de Next.js-versies 14.3.0-canary, 15.x en 16.x en is verholpen in de volgende gepatchte versies: 14.3.0-canary.88, 15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7 en 16.0.7.
**Update**: Het NCSC heeft middels een openbare bron vernomen dat misbruik van de kwetsbaarheid met kenmerk CVE-2025-55182 sinds 3 december is waargenomen. Inmiddels is er publieke proof-of-conceptcode beschikbaar voor de betreffende kwetsbaarheid, wat het risico op grootschalig misbruik verhoogt.
Oplossingen
React heeft beveiligingsupdates uitgebracht om de kwetsbaarhedeid te verhelpen. Het NCSC adviseert om deze updates zo snel mogelijk te installeren. Zie de instructies van React voor meer informatie.
Dreigingsinformatie
Er is publieke PoC code beschrikbaar voor CVE-2025-55182 wat het risico op misbruik verhoogt.
Kans
high
Schade
high
CWE-502
Deserialization of Untrusted Data
{
"document": {
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE"
}
},
"lang": "nl",
"notes": [
{
"category": "legal_disclaimer",
"text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings."
},
{
"category": "description",
"text": "React heeft kwetsbaarheden verholpen in bepaalde versies van React Server Components (specifiek voor versies 19.0.0, 19.1.0, 19.1.1 en 19.2.0).",
"title": "Feiten"
},
{
"category": "description",
"text": "Een ongeauthenticeerde aanvaller kan een malafide HTTP-verzoek sturen naar elke Server Function-endpoint dat, wanneer het door React wordt verwerkt, kan leiden tot remote code execution op de server. Echter, zelfs als een Server Function-endpoint niet is ge\u00efmplementeerd, kan exploitatie nog steeds mogelijk zijn via React Server Components. Door deze fout kunnen aanvallers op afstand willekeurige code uitvoeren, wat de integriteit van de getroffen applicaties ernstig in gevaar brengt.\n\nDe kwetsbaarheid bevindt zich in de React versies 19.0, 19.1.0, 19.1.1 en 19.2.0 van:\n\n- react-server-dom-webpack\n- react-server-dom-parcel\n- react-server-dom-turbopack\n\nAls bovengenoemde pakketten worden gebruikt, upgrade dan onmiddellijk. Deze kwetsbaarheid is verholpen in de versies 19.0.1, 19.1.2 en 19.2.1. Als de React-code van uw applicatie geen server gebruikt, is uw applicatie niet gevoelig voor deze kwetsbaarheid. Eveneens, als uw applicatie geen framework, bundler of bundler-plugin gebruikt die React Server Components ondersteunt, is uw applicatie niet getroffen. \n\nDe volgende React-frameworks en bundlers zijn getroffen: \n\n- Next\n- React Router\n- Waku\n- @parcel/rsc\n- @vitejs/plugin-rsc\n- rwsdk\n\nDe kwetsbaarheid treft ook Next.js met App Router, en heeft hiervoor aanvankelijk het kenmerk CVE-2025-66478 toegewezen gekregen, maar is inmiddels als zelfstandig CVE-id teruggetrokken. De kwetsbaarheid bevindt zich in de Next.js-versies 14.3.0-canary, 15.x en 16.x en is verholpen in de volgende gepatchte versies: 14.3.0-canary.88, 15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7 en 16.0.7.\n\n**Update**: Het NCSC heeft middels een openbare bron vernomen dat misbruik van de kwetsbaarheid met kenmerk CVE-2025-55182 sinds 3 december is waargenomen. Inmiddels is er publieke proof-of-conceptcode beschikbaar voor de betreffende kwetsbaarheid, wat het risico op grootschalig misbruik verhoogt.",
"title": "Interpretaties"
},
{
"category": "description",
"text": "React heeft beveiligingsupdates uitgebracht om de kwetsbaarhedeid te verhelpen. Het NCSC adviseert om deze updates zo snel mogelijk te installeren. Zie de instructies van React voor meer informatie.",
"title": "Oplossingen"
},
{
"category": "description",
"text": "Er is publieke PoC code beschrikbaar voor CVE-2025-55182 wat het risico op misbruik verhoogt.",
"title": "Dreigingsinformatie"
},
{
"category": "general",
"text": "high",
"title": "Kans"
},
{
"category": "general",
"text": "high",
"title": "Schade"
},
{
"category": "general",
"text": "Deserialization of Untrusted Data",
"title": "CWE-502"
}
],
"publisher": {
"category": "coordinator",
"contact_details": "cert@ncsc.nl",
"name": "Nationaal Cyber Security Centrum",
"namespace": "https://www.ncsc.nl/"
},
"references": [
{
"category": "external",
"summary": "Reference",
"url": "https://aws.amazon.com/blogs/security/china-nexus-cyber-threat-groups-rapidly-exploit-react2shell-vulnerability-cve-2025-55182/"
},
{
"category": "external",
"summary": "Reference",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-55182"
},
{
"category": "external",
"summary": "Reference",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66478"
},
{
"category": "external",
"summary": "Reference",
"url": "https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components"
},
{
"category": "external",
"summary": "Reference",
"url": "https://www.wiz.io/blog/critical-vulnerability-in-react-cve-2025-55182"
}
],
"title": "Kwetsbaarheden verholpen in React Server Components",
"tracking": {
"current_release_date": "2025-12-05T12:13:36.590522Z",
"generator": {
"date": "2025-08-04T16:30:00Z",
"engine": {
"name": "V.A.",
"version": "1.3"
}
},
"id": "NCSC-2025-0380",
"initial_release_date": "2025-12-03T20:11:57.728117Z",
"revision_history": [
{
"date": "2025-12-03T20:11:57.728117Z",
"number": "1.0.0",
"summary": "Initiele versie"
},
{
"date": "2025-12-05T12:13:36.590522Z",
"number": "1.0.1",
"summary": "Het NCSC heeft middels een openbare bron vernomen dat misbruik van de kwetsbaarheid met kenmerk CVE-2025-55182 sinds 3 december is waargenomen. Inmiddels is er publieke proof-of-conceptcode beschikbaar voor de betreffende kwetsbaarheid, wat het risico op misbruik verhoogt."
}
],
"status": "final",
"version": "1.0.1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-1"
}
}
],
"category": "product_name",
"name": "react-server-dom-parcel"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-2"
}
}
],
"category": "product_name",
"name": "react-server-dom-turbopack"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-3"
}
}
],
"category": "product_name",
"name": "react-server-dom-webpack"
}
],
"category": "vendor",
"name": "Meta"
},
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-4"
}
}
],
"category": "product_name",
"name": "react-server-dom-parcel"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-5"
}
}
],
"category": "product_name",
"name": "react-server-dom-turbopack"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-6"
}
}
],
"category": "product_name",
"name": "react-server-dom-webpack"
}
],
"category": "vendor",
"name": "Meta Open Source"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-55182",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"notes": [
{
"category": "other",
"text": "Deserialization of Untrusted Data",
"title": "CWE-502"
},
{
"category": "description",
"text": "React Server Components versions 19.0.0 to 19.2.0 contain a critical unauthenticated remote code execution vulnerability due to unsafe deserialization of HTTP request payloads, necessitating immediate upgrades to fixed versions.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-55182 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-55182.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 10.0,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6"
]
}
],
"title": "CVE-2025-55182"
},
{
"cve": "CVE-2025-66478",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"notes": [
{
"category": "other",
"text": "Deserialization of Untrusted Data",
"title": "CWE-502"
},
{
"category": "description",
"text": "A vulnerability tracked as CVE-2025-55182 has been identified in specific React packages, including Next.js versions 15.x and 16.x, necessitating upgrades to patched versions.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-66478 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-66478.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 10.0,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6"
]
}
],
"title": "CVE-2025-66478"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…