# Summary of CVE-2025-55182

By Steven Van · 2025-12-03

Vercel deployed free WAF rules against a critical React Server Components RCE flaw, but says a patched upgrade is still required.

**CVE-2025-55182**, a critical-severity vulnerability in React Server Components, affects React 19 and frameworks built on it, including Next.js (CVE-2025-66478). Under certain conditions, specially crafted requests could lead to unintended remote code execution.

[Vercel](<https://creatorstoolbox.com/tools/vercel>) deployed new WAF rules to automatically protect all projects hosted on its platform at no cost, and worked with the React team to share mitigation recommendations with other large WAF and CDN providers. Vercel says not to rely on the WAF for full protection: immediate upgrades to a patched version are required, regardless of hosting provider.

The vulnerability affects versions 19.0, 19.1.0, 19.1.1, and 19.2.0 of react-server-dom-parcel and react-server-dom-webpack, as included in affected frameworks.

See the [React2Shell security bulletin](<https://vercel.com/kb/bulletin/react2shell>) for upgrade guidance.

[![](<https://images.ctfassets.net/hjgychtc108g/44YxsiH0DzV5EstphbDoUl/d2d7c028412e1df6f7678d928d971e0b/react2shell-bulletin-og.png>)](<https://vercel.com/kb/bulletin/react2shell>)

![Vercel](<https://www.google.com/s2/favicons?domain=vercel.com&sz=128>)

Vercel

The platform for frontend developers — deploy, preview, and scale web apps and AI agents with zero config.

[View Vercel →](<https://creatorstoolbox.com/tools/vercel>)

[Original source](<https://vercel.com/kb/bulletin/react2shell>)

[Read Summary of CVE-2025-55182 on Creators Toolbox](<https://creatorstoolbox.com/blog/vercel-summary-of-cve-2025-55182>)

---
Canonical source: https://creatorstoolbox.com/blog/vercel-summary-of-cve-2025-55182